Ivy Privacy & Data Policy

1. Who we are

Babaodi Tech Solutions, Houston, Texas, runs Ivy. For privacy questions or requests: [email protected].

2. What Ivy reads but does not keep

When you ask a question, Ivy reads the calendar events, emails or client records needed to answer it, from the systems you connected. Those systems remain the place your data lives; we don't copy your mailbox, calendar or client files into Ivy.

3. What we store

Account and settings: your business name, Ivy's name, greeting and voice, the people and phones you add, receptionist settings (hours, FAQs, intake questions, transfer numbers) and connector settings. Sign-in tokens for Google or Microsoft are stored encrypted.

Calls and conversations: for Ivy Receptionist, call records (caller number, time, length), the intake answers, a transcript and summary, and the recording if you turned recording on. For Ivy Assistant, a short log of questions, answers and prepared actions so you can review them.

Technical logs: minimal logs (such as time, usage minutes and errors) to run, secure and bill the service.

4. Services Ivy relies on

Cloudflare (hosting, database and security), Ultravox (real-time voice conversation and the AI models that power it), Cartesia (Ivy's voice) and Twilio (phone numbers and calls). If you connect them, Google (Calendar and Gmail) and Microsoft 365 (Outlook and Calendar). Each processes data only to provide its part of the service.

5. Google user data

Ivy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar and Gmail data only to answer your questions and to prepare and, after your confirmation, send emails and create events for you. We don't use it for advertising, don't sell it, don't use it to train AI models, and humans don't read it unless you ask us to for support, it's needed for security, or the law requires it.

6. Microsoft 365 data

If you connect Microsoft 365, Ivy uses Microsoft Graph with the permissions you approve (calendar, mail, sending) for the same purposes and under the same limits as Google data above. You can disconnect at any time from Ivy or from your Microsoft account.

7. Call recordings and callers

Recording is off unless your business turns it on. When it's on, callers hear that the call may be recorded. Callers' details are handled on behalf of the business they called; that business decides how to use them and is the one to contact about them.

8. How long we keep data

Call records, transcripts, summaries and question logs are kept while your account is active, or for a shorter period you choose. Recordings can be turned off or deleted at any time. Technical logs are kept only as long as needed for security and billing.

9. Deleting your data

Any phone can be unpaired and any connection removed from the admin. To delete your account and its stored data, use the delete option in the admin or email [email protected]; we'll confirm once it's done. Disconnecting Google or Microsoft deletes the stored sign-in for that account.

10. Security

Traffic is encrypted, sign-in tokens and connector secrets are encrypted at rest, the admin is behind single sign-on, each phone has its own revocable key, and sensitive answers open on screen behind Face ID instead of being read aloud. No system is perfect; if we learn of a breach affecting your data, we'll tell you promptly.

11. Health information and children

Ivy is not a HIPAA-compliant service today — please don't use it for protected health information. Ivy is a business tool and isn't directed at children under 13.

12. Changes and contact

We'll post changes here and tell your administrator about important ones. Questions or requests: [email protected].