Privacy Policy

This Privacy Policy explains how Marija Ilievska, doing business as Hartwork ("Hartwork", "we", "us"), collects, uses and shares personal information. It covers our website at https://hartworkai.com, the Hartwork client dashboard, and the AI phone, text and chat services we run for the businesses that are our clients. We serve businesses in the United States and Canada.

Questions about anything here? Email marie@hartworkai.com.

1. Two roles, depending on who you are

• If you visit our website, book a demo with us, or are a Hartwork client: we decide how your information is used, and this policy applies to you directly.
• If you call, text, chat with, or leave your details for one of our clients (for example, you call a gym that uses Hartwork): we handle your information on that business's behalf, following its instructions and our agreement with it. That business is responsible for its own privacy practices, and you can contact it directly. You can also reach us at marie@hartworkai.com.

2. What we collect

From website visitors

• How you use the website, only if you accept analytics cookies: pages viewed, device and browser type, how you arrived, and approximate location derived from your IP address. This comes through Google Analytics.
• Your cookie choice, stored in your browser.
• If you book a demo, the details you enter in Calendly, such as your name, email, phone number and business. Calendly collects them and shares them with us.
• Anything you send us by email.

From our clients

• Contact and business details: your name, business name, email, phone number, business hours, and the information about your services that you give us during onboarding.
• The email address you sign in to the dashboard with. You sign in with a one-time link sent by email. We do not collect or store passwords.
• Billing records: your plan, invoices and payment status. We bill by invoice and do not store card or bank details.
• Business registration details that phone carriers require before your business can send text messages: legal business name, business type, federal tax ID (EIN), registered address, and the name, title, email and mobile number of the person authorized to register.
• Files you upload during setup or with a change request, such as price lists, menus or policies.
• If you connect your Google mailbox so that emails your AI sends to your callers and leads go out from your own address: the email address of that mailbox, and your permission to send email from it. We can send email from your mailbox. We cannot read, change or delete your mail.

On behalf of our clients, about the people who contact them

• Phone number and caller ID, and name and email address if given.
• Call recordings, transcripts, summaries and outcomes (for example: booked, message taken, transferred). All calls handled by Hartwork are recorded, and our agents tell callers they are speaking with an AI on a recorded line.
• Text messages and website chat conversations with the AI.
• For people who submit a form on a client's website: the details entered, plus the exact consent wording shown, the time, the page and the IP address, kept as proof that consent was given.

3. How we use it

• To provide the services: answer calls and chats, call and text new leads back, send booking links, reminders and confirmations, and show results in the client's dashboard.
• If you connect your mailbox: to send emails on your behalf to your own callers and leads, such as a follow-up after a missed call or a link a caller asks for, and a test email to yourself when you ask for one. Nothing else.
• To set up, support and bill our clients, and to reply when you contact us.
• To keep the services secure and working, and to find and fix mistakes, including by reviewing recordings and transcripts.
• To understand how our website is used and improve it, only with your consent to analytics cookies.
• To meet legal obligations and to resolve disputes.

We do not sell personal information. We do not share it for targeted advertising. We do not use our clients' callers' or leads' information to train AI models.

Hartwork's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/terms/api-services-user-data-policy.

4. Who we share it with

We share personal information only with the service providers that run Hartwork, and only as much as each needs to do its job:

• ElevenLabs: the AI voice and chat agents that talk with callers and leads, including speech and language processing.
• Twilio: phone numbers, calls and text messages.
• Supabase: our database, dashboard sign-in and file storage, including call recordings.
• Vercel: hosting for our website and dashboard.
• Google Analytics: website analytics, only with your consent.
• Calendly: demo booking and, on the Pro plan, our clients' appointment booking.
• Payoneer: invoicing and payments.
• Resend: to send sign-in links and emails about your account and setup.
• Google (Gmail): to send emails from a client's own mailbox, only when that client has connected it.

The information our clients' callers and leads provide is visible to that client in its own dashboard, and to no other client. We may also disclose information when the law requires it, to protect people's rights and safety, or as part of a sale or transfer of the business, in which case this policy keeps applying to it.

5. Cookies

Our website sets no analytics cookies until you accept them, and we do not currently use advertising cookies. You can change your choice at any time with "Cookie settings" at the bottom of every page. Details are in our Cookie Policy at https://hartworkai.com/cookies.

6. AI and automated conversations

• People who reach a Hartwork agent by phone, text or chat are talking with an AI, not a person.
• The AI answers questions, takes messages, sends booking links and helps book appointments. It does not make decisions that have legal or similarly significant effects on anyone.
• We may review recordings and transcripts to check quality and correct mistakes.

7. How long we keep it

• Call recordings: 90 days from the date of the call, then permanently deleted.
• Transcripts, summaries and the rest of the call record: kept for as long as the business is a Hartwork client, so it can look back at its history.
• Proof-of-consent records: up to 4 years, so that consent can be shown if it is ever questioned.
• When a client's service ends, or has been paused for more than 30 days, its dashboard is archived: the client can no longer see it, nothing is deleted, and everything is restored if the client returns. Archived data is kept until the client asks us to delete it, and we delete it within 30 days of that request, except where the law requires us to keep it.
• If you called or contacted one of our clients, you can ask for your information to be deleted at any time (see section 10).
• A mailbox connection: until you disconnect it in your dashboard, remove Hartwork's access in your Google Account, or ask us to remove it.
• Billing records: as long as tax and accounting law requires.
• Website analytics: according to our Google Analytics retention settings.
• Totals that identify no one (such as the number of calls handled in a month) may be kept indefinitely.

8. How we keep it safe

• Each client can see only its own data, enforced in the database itself. Our providers encrypt data in transit and at rest, and dashboard sign-in uses one-time email links rather than passwords.
• Your federal tax ID is stored apart from your other details and shown in full only to Hartwork. In your dashboard you see only its last four digits.
• Uploaded files are private. They open only through links that expire after a few minutes.
• The permission that lets us send from a connected mailbox is stored encrypted, apart from your other details, and no dashboard user can read it. You can disconnect at any time in your dashboard settings.
• If a breach affects a client's data, we will notify that client in writing within 72 hours of becoming aware of it, and notify anyone else the law requires.

9. Children

Hartwork is a service for businesses and is not directed at children. We do not knowingly collect personal information from children under 16. If you believe we have, email us and we will delete it.

10. Your rights and choices

Depending on where you live, including California and other US states with privacy laws, and Canada, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising (we do none of these). We will not treat you differently for using these rights.

To make a request, email marie@hartworkai.com. We will confirm your identity using contact details we already hold and reply within 45 days. You may use an authorized agent. If we turn down a request, you can appeal by replying to our answer. If the appeal is also turned down, you can contact your state attorney general.

If your information reached us through one of our clients (for example, you called their business), we will pass your request to that business or handle it on its instructions.

• To stop text messages from a Hartwork agent, reply STOP.
• To stop calls, tell the agent during a call, or ask the business directly.
• To change your cookie choice, use "Cookie settings" at the bottom of any page.

Because we do not sell or share personal information for advertising, Global Privacy Control and Do Not Track signals have nothing further to switch off. Analytics cookies still wait for your consent either way.

In Canada, you may also withdraw consent, subject to legal and contractual limits, and you may complain to the Office of the Privacy Commissioner of Canada.

11. Categories of personal information (for California and other US state laws)

In the past 12 months we have collected these categories, for the purposes in section 3, and disclosed them only to the providers in section 4:

• Identifiers, such as name, phone number, email address and IP address: yes.
• Customer records, such as business, billing and business registration details: yes.
• Internet or network activity, such as website usage, only with consent: yes.
• Approximate location derived from an IP address: yes. We do not collect precise location.
• Audio and electronic information, such as call recordings: yes.
• Professional information, such as a client's business and role: yes.
• Sensitive personal information: we do not ask for it and do not use it to infer anything about anyone. A caller may mention something sensitive on a call; if so, it is treated like the rest of the call record: the recording is deleted after 90 days, and the transcript is kept as described in section 7.
• Biometric information: no. Recordings are not used to identify anyone by their voice.

12. Where it is stored

Our providers store and process information in the United States. If you are in Canada, your information may be processed in the United States and be subject to its laws.

13. Changes to this policy

When we change this policy, we will update the date at the top. If a change is significant, we will also tell our clients by email before it takes effect.

14. Contact

Marija Ilievska, doing business as Hartwork. Email: marie@hartworkai.com.