Privacy Policy

01Who we are, and the two roles

Greggy AI LLC, doing business as GreggyAI ("GreggyAI," "we," "us"), is a Virginia limited liability company — Virginia State Corporation Commission Entity ID 12023650. We build and operate AI agents that answer the phone, reply in website chat, and send and receive text messages and email on behalf of the businesses that use our platform. Our first customers are car dealerships, and the examples below use a dealership for that reason; the platform itself is not specific to one industry.

Almost everything in this policy depends on which of two relationships you have with us. Please read the one that fits you.

If you are not sure which one applies to you, ask the business you contacted — or write to us at corp@greggyai.ai and we will tell you whose records you are in and pass your request to them.

02A. When you deal with us directly

If you contact us about the platform, request early access, or are a user at a customer business, we collect:

• What you tell us — your name, email address, phone number, company, and whatever you write in a message or say on a call.
• Account information, if you are a user at a customer business — your name, work email, role and permissions, and a record of administrative actions taken on your account (role changes, password resets, being added or removed). Passwords are stored only as salted hashes.
• Ordinary server and security logs from our websites and services, which include IP addresses and request details, used to keep the service running and to stop abuse.

Cookies and browser storage on greggyai.ai

We do not run advertising or analytics trackers on greggyai.ai. There is no ad pixel, no third-party analytics tag, no session-recording script, and no cross-site tracking. The only things we put in your browser are functional:

• A sign-in key for the early-access area, held in your browser's session storage and discarded when you close the tab or sign out.
• Where a site of ours offers chat, a signed session identifier in an HttpOnly cookie so the conversation survives a page reload, plus the conversation itself saved in your own browser so you can pick it back up. See Website chat.

We use fonts served by Google Fonts on our website, which means Google receives your IP address as part of loading the font files.

03B. When you reach a business through one of our AI agents

This is the part most people are reading this page for. When you call, chat, or text a business that uses GreggyAI, an AI agent may handle the conversation. What follows describes exactly what happens, channel by channel. In every case the business you contacted is the one whose records these are.

Across all channels, the record we keep of a conversation is what was said in it — the transcript, and the details you chose to give, such as your name, phone number, email address, the vehicle or product you asked about, your timeline or budget if you mention it, and any appointment you book. We also keep the ordinary technical facts needed to deliver the conversation and prove what happened: which number was called or texted, when, how long it lasted, and for website chat the IP address the chat came from.

04Phone calls, recording and AI

Every call to a number we answer opens with a spoken notice, before anything you say is captured. The standard wording is:

Three things about that notice are worth stating plainly, because they are design decisions and not accidents:

• It is played by the phone carrier before the AI is connected. Nothing is streamed to us, and no audio of you exists, until the notice has finished playing. Recording begins after the notice, never before it.
• A business cannot switch it off. A business can reword the notice to match the recording line it already uses, but there is no setting that removes it. It plays on every inbound call.
• It plays everywhere, regardless of which state you are calling from. We do not try to work out whether your state requires everyone on a call to consent. We give the notice to every caller.

If you stay on the line after the notice, the AI agent takes the call. The standard greeting identifies it as an AI agent — for example, "Welcome to [business] — this is the AI agent." Businesses can write their own greeting, so the exact wording varies, and you can always ask the agent directly whether you are speaking to a person; it will tell you it is automated and offer to connect you with someone.

If you do not want the AI or the recording

Tell the agent, and ask for a person. Where the business has given us a number to forward to, we record your phone number as having declined, forward you to a human, and route your future calls to that number straight to a person with no AI and no recording on the line. If the business has not given us a forwarding number, we cannot complete that transfer — so if this matters to you, the reliable route is to ask the business for a direct line, and to tell us so we can get the decline on file.

What a call leaves behind

• A recording of the call and a written transcript of it.
• A short summary of what the call was about, generated automatically.
• Call details — the numbers involved, the time, the length, and the cost.
• A contact record for you in that business's customer system, created from the number you called from, so the business can follow up.
• If you type digits on your keypad, the agent is told how many digits you entered rather than the digits themselves, so a PIN or card number keyed in instead of spoken is not handed to the AI model. Please see the warning under What we never do about sensitive details either way.

If nobody is available and you leave a voicemail, your message is recorded and transcribed so the business can read it and text you back. A voicemail greeting is not the AI agent and does not carry the recording notice above — the act of leaving a message is the recording.

We do not make outbound sales calls. The AI agent answers calls that come in; it does not dial out.

05Website chat

The chat does not start, and nothing is captured, until you agree to it. Before the chat window will accept a message you are shown a plain-language notice and have to tick a box that says "I have read and agree to the privacy policy and SMS terms above." Until that box is ticked the server refuses the conversation outright. The notice you agree to reads:

We keep a record that you agreed, including the wording you were shown, its version, the time, and the language it was shown in.

The chat is always started by you. It does not pop itself open, and nothing about your browsing makes it appear — see What we never do.

What the chat records

• The conversation itself, and the details you give in it.
• The IP address the chat came from, and the time.
• Your consent record, as described above.
• If you type a phone number or email address into the chat, we read it out of your message and create a contact record for you in that business's system, so a salesperson can follow up. Giving a phone number in chat is also how you agree to a text reply — the notice says so before you start.
• If you never give any way to reach you, the conversation is still saved for the business, without a contact record attached.
• A message that trips our abuse filters (spam links, abusive language) is stored along with the reason it was flagged.

Your browser also keeps the conversation and your consent tick on your own device, so that you can close the window and come back to the same chat for a few hours. Clearing your browser storage clears that copy; it does not clear the business's copy.

When a person takes over

You can ask for a human at any time using the "Talk to a sales rep" button, which pages the business's staff. A salesperson can also take over on their own initiative from their queue, without you having asked. When that happens the chat header changes to "Live — chatting with a salesperson," and their replies are shown in a different colour from the assistant's. A person who takes over can read the whole conversation up to that point, including the part you had with the AI. If the conversation goes quiet, it hands back to the AI.

06Text messages

If you give a mobile number and opt in, you agree to receive SMS text messages about your enquiry, appointments and related customer care from the business, sent through GreggyAI as its messaging service. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe at any time, or HELP for help. Consent to receive messages is not a condition of any purchase.

How texting consent is recorded

There are four ways a number comes to be opted in, and we record which one it was, along with the date and time:

Two honest notes on the limits of that. First, starting the conversation is treated as agreement to be answered in it: if you text a business first, the AI will reply to you in that thread without a separate opt-in, because replying to you is the point. Second, a number we hold with no record either way — for example one loaded from a business's own existing customer list — is not blocked from being contacted. What is blocked is any number that has opted out. If you never want to hear from us, the reliable step is to opt out rather than to stay silent.

Stopping texts

Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT or REVOKE) to any message. The opt-out is recorded immediately and permanently against your number and you get one confirmation message. Reply HELP or INFO for help. Reply START if you later want messages again.

An opt-out is specific to the channel you sent it on. Replying STOP to a text stops texts. It does not by itself stop email from the business, and it does not remove you from its records. To stop everything, tell us or the business and ask for a full opt-out, which we can set across every channel at once.

What a text conversation leaves behind

Both sides of the conversation are stored as sent, in full, including the messages we send you. We keep the outbound copy exactly as the carrier delivered it, because that record is the proof of what was actually sent. There are no quiet hours built into the platform and no fixed cap on message frequency, which is why every disclosure says frequency varies.

07Email

Businesses can send email through the platform — appointment and enquiry follow-ups, and notifications. Before an email is queued we check whether the recipient has opted out of email, and a blocked message is stored as suppressed rather than sent, so the business can see that it was stopped. As with texts, the check is for the absence of an opt-out; it does not require a separate email opt-in.

Today there is no one-click unsubscribe link in these emails. To stop email from a business that uses us, reply to the email and say so, ask the business directly, or write to us and we will set the opt-out for you. We are building a standard unsubscribe header and link, and this section will be updated to say so when it ships rather than before.

We do not currently receive inbound email into the platform — an email you send to a business goes to that business's own mailbox, not to us.

08What we never do

This section is a commitment, not a description, and it is built into how the product is designed.

• We do not track your browsing. We do not follow you across pages or across sites, we do not read the page you are looking at to guess what you want, and we do not build a behavioural profile or an engagement score for you. What the AI knows is what you typed or said to it.
• Nothing fires at you because of your behaviour. The chat does not pop open, and no message is triggered, because you scrolled, lingered, or came back a third time. You start the conversation.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have no advertising business.
• We do not pool one business's customers with another's. Each business's records are kept separated from every other business's, and staff at one cannot see another's.
• We do not use a conversation to train AI models. See AI models and your conversations.

One caution in the other direction, because it is the honest thing to put on this page: please do not give an AI agent a card number, a bank account, a Social Security number, or a password, in chat, in a text, or out loud on a call. A conversation is stored as it happened. We strip our own system credentials out of anything the AI writes back, and keypad entries are masked as described above, but we do not detect and remove sensitive numbers from what you send us. If you need to hand over something like that, ask for a person and a proper channel for it.

09How the information is used

For conversations handled on a business's behalf (role B), the purposes are the business's, and they are the obvious ones: answering your question, finding the product or vehicle you asked about, booking or changing an appointment, taking a message, passing you to a person, and keeping a record of the exchange so whoever picks it up next knows what was already said.

We also use conversations for two purposes of our own, and both are worth naming explicitly:

• Running and securing the platform — delivering messages, diagnosing faults, stopping spam and abuse, and keeping an accurate record of what was sent, which is also how we demonstrate compliance with messaging rules.
• Checking and improving the quality of the AI — see the next two sections, because this is where people are involved and where an AI provider is involved, and you should know how.

Human review

People read these conversations. The chat notice says so, and it is true of every channel. Specifically:

• Staff at the business you contacted can read your conversations with its AI agent — chat transcripts, text threads, call transcripts and call recordings — in their customer system. That is the point of the product: the AI is answering on their behalf and they need the record.
• They can also rate a conversation for accuracy and quality, and mark it to be used for internal testing.
• A conversation marked for testing can be re-run against the current AI so we can see whether a newer version would have answered better. This is a simulation: it cannot send you a message, book you an appointment, or page a salesperson. Nothing from a re-run reaches you.
• A very small number of authorized GreggyAI personnel can access call monitoring and recordings across the businesses running on a given server, in order to operate and troubleshoot the telephone service. This access is restricted by role, is re-checked on every request, and is used to keep the service working — not to look through customer records.

10Who else sees it

We do not sell personal information and we do not share it with anyone for their own marketing. We use a deliberately short list of service providers, each doing one job, each handling the information only to deliver that job for us:

We may also disclose information when the law requires it, to respond to lawful legal process, to protect our rights or someone's safety, or in connection with a merger or sale of the business — in which case this policy travels with the information.

And once more, because a messaging rule turns on it: mobile information, opt-in data and consent are not shared with third parties or affiliates for their marketing or promotional purposes, and are passed to the service providers above only as needed to deliver the messaging itself.

11AI models and your conversations

The agent's replies are generated by a large language model provided by Anthropic. Your conversation is sent to Anthropic to produce the reply, and — on phone calls — your speech is sent to ElevenLabs to be turned into text and to generate the voice you hear.

We do not use your conversations to train or fine-tune AI models. The platform has a switch for capturing conversations as training examples and it is turned off in our production systems. The model-training work we do is done on synthetic, machine-generated conversations that contain no real customer, and on our own separate models. We instruct our AI providers to use what we send them only to deliver the service to us.

What we do use real conversations for, as described above, is human quality review and re-running a conversation against a newer version of the AI to compare answers. Neither produces a trained model from your words, and neither sends you anything.

The agent is a language model and can be wrong. Prices, availability, specifications, appointment times and anything else it tells you are not a binding offer or a guarantee — confirm the details with the business before relying on them.

12How long we keep it, and how it is protected

We are going to be straight with you about this rather than quote a comfortable-sounding number we do not enforce.

Conversation records do not expire on a timer today. Transcripts, call recordings, text threads, chat logs, contact records and the consent trail are kept for as long as the business we hold them for keeps its account with us, because that record is what the business relies on to serve you and what we rely on to show that a message was permitted. We delete them when the business asks us to, when a person asks us to and we are able to (see your rights), and when a business leaves the platform. Automatic expiry with a fixed retention window is something we are working on, and we will state the windows here when they are real and enforced.

Records that are not conversations expire sooner: sign-in sessions and tokens are short-lived, a website chat session identifier lasts twelve hours, and the copy of your chat kept in your own browser is good for a few hours before it is dropped.

Security

• Traffic to and from our services is encrypted in transit with TLS.
• Databases are not exposed to the public internet; they listen only to the application on the same machine.
• Access is by role, and the customer-facing AI service runs with read-only, low-privilege database access and holds none of our messaging or AI provider credentials, so a fault in the public-facing part cannot be used to change or exfiltrate records.
• Records belonging to different businesses are logically separated, and every query is forced through a tenant check that fails rather than returning unscoped data.
• Stored service credentials are encrypted, secrets are kept in an encrypted store, and our own credentials are stripped out of anything the AI writes.
• Administrative actions on accounts — role changes, password resets, members added or removed — are written to an append-only audit trail.
• If a security incident affects information we hold for a business, we notify that business promptly with what we know, so it can meet its own notification duties to you and to regulators on time.

If the business you contacted arranges financing or leasing, federal financial-privacy rules may treat what you told us — including on a recorded call — as nonpublic personal information. In that case we handle it as that business's service provider under those rules and under our contract with it, and that business's own financial-privacy notice describes your choices.

No system is perfectly secure, and we would rather you know what we have not finished than assume it. We do not currently hold a SOC 2 or ISO 27001 certification. If you need a description of our controls for a vendor review, write to corp@greggyai.ai and we will give you an accurate one.

13Your choices and your rights

The fastest routes

Rights under state privacy law

Depending on where you live, you may have the right to confirm whether we hold personal data about you and get a copy of it, to correct it, to have it deleted, to obtain it in a portable form, and to opt out of targeted advertising, the sale of personal data, and profiling used to make significant decisions about you. We do not conduct targeted advertising, we do not sell personal data, and we do not use automated profiling to make decisions of that kind — so on this platform those three opt-outs have nothing to act on, and you can still ask us to confirm that.

How to exercise them, and what happens:

• Send the request to corp@greggyai.ai, or by post or phone using the details at the end of this page. Tell us the phone number or email address you used and, if you know it, which business you were dealing with — that is how we find your records.
• We respond within 45 days, and will tell you if we need a single extension and why.
• We have to verify it is you before handing over or deleting anything, which normally means confirming control of the phone number or email address in the record. We will not ask you to create an account to make a request.
• An authorized agent may make a request for you with your written permission.
• If we refuse, you can appeal. Reply to our decision saying you want to appeal and a different person will review it; we will write back with the outcome and our reasons within 60 days. If you are still unsatisfied you may complain to your state Attorney General — for Virginia, the Office of the Attorney General at oag.state.va.us.
• We will not treat you worse for asking. No worse price, no worse service.

One limit you should know about. Where a conversation belongs to a business we work for (role B), we hold it on that business's behalf, and we are obliged to act on its instructions. If you ask us to delete it, we will pass your request to that business, act on it where we are able to, and tell you who to contact and what we did. We will not quietly drop the request.

Requests for access and deletion are handled by hand today rather than by a self-service button, which is why we ask for the identifiers above — it helps us find every record rather than the first one.

14Children

The platform is built for business-to-consumer communication between adults and is not directed at children. We do not knowingly collect personal information from anyone under 13, and our messaging programs are not age-gated because they are not intended for children at all. If you believe a child has given us information, write to corp@greggyai.ai and we will delete it.

15Changes to this policy

We will update this page when what we do changes, and we will move the "last updated" date at the top when we do. Where a change materially affects how your conversations are handled, we will re-ask for consent in the chat rather than rely on you re-reading this page — the consent notice is versioned precisely so that bumping it prompts again.

Several sections above say plainly that something is not built yet — a fixed retention clock, a one-click email unsubscribe. Those sentences are there on purpose. When we ship them, we will change the words here, and not before.

16How to reach us

Greggy AI LLC, doing business as GreggyAI
8401 Mayland Dr, Ste A, Richmond, VA 23294, USA
corp@greggyai.ai · 571-571-1951

For privacy requests, please put "Privacy request" in the subject line so it is routed straight away. If you are contacting us about a conversation you had with a business's AI agent, telling us the business's name and the number you used will get you an answer considerably faster.