Privacy Policy
Last updated: October 29, 2026 | Effective: October 22, 2026
AYBIZA LLC operates the AYBIZA platform, where AI agents handle customer conversations for your business through voice and chat, plus a CRM and service desk, automations, analytics, and internal channels where your team directs and oversees its agents. This policy explains what data we collect, how we use it, who we share it with, and what rights you have. AYBIZA serves businesses only. We do not knowingly provide services to individuals acting in a personal capacity. References to “AYBIZA,” “we,” “us,” or “our” mean AYBIZA LLC.
1. Who We Are and Our Roles
AYBIZA LLC is a Wyoming limited liability company. We act in two legally distinct roles, and the split is straightforward:
- Controller for the data we collect to run our business relationship with you: account, business verification (KYB), legal-acceptance, and platform usage data. We decide why and how this data is processed.
- Processor for the customer content you and your AI agents create or store on the platform: conversations, voice recordings, CRM records, uploaded knowledge, agent memory, and widget-visitor data. We process this only on your documented instructions. You are the controller of your end-customers’ data. Our Data Processing Agreement (DPA) at /dpa, incorporated into our Terms, governs this processing.
2. What We Collect
Data we collect as controller:
- Account data: your name, work email, job title, company name, and authentication credentials. A work email from a verified business domain is required; consumer email addresses are not accepted. When you set up your organization you also tell us its industry, declared use case, team size, estimated monthly call volume, and billing country.
- Business verification (KYB) data: your legal business name, country, and website. We screen the legal name against sanctions lists, and a reviewer sees whether the website answers and how old its domain is. This is required for fraud prevention and regulatory compliance before your organization places outbound calls.
- Legal-acceptance records: the agreement version, timestamp, and IP address recorded when you accept our Terms, this policy, the DPA, or another agreement.
- Usage data: feature usage, API call volumes, credit consumption, session activity, IP addresses, browser and device information, and performance metrics. On the marketing website we collect only the request metadata and abuse-prevention signals needed to keep the site secure and available.
Customer content we process as processor (you are the controller of all of it):
- Conversations: transcripts, messages, and interaction outcomes from your agents and channels.
- Voice recordings: audio captured when you enable call recording, stored under your retention settings.
- CRM records: contacts, deals, support tickets, tasks, and other business records you enter.
- Uploaded knowledge content: documents and files you provide for retrieval and agent grounding.
- Agent memory: the long-term notes an agent retains to maintain context across conversations.
- Widget-visitor data: identifiers, messages, and verification details from visitors who interact with an agent you embed on your own site.
3. How We Use Information
We use the data we control to create and manage your account and workspace, verify your business before outbound calling, deliver the platform, process billing and credits, send service communications, provide support, detect and prevent fraud and abuse, comply with legal obligations (including TCPA, FCC rules, and OFAC sanctions screening), and improve platform performance using aggregated, non-identifying analytics.
AI agents and automation. Our platform lets your AI agents carry out tasks you configure, such as answering questions, updating records, and routing conversations. This is automation you direct and control. AYBIZA does not make solely automated decisions that produce legal or similarly significant effects about you. Where an agent acts on your end-customers, you as controller are responsible for any automated-decision disclosures and human-review measures that apply to your use.
No training on your content. AYBIZA does not use customer content to train AI models of its own. What the providers behind AYBIZA do is a separate question, and we answer it exactly rather than in one sentence, because the honest answer is not the same for all of them.
On AYBIZA’s own provider accounts, Anthropic, AWS Bedrock, OpenAI, Perplexity and xAI each publish terms saying they will not train on the content we send them. That is their own published wording, not a promise of ours, and it is what we rely on.
AYBIZA’s own website and phone agent reaches Anthropic’s models through OpenRouter, on our account. When you talk to that agent, what you say passes through OpenRouter, and every request we send it asks for zero data retention and refuses data collection.
Where a call is heard and answered, we cannot say the same yet. We reach two providers on our own accounts whose published terms let them train on what they are sent: AssemblyAI and Cartesia. Between them they hear your callers and speak your agents’ answers. Each offers an opt-out, and until we have set it on our accounts, their terms are the ones that apply.
ElevenLabs publishes that it may train on what it is sent, and offers an account-level opt-out. We set that opt-out on our own account on 17 August 2026; it covers what we send after that date and nothing sent before it. Deepgram keeps what it is sent for model improvement unless a request opts out. Every request we send it opts out by default since 6 October 2026, on our account and on yours, unless an agent’s speech settings turn the opt-out off; an opted-out request leaves nothing behind, and requests sent before that date did not carry it.
You can take this decision back from us. When you bring your own API keys (BYOK), your agents run on your accounts instead of ours, and your organization can be set to run on its own keys only — in that mode no leg of a call, whether speech, language or telephony, falls back to an AYBIZA key. On your own keys the agreement that governs is the one you hold with that provider, not this policy, and we cannot see its terms. One is worth naming: ElevenLabs’ training opt-out is a setting on each account, so on your own key yours is the switch that decides.
4. Legal Basis for Processing (GDPR)
For data subject to the EU GDPR or UK GDPR, we rely on:
- Contract performance (Article 6(1)(b)): processing account, KYB, and billing data to provide the services you contracted for.
- Legal obligation (Article 6(1)(c)): processing required for telecommunications law, sanctions screening, and financial regulation.
- Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, and aggregated analytics, where not overridden by your rights. You may object at any time (see Section 9).
Customer content we process on your behalf is governed by the DPA; you as controller establish the lawful basis for your end-customers’ data. We do not rely on consent to process business customer data. Where consent is required, it is obtained separately and can be withdrawn at any time.
5. Cookies and Tracking
The marketing website uses only essential cookies and browser storage required for core functionality, CSRF protection, and security. We use no analytics cookies, no advertising cookies, and no cross-site tracking pixels. Public forms may use a human-verification service (Cloudflare Turnstile) that processes browser and device signals to tell human traffic from automated abuse; it is used for security, not advertising. Because we do not track you across other sites, we do not act on Do Not Track signals, which are designed to limit exactly that kind of cross-site tracking. You can manage cookies in your browser, though disabling essential cookies may break core functionality.
Every cookie we set, on the website and in the app:
| Cookie | Where | Purpose | Lifetime |
|---|---|---|---|
_aybiza_com_key |
aybiza.com | Keeps form protection working and remembers your country for prices | 1 day |
_aybiza_session_v2 |
app.aybiza.com | Keeps you signed in | 30 days |
aybiza_mfa_device |
app.aybiza.com | Remembers a device that passed two-factor sign-in | 30 days |
ay_region |
app.aybiza.com | Sends you to the region that holds your data | 30 days |
aybiza_theme |
app.aybiza.com | Remembers light or dark display | 1 year |
The chat widget on a customer’s website sets no cookie. It keeps the visitor’s conversation in that browser’s local storage, under a key starting aybiza_widget:, until the conversation’s session expires, so the conversation survives a page reload.
Our status page, status.aybiza.com, is hosted by a third-party monitoring provider, which receives your IP address and browser details when you open it.
6. Sub-Processors and Sharing
We do not sell personal data, and we do not share it for cross-context behavioral advertising. To deliver the platform we engage vetted sub-processors for infrastructure, payments, telephony, AI and language models, speech processing, and web search, each under a data processing agreement. The current named list, with the role of each provider, is maintained in our DPA subprocessor schedule. When you use BYOK, the provider you chose is not an AYBIZA sub-processor; you control that relationship.
Text messages. When you call AYBIZA’s line, +1 936 236 7060, and want to book a meeting, AYBIZA’s AI agent can text you so you can type your email address instead of spelling it. Before any text is sent, the agent asks you in its own words, telling you why, that it is one or two texts from AYBIZA, that message and data rates may apply, and that you can reply STOP at any time. The text reads: “AYBIZA: Hi, this is AY from your call. Reply to this text with your email address and we’ll send your meeting invitation there. Reply STOP to opt out.” If your reply is not an email address, one more text asks for it again.
A text is sent only after you say yes, only to the number you are calling from, and at most three per call. Your answer is kept with the call’s recording and transcript.
SMS terms. By saying yes on the call, you agree to receive text messages from AYBIZA LLC at the number you are calling from. Message type: customer care messages about the meeting you asked to book, asking for your email address so we can send the invitation. Message frequency: one or two messages per call, never more than three. Msg & data rates may apply. Reply STOP to opt out at any time, or HELP for help. Carriers are not liable for delayed or undelivered messages. Questions: support@aybiza.com. We use your mobile number and your consent to receive texts only to send the messages you asked for. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging opt-in data and consent are never shared with any third party; the telephony providers that carry a message receive the number only to deliver it. Message and data rates may apply.
We may disclose data where required by law, valid court order, or regulatory demand, or to protect the rights, property, or safety of AYBIZA, our customers, or the public; where legally permitted, we notify you first. If AYBIZA is involved in a merger, acquisition, or asset sale, personal data may transfer as part of the transaction, and we will notify you of any change in ownership or use of your data.
7. International Data Transfers
AYBIZA hosts data in the United States on Amazon Web Services. Encrypted backup copies are held with a second cloud provider in the same jurisdiction as the data they protect, so backups introduce no additional cross-border transfer. For transfers from the EEA, United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (Module 2) and, for the UK, the ICO’s International Data Transfer Addendum; the mechanics and supplementary measures are set out in our DPA. For transfers from Argentina, under Personal Data Protection Law No. 25,326, we rely on the model agreement for international transfers approved by the Agencia de Acceso a la Información Pública (Resolución AAIP 198/2023), as set out in our DPA.
8. Data Retention
We keep personal data only as long as needed for the purpose it was collected, or as required by law. Where a window is configurable, your organization sets it.
| Data | Retention |
|---|---|
| Account data | Duration of your subscription, plus 30 days after closure for export, then deleted |
| Chat and text messages | 365 days by default for new organizations (an existing organization keeps its current setting); configurable from 30 days up to 10 years |
| Internal workspace messages | 365 days by default for new organizations (an existing organization keeps its current setting); configurable from 30 days up to 10 years |
| Call recordings | 90 days by default; configurable from 1 day up to 7 years. Deleted recordings are purged from storage after a 30-day grace period |
| Meeting transcripts | Follows your call retention setting |
| Call records and transcripts | 365 days by default for new organizations (an existing organization keeps its current setting); configurable from 30 days up to 10 years |
| Agent memory | 45 days by default; configurable from 1 day up to 2 years |
| Analytics and usage records | 365 days by default; configurable from 30 days up to 7 years. Deleted when the window ends, with no archive copy kept after it |
| Business verification (KYB) records | While your account is open |
| Closure record | Kept for 10 years after the closed account is purged: business name, country, website, the verification decision and sanctions result, and which terms and calling-rules versions were accepted and when. It holds no customer content |
| Billing and legal-acceptance records | While your account is open. Both are deleted from our systems when the closed account is purged, after the 30-day export period. Our payment processor keeps its own payment records under its own retention |
| Support tickets | No automatic expiry: kept until a ticket is deleted, then permanently removed after a 30-day grace period. An erasure request unlinks the person from their tickets and erases the subject and message text |
| Waitlist applications | 12 months after the last activity on the application |
| Region-launch requests | 12 months after we notify you that your region has launched; kept until then |
| Audit and access logs | One year. Retained for security and regulatory purposes, including support-access metadata recording who accessed data, what, and when — never the content itself. These records are not removed on request; the account they reference is anonymized instead |
When a retention period expires, data is permanently deleted or irreversibly anonymized. When you request erasure, we delete your account content, including support-channel messages, but retain the audit metadata above for security and regulatory reasons. A do-not-contact entry also stays after erasure, as a one-way hash with its reason removed, so a person who asked not to be contacted is not contacted again.
9. Your Rights
To exercise any right below, contact privacy@aybiza.com. We verify your identity, respond within 30 days (extendable by 60 days for complex requests, with notice), and do not charge for reasonable requests.
GDPR rights (EEA and UK). You may request access (Article 15), rectification (Article 16), erasure (Article 17), portability in a machine-readable format such as JSON or CSV (Article 20), restriction (Article 18), and objection to processing based on legitimate interests (Article 21). Where processing is based on consent, you may withdraw it at any time. You may lodge a complaint with your data protection authority; UK residents may contact the Information Commissioner’s Office at ico.org.uk.
CCPA/CPRA rights (California). You have the right to know what personal information we collect and why, to delete it (subject to legal exceptions), to correct it, and to non-discrimination for exercising these rights. AYBIZA does not sell personal information or share it for cross-context behavioral advertising, and does not use sensitive personal information beyond the purposes CCPA/CPRA permits. To submit a request, email privacy@aybiza.com with the subject “California Privacy Request.” You may use an authorized agent with written authorization.
Other US state privacy rights. Residents of states with comprehensive privacy laws have comparable rights to access, delete, correct, and obtain a portable copy of their personal data, to opt out of targeted advertising and profiling, and to appeal a declined request. AYBIZA does not conduct targeted advertising or profiling with legal effects, but you may still submit these requests. We honor the Global Privacy Control and other recognized universal opt-out signals as a valid opt-out of sale and targeted advertising.
Argentina (Law No. 25,326). You may request access to your personal data, and its rectification, update or deletion. We answer an access request within 10 calendar days and a request to rectify, update or delete within 5 business days. You may lodge a complaint with the Agencia de Acceso a la Información Pública, Argentina’s data protection authority.
End-customer requests. These rights cover data for which AYBIZA is the controller. If your end-customer asks about data we process on your behalf, they should contact you as their controller; we assist you in fulfilling valid requests as required by the DPA.
10. Voice and Biometric Data
When you enable voice, audio is processed by our speech sub-processors to run real-time conversations, and recordings are stored only when you turn on call recording. AYBIZA does not create voiceprints and does not use voice to uniquely identify any individual. Recordings are treated as ordinary audio, not as biometric identifiers. You are responsible for obtaining any recording consent the law requires in the jurisdictions you and your contacts are in. If you use a voice-cloning feature, you must have the written consent of the person whose voice is used.
11. Security
We apply technical and organizational safeguards appropriate to the risk, including encryption in transit and at rest, organization-level data isolation, least-privilege access controls, multi-factor authentication, and immutable audit logging. Our architecture is designed following the SOC 2 Trust Services Criteria; a third-party assessment is planned. Full details are at /security. To report a security vulnerability, email security@aybiza.com.
12. Children
AYBIZA is a business-to-business platform and is not directed to anyone under 18. Account registration requires verified business information. We do not knowingly collect personal data from individuals under 18, and any agent or widget you deploy must not target or be directed to children. If we learn we have collected data from someone under 18, we delete it promptly.
13. Contact and Changes
We may update this policy from time to time. We notify you of material changes by email to your registered work address at least 30 days before they take effect; minor changes such as formatting may be made without notice. The current version is always at /privacy, and the “Last updated” date reflects the latest revision. Continuing to use AYBIZA after a material change takes effect means you accept it; if you do not agree, you may close your account before the effective date.
Contact routing:
- Privacy and data-subject requests: privacy@aybiza.com
- EU and UK privacy inquiries: eu-privacy@aybiza.com
- Security and vulnerability reports: security@aybiza.com
- Legal notices: legal@aybiza.com
- General inquiries: info@aybiza.com
AYBIZA LLC, a Wyoming limited liability company. Business address: 32222 Tamina Rd Ste A5-11, The Woodlands, TX 77354. Registered agent: Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801.