Privacy Policy — WhiteBoxForge AI Receptionist

Last updated: June 26, 2026 · Version 1.1

In this Policy, "WhiteBoxForge," "we," "us," or "our" means HarbingerScope LLC, a Texas limited liability company doing business as "WhiteBoxForge." We operate the AI receptionist service available at aireceptionist.whiteboxforge.com (the "Service"). This Policy explains what we collect, how we use it, and your choices. Contact: HarbingerScope LLC d/b/a WhiteBoxForge, 7727 Vacek Meadows Loop, Richmond, Texas 77469 · [email protected].

1. Who this Policy is for

The Service has two kinds of people whose data we handle:

• Clients — the businesses that subscribe to the Service.
• Callers — the customers of our Clients, who call a phone line answered by the AI receptionist.

If you are a Caller, we process your information on behalf of the Client you called. For requests about your data, contact that business directly; we will support their response.

2. What we collect

From Clients: name, business name, email, phone, billing details (processed by Stripe — we do not store full card numbers), account settings, the website URL you submit, and the content you add to your receptionist (greeting, FAQ, knowledge base).

From Callers (during a call answered by the AI): the call audio recording and transcript, your name, phone number, service address, appointment details, and anything you tell the assistant. The assistant discloses that the call may be recorded; the Client is responsible for ensuring this disclosure meets the law in their and the caller's location.

Automatically: log data, device/IP, and usage analytics needed to run and secure the Service.

From the public web (demo only): when a prospect submits a website URL, we read that site's public pages to build a demo. We do not collect private data this way.

3. How we use it

To provide and operate the Service (answer calls, book appointments, send confirmations and summaries), to bill and support Clients, to secure and improve the Service, and to comply with law.

We do not sell your personal information. We do not use Client or Caller call content to train AI models.

4. Who we share it with (sub-processors)

We share data only with the vendors that power the Service, under contract and only as needed. The current list — with purpose and data shared — is published at /legal/subprocessors. We require these providers to protect the data and use it only to provide their service to us.

5. Retention & deletion

Demo agents and demo data are ephemeral (auto-deleted shortly after the demo). Durable Client and call data is retained for the life of the account and deleted within 90 days after termination, except where we must keep it to meet a legal obligation. Clients can request deletion at any time.

6. Security

We use encryption in transit (TLS) and at rest, access controls, and least-privilege practices. No system is perfectly secure, but we work to protect your data and will notify affected Clients of a breach as required by law.

7. Your U.S. state privacy rights

Depending on your state of residence — including under the California CCPA/CPRA, the Texas Data Privacy and Security Act, and the Virginia, Colorado, Connecticut, and Utah privacy laws — you may have the right to: confirm whether we process your information and access it; correct it; delete it; obtain a portable copy; opt out of "sale," "sharing," or targeted advertising (we do none of these); and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights, and you may use an authorized agent. Clients may exercise rights directly; Callers should contact the business they called, and we will assist. To make a request, email [email protected]. We will verify your identity and respond within the period required by law. Right to appeal: if we deny your request, you may appeal by replying to our decision or emailing [email protected]; if the appeal is denied you may contact your state Attorney General.

Sensitive information

Some information processed through the Service — such as the contents of phone calls — may be treated as "sensitive personal information" under certain state laws. We use it only to provide the Service and the purposes described in this Policy, and not to infer characteristics about you. Where applicable, you may have the right to limit our use of sensitive personal information.

Categories of personal information (CCPA/CPRA)

In the past 12 months we have collected: identifiers (name, phone, email, address); commercial information (subscription and booking details); audio and electronic information (call recordings, transcripts, summaries, and SMS/email content); internet and network activity (usage, IP, device); and coarse location inferred only from area code/region for time-zone purposes. Sources: you, your callers, your connected integrations, and automatic collection. Purposes: to provide, secure, bill for, support, and improve the Service. We do not sell or share personal information.

Voice & biometric data

The assistant speaks using a synthetic, library voice and is not designed to create, and does not create, a voiceprint or other biometric identifier of any caller. We process call audio to operate the Service (for speech recognition and quality), not to identify any individual by their voice, and we do not sell biometric information. Where a caller's jurisdiction regulates biometric identifiers — for example the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), or Washington law — the Client is responsible for any notice or consent its use of the Service requires.

Automated processing

The Service uses automated, AI-based systems to converse with callers and generate summaries. We do not use these systems to make decisions that produce legal or similarly significant effects about callers.

Cookies & analytics

Our websites use cookies and similar technologies for essential functionality, security, and the basic analytics needed to run and secure the Service. You can control non-essential cookies through your browser settings.

Law-enforcement & legal requests

We disclose personal information to government or law-enforcement authorities only when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect rights, safety, or security.

8. Children

The Service is for businesses and is not directed to children under 13.

United States only

The Service is offered in and intended for businesses and callers in the United States. We do not target or knowingly offer the Service to individuals in the EEA or UK.

9. Changes

We may update this Policy; we will change the "Last updated" date and, for material changes, notify Clients.

10. Contact

HarbingerScope LLC d/b/a WhiteBoxForge · 7727 Vacek Meadows Loop, Richmond, Texas 77469 · [email protected].