PRIVACY POLICY

1. INFORMATION WE COLLECT

2. HOW WE USE INFORMATION

We use information to:

• •Provide, operate, and maintain the Services
• •Process payments and manage subscriptions
• •Send account, billing, and service-related communications
• •Provide customer support
• •Maintain security, prevent fraud, and enforce our Terms of Service
• •Improve and develop the Services
• •Comply with legal obligations

We do not sell End Customer personal data to third parties.

3. OUR ROLE AS DATA PROCESSOR

With respect to End Customer data that our Customers submit to TreeROI, our Customer is the data controller and we act as a data processor/service provider. We process that data only:

• •To provide the Services to our Customer,
• •Per our Customer's instructions, and
• •As required by law.

Our Customers are responsible for having a lawful basis to collect, use, and share End Customer data with us, including obtaining necessary consents. A Data Processing Addendum governs this relationship in more detail.

4. SMS & EMAIL COMMUNICATIONS

TreeROI enables our Customers to send SMS, MMS, and email messages to their End Customers. Please note:

4A. VOICE AI & AGENCY-PROVISIONED COMMUNICATIONS

TreeROI offers voice AI calling and agency-provisioned SMS/voice features through our own accounts with Vapi Inc. and Twilio Inc. (our "Communications Providers"). When a Customer uses these features:

• •Data involved: call audio, call recordings (where enabled by the Customer), call transcripts, phone numbers, SMS/text content and metadata, and delivery/consent status.
• •Purpose: this data is used solely to provide the feature to the Customer (e.g., displaying call history, transcripts, and reports within TreeROI) and for our own security, abuse-monitoring, billing, and service-improvement purposes. We do not sell this data and do not use it for third-party advertising.
• •Provider settings: where a Communications Provider offers configuration options affecting data handling (for example, a setting that disables storage of call recordings/transcripts after a call ends), the Customer's selection of that setting within TreeROI determines how that data is handled. We are not responsible for a Communications Provider's handling of data outside our own systems.
• •Recipient notice: Customers are responsible for providing any legally required notice or consent to call/message recipients (e.g., "this call may be recorded" or AI-agent disclosures), as described in our Terms of Service.

5. HOW WE SHARE INFORMATION

We share information with:

• •Service providers who support our operations, including: Stripe (payment processing); Vapi Inc. (voice AI calling platform); Twilio Inc. (SMS and voice communications infrastructure); other SMS/email carriers and delivery infrastructure providers; and cloud hosting providers
• •Our Customers - the business using TreeROI can access the End Customer data they submitted
• •Legal & safety purposes - to comply with law, respond to legal process, or protect rights, property, or safety
• •Business transfers - in connection with a merger, acquisition, or sale of assets, subject to this Policy or a materially similar one

We do not sell personal information as defined under the CCPA/CPRA.

6. COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate our website and Services, remember preferences, and understand usage. See our Cookie Policy for full details on the types of cookies we use and how to manage your preferences.

7. DATA SECURITY

We maintain reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. DATA RETENTION

We retain Customer and End Customer data for as long as the Customer account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements. Customers may request export or deletion of their data as described in our Terms of Service. Call recordings and transcripts generated through voice AI or agency-provisioned messaging features are retained for as long as the Customer account is active and the feature is in use, and thereafter per this Section, unless a shorter period is selected by the Customer or required by law.

9. YOUR RIGHTS

Depending on your location, you may have rights to:

• •Access, correct, or delete your personal information
• •Object to or restrict certain processing
• •Request a copy of your data in a portable format
• •Opt out of certain communications

10. CHILDREN'S PRIVACY

The Services are intended for business use and are not directed to children under 18. We do not knowingly collect personal information from children.

11. INTERNATIONAL USERS

The Services are hosted in the United States and intended for use by U.S.-based businesses. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last Updated" date, and where required, we will provide additional notice.