Privacy Policy

This Privacy Policy explains how Fluid Bloom Media LLC ("Fluid Bloom," "we," "us," or "our") handles personal information when you use Zappy Calls, its iOS app, hosted AI receptionist, websites, and support services (collectively, the "Service"). It also explains information processed on behalf of a business customer about callers, leads, employees, and contacts.

1. Our roles

For account, billing, product-security, support, and service-improvement information, Fluid Bloom generally determines why and how the information is processed. For call content, transcripts, lead details, business knowledge, calendars, and instructions submitted by or for a business customer, the customer generally determines the purpose of processing and Fluid Bloom processes the information to provide the Service. Business customers are responsible for their own privacy notices, caller disclosures, consent, and lawful instructions.

2. Information we process

• Account and business information: name, email or Apple private-relay email, Sign in with Apple user and organization identifiers, authentication and session records, business name, website, address or service area, phone numbers, timezone, industry, services, pricing, FAQs, hours, staff roles, support messages, and configuration. Apple authentication refresh credentials are encrypted at rest and used for account security and revocation.
• Subscription information: product, entitlement, transaction, renewal, refund, revocation, and purchase-history information received from Apple. Apple processes payment-card details; we do not receive the full card number.
• Call and lead information: caller and destination phone numbers, call identifiers, direction, timestamps, status, duration, routing events, live audio while a call or test is occurring, transcripts when enabled and available, summaries, collected fields, urgency and outcome indicators, and transfer or notification results.
• Business content: greetings, instructions, approved website facts, services, prices, availability, prohibited statements, escalation rules, and other content used to configure the receptionist.
• Calendar information: provider, connection status, account identifier, availability, event details needed to check or create appointments, and encrypted authorization credentials where a calendar is connected.
• Device and usage information: app version, device and operating-system information transmitted in ordinary network requests, product interactions, feature status, call and live-test usage, diagnostic events, error details, and service-performance data.
• Support and security information: correspondence, troubleshooting context, authentication events, access records, suspected abuse, and incident information.

Raw call recording is disabled in the current release. Live audio must still be transmitted to telephony and AI providers to answer a call. If a future recording option is enabled, we will present the setting and update applicable disclosures before relying on it.

3. Why we process information

We use information to authenticate users; provide and configure phone, AI, transcription, lead, transfer, notification, and calendar features; meter included minutes; verify subscriptions; prevent abuse; secure and troubleshoot the Service; respond to support; comply with law; enforce agreements; and improve reliability and call outcomes. We do not sell personal information or use caller content for third-party advertising. We do not track users across other companies' apps and websites for advertising.

4. Service providers and disclosures

We disclose information only as needed to operate the Service, follow a business customer's instructions, protect users and the Service, complete a business transfer, or comply with law. Providers may include:

• Apple for app distribution, subscriptions, purchase history, and related server services;
• Cloudflare for application hosting, network security, and database services;
• Telnyx for telephone numbers, calling, routing, and messaging capabilities;
• Vapi and its configured infrastructure providers for real-time AI call orchestration, speech, and call events;
• xAI for language-model processing, direct Grok voice calls, outage fallback, and post-call analysis;
• Soniox and Deepgram for speech recognition or speech generation through the configured call service;
• Google or Microsoft only when a customer chooses to connect a supported calendar; and
• diagnostic, communications, and security vendors used to detect errors, deliver alerts, or protect the Service.

Telephone networks and the caller's or customer's own carrier also process call metadata and audio as necessary to complete calls. Information may be processed in the United States and other locations where these providers operate, subject to appropriate contractual and legal safeguards.

5. Call notice, consent, and sensitive categories

Before using AI features, the iOS app asks an account member to allow processing of business details, live audio, transcripts, and related service information by the named telephony and AI providers. The choice and disclosure version are saved for that member and account. Choosing Not now leaves AI setup unavailable; account privacy controls and deletion remain available. This account-member permission does not replace notice or consent that may be required from callers.

Privacy, wiretap, biometric, telemarketing, and call-transcription rules vary by location and context. Zappy Calls speaks the business greeting as configured and does not add a separate spoken notice. A business customer must review the complete call flow and determine whether legally required notice, affirmative consent, opt-out handling, or another contact method is needed before use. Zappy Calls is not represented as HIPAA-compliant, no business associate agreement is offered unless separately agreed in writing, and human healthcare and legal-practice use is not supported in the current public release. Do not configure the Service to collect medical records, payment-card data, government identifiers, account passwords, or other highly sensitive information unless Fluid Bloom has expressly approved that use in writing and the required safeguards and agreements are in place.

6. Retention

We retain account and service information while an account is active and as needed to provide, secure, and document the Service. Call metadata, transcripts, lead content, business configuration, support records, and calendar data may be retained according to the customer's settings, contractual requirements, and operational needs. When a verified account-deletion request is completed, we aim to delete or deidentify active-service personal information within 30 days, except information reasonably necessary for legal obligations, transaction records, fraud prevention, security, dispute resolution, or enforcement. Residual copies in encrypted backups may age out within up to 90 days. Provider deletion can have separate retention limits. For example, deleting a call in Vapi removes caller transcripts and call artifacts but may retain the assistant configuration, which can include business information, together with billing and operational metadata. We track connected-provider cleanup separately and do not represent a local deletion as confirmation that every provider copy has been erased. Contact us for an account-specific deletion status or provider retention request.

7. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information, including access controls, encrypted transport, secret management, and provider authentication. No internet or telephone system is perfectly secure. Customers must secure their Apple account, devices, phone-provider accounts, calendar accounts, transfer destinations, and staff access, and should report suspected misuse promptly.

8. Choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, or to appeal a privacy decision. Business callers should ordinarily contact the business they called first because that business controls the call purpose and relationship. Account holders can use available in-app controls or contact us. We may verify identity and authority before completing a request.

9. Account deletion

Account holders may initiate deletion in Zappy Calls under Settings → Account & privacy → Delete account and data, or follow our web deletion instructions if they cannot access the app. In-app deletion immediately revokes Zappy sessions and queues hosted-data and connected-credential deletion, including revocation of the Sign in with Apple credential. Deleting the iOS app does not cancel an Apple subscription or delete the hosted account. Manage the subscription through Apple and request account deletion separately.

10. Children

The Service is for businesses and authorized adults and is not directed to children under 13. Business customers must not intentionally use it to solicit information directly from children without an appropriate lawful basis, notices, consent, and safeguards.

11. Changes

We may update this Policy as the Service, providers, or law changes. We will post the revised date and provide additional notice when required. Materially new uses of call content will not be applied retroactively without an appropriate basis and notice.

12. Contact

Fluid Bloom Media LLC
Email: colton@fluidbloommedia.org