Effective date: October 22, 2026
Steadyline ("Steadyline," "we," "us") runs https://steadyline.agency. We set up AI receptionists, automated email follow-up, a CRM, lead capture, and review requests for owner-run service businesses ("clients"). This policy explains what information we collect, how we use it, and the choices you have.
calendar.events). See Section 6.We do not store payment card data.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Transactional or informational texts and emails, such as replies to a caller's own inquiry and appointment confirmations or reminders, may go to people who contacted the business. Marketing texts and review-request texts are sent only with the recipient's prior express written consent, captured through an unchecked opt-in checkbox or a keyword opt-in (for example, texting a keyword to the business's number). We keep records of each consent, including when and how it was given, and the opt-in wording shown.
Every text includes a way to opt out: reply STOP. Every marketing email we send, or send for a client, includes the sender's valid physical mailing address and a clear way to opt out, either by replying to the email and asking to be removed or through an unsubscribe link where one is included. Opt-outs are honored within 10 business days.
We use these providers to run our services. They process data only for us: - Vapi: AI voice receptionist and call handling - Speech and AI model providers used by Vapi: to run a call, Vapi passes call audio and text to speech-to-text, large language model (LLM), and text-to-speech providers. These providers process call content in real time to transcribe the caller, generate replies, and produce the receptionist's voice. Vapi's own privacy policy says call recordings, transcripts, and logs may be used to help improve its AI models. We have not confirmed that Vapi or these providers are contractually barred from using call data for training, so we do not promise that. We are reviewing settings and add-ons that limit this, such as Vapi's Zero Data Retention option. - Twilio: phone numbers, calls, and text messages - Supabase: database and authentication - Railway: application hosting - Google: Google Calendar integration and Google Workspace services - Resend: sending transactional and follow-up email - Zoho: our business email
We may also disclose information if the law requires it, or as part of a merger or sale of the business.
When a client connects Google Calendar, we request only the calendar.events scope. Steadyline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
We use encryption in transit, access controls, and per-client data separation. No system is perfectly secure.
This section applies to California residents and supplements the rest of this policy. It covers the past 12 months and our ongoing practices.
| Category (CCPA) | Examples | Sources | Business purposes | Retention |
|---|---|---|---|---|
| Identifiers | Name, email, phone number, IP address, account login | You; our clients; callers; your browser | Providing services, account management, support, security | Life of the account + 90 days |
| Customer records (Cal. Civ. Code 1798.80) | Business name, address, billing contact | Clients | Contracting, billing, support | Life of the account + up to 7 years where tax law requires |
| Commercial information | Plan, services purchased, service history | Clients | Billing, support, providing services | Life of the account + up to 7 years where tax law requires |
| Audio and electronic information | Call recordings, transcripts, text and email message content | Callers and customers of our clients | Answering calls, booking, follow-up, quality and security | Recordings and transcripts: up to 90 days in Steadyline's systems; our voice AI provider deletes its copies sooner, on its plan's schedule (currently 14 days). Message history: life of the client account + 90 days |
| Internet or network activity | Pages visited, browser type, logs | Your browser and device | Security, debugging, site operation | Up to 12 months |
| Professional or commercial information | Job type, lead notes, appointments in the CRM | Clients and their customers | Providing CRM and booking features | Life of the client account + 90 days |
| Inferences | None | None | None | Not applicable |
We do not collect biometric, precise geolocation, or protected-classification information.
We disclose the categories above only to service providers/processors who are contractually bound to use them only to provide services to us: - Identifiers, audio and electronic information: Vapi (voice AI) and the speech-to-text, LLM, and text-to-speech providers Vapi uses, Twilio (calls and texts) - All categories listed above: Supabase (database), Railway (hosting) - Identifiers, professional/commercial information (calendar events): Google (Calendar, Workspace) - Identifiers, electronic information (email content): Resend (outbound email), Zoho (business email)
We do not sell personal information and we do not share personal information for cross-context behavioral advertising, and we have not done so in the past 12 months. Because we do neither, we do not offer a "Do Not Sell or Share" link. We have no actual knowledge of selling or sharing personal information of consumers under 16.
We do not collect or use sensitive personal information as defined by the CCPA, and we do not use any personal information to infer characteristics about you.
California residents have the right to: - Know the categories and specific pieces of personal information we collect, use, and disclose, the sources, and the purposes; - Delete personal information we collected from you, subject to legal exceptions; - Correct inaccurate personal information; - Limit the use of sensitive personal information (we do not collect any); - Opt out of sale or sharing (we do neither); - Non-discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised these rights.
Email tavish@steadyline.agency with the subject "Privacy Request" and the right you want to exercise. We will confirm receipt within 10 business days and respond within 45 days (extendable by another 45 days with notice).
Verification. We verify requests by matching information you provide (such as your name, email, and phone number) with what we hold, and we may contact you at the email or phone on file to confirm. We will ask for more information only when needed and use it only for verification.
Authorized agents. An authorized agent may submit a request for you with your signed written permission. We may still ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.
For data about our clients' customers and callers (calls, recordings, messages, CRM records), Steadyline acts as a service provider/processor on behalf of the client, which is the business that controls the data. If you send us a request about that data, we will forward it to the relevant client and help them respond, as our contract with them requires.
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws (such as Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island) may have the right to confirm whether we process their personal data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do not sell personal data, use it for targeted advertising, or profile people in that way.
To exercise these rights, follow Section 9.6. If we deny your request, you may appeal by replying to our decision with "Appeal" in the subject; we will respond within the time required by your state's law (generally 45 to 60 days). If your appeal is denied, you may contact your state Attorney General.
Our services are not meant for children under 16. We do not knowingly collect their data.
We may update this policy. If we do, we will post the new date at the top.
Steadyline 1701 South Figueroa #1419, Los Angeles, CA 90015 tavish@steadyline.agency