Privacy Policy

This policy covers four groups of people:

• Business customers: companies and people who sign up for a GBI account.
• End users: the customers of those businesses, when they talk to a GBI chatbot, voice agent, or text line. The business you contacted decides what happens to your data. We process it for them. To use your rights, use the form and choose that option, and we will pass your request to that business.
• People who contact us or fill in our forms: applicants, waitlist members, affiliates, and people who write to support.
• Businesses we reach out to: businesses we contact about our services, and anyone who uses a demo preview we built for a business.

For the first, third, and fourth groups, GBI decides why and how the data is used (we are the “controller”). For end users, the business is the controller and GBI is its “processor”.

When you create an account or apply: name, email address, phone number, business name, industry, website, and what you tell us about your needs. Billing is handled by our payment processor. We never see your full card number.

In our customer and lead records: a profile for each person who becomes a lead or customer. It can hold their names, email addresses, and phone numbers (including old ones), company and job title, city and country, where they first came from, the IP addresses they connected from with the approximate place and device, notes our team wrote about conversations, and their payment history. Payment history holds the amount, date, card brand, last four digits, expiry, and billing name and address. We use these details to know who a person is across the years, to serve them well, and to measure what our marketing is worth.

Public information about business contacts: for leads and customers, our team can run a research tool that looks at public sources, such as the company’s own website and professional profiles, to fill in job title and company. Each fact is checked against what we already know about the person before it is added, and a person reviews anything uncertain. We do not collect information about people’s health, beliefs, family, or finances this way.

When AI features are live for a business: call recordings and transcripts, chat logs, text message threads, the contact details of people who reach out, and information submitted through forms. These belong to the business that uses the feature.

When we reach out or you use a demo: publicly available business details (name, address, phone, website, public review counts, and a business email published on the business’s own site or listings), what you type into a demo chat, the audio and transcript of a demo voice call (which may be recorded), and whether a demo or email was opened or answered.

Collected automatically: usage data, log data (IP address, browser type, pages visited), and error and performance data. In the signed-in app, a small sample of sessions are recorded for error diagnosis with all text hidden.

We do not use your data for advertising. We do not sell personal data, and we do not share it for cross-context behavioral advertising. We do not make decisions that have legal or similarly significant effects on a person using only automated means.

We share data only with the companies that help us run the platform, and only for that purpose. They are bound by data processing terms. Our core service providers are:

• Vercel: application hosting
• Supabase: database and file storage
• Clerk: sign-in and identity
• Anthropic: AI language model processing
• Stripe: payment processing
• An enterprise telecom provider: voice and text delivery
• Additional AI, speech, and voice providers, including backup language models and demo voice calls
• An email delivery provider and a cold email platform: sending service and outreach emails
• Web research and business data providers: public information about business contacts
• An error monitoring provider: finding and fixing bugs

We also share data when the law or a court requires it, to protect people’s safety, or in a sale or merger of the business (you would be told). If a business uses GBI to talk to you, that business sees your conversation.

We are in the United States and our providers process data in the United States and other countries. If you are in the EU, UK, or Switzerland, we rely on approved safeguards for these transfers, such as standard contractual clauses, where the law requires them. You can ask us for a copy of the safeguards.

We keep personal data only as long as we need it for the reasons above, and then remove it.

• When you close your account: your business data and customer records, call recordings, files, and the copies held by our voice provider are deleted within 30 days. Your sign-in identity is deleted at the same time.
• Billing and tax records are kept for 7 years because tax law requires it. After that, the name, address, and card details are removed.
• Demo previews and outreach records are kept while they are useful. A business can ask us to take down its demo, and anyone can ask us to delete their demo conversations, at any time.
• Your request to delete or stop contact: we keep a scrambled one-way code of your email or phone number so that we never contact you again. We do not keep the email or number itself.
• Backups: deleted data leaves our backups as older backups are replaced on their normal schedule.

Everyone can ask us to show them what we hold, correct it, delete it, give it to them in a file they can reuse, or stop contacting them. It is free. Use the form: our privacy request page. You can also write to hello@goldenbeaconconsulting.com.

If you are in the EU, UK, or Switzerland you also have the right to limit how we use your data, to object to our use of it based on our legitimate interest, to withdraw consent at any time, and to complain to your data protection authority.

If you live in California or another US state with a privacy law you have the right to know what we collect and how we use it, to get a copy, to delete your data, to correct it, to opt out of the sale or sharing of your data (we do neither), and to not be treated worse for using your rights. We do not use or disclose sensitive personal information for anything other than providing the service.

How it works. We first ask you to confirm the request from the email address you gave, so nobody can make a request in your name. We then reply within 30 days. If a request is complex we may take up to 60 more days (EU and UK) or 45 more days (US states), and we will tell you why. If we cannot do what you ask, we tell you the reason. If you disagree, you can appeal: reply with the word APPEAL and someone who was not involved will review it. You may also contact your state attorney general or your data protection authority.

Someone acting for you. An authorized agent can make a request for you. We will ask for proof that they are authorized.

Some things we must keep. If the law requires a record, for example a payment for tax purposes, we keep the record without your name and details, and we tell you what we kept and why.

We do not track you across other websites. Because we do not sell or share personal data, there is nothing for a “Do Not Sell or Share” setting or a Global Privacy Control signal to switch off.

In the last 12 months we collected these categories of personal information, for the purposes described above, and we did not sell or share any of them:

We use cookies that the platform needs to work, such as signing in and keeping your session safe. You can block cookies in your browser, but you will not be able to sign in.

We set a visitor id cookie called gbi_vid. It lasts up to 13 months. It remembers which page, link, ad or website first brought you to us, and which of our pages you opened, so that if you later send us a form, book a call, or write to us, we can tell which of our marketing helped you find us. If you arrive through an affiliate link, we also set a cookie that remembers which affiliate referred you, so the affiliate can be credited if you sign up.

We do not set these cookies for visitors in the EU, UK, or Switzerland unless they accept cookies. In those places, when you send a form we still note which page it was on and the campaign in the link you used, because you sent that form to us. If you decline cookies anywhere, we do not set them. We do not use advertising cookies or third-party tracking pixels. We store only a scrambled form of your IP address for this purpose. Visit records for people who never gave us an email address or phone number are erased after 14 months. Landing pages built by our customers may use their own cookies, and show their own notice.

When an AI assistant answers a call or chat, it tells you it is an AI. When a call may be recorded, it tells you at the start. If you do not want to be recorded, you can end the call. AI answers can be wrong, so please do not rely on them for medical, legal, or financial decisions.

GBI is a business tool for adults. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it promptly.

We use reasonable technical and organizational measures to protect your data. Our Security page describes them. If a breach puts your data at risk, we will tell you and the authorities within the time the law requires, and we will tell the businesses we serve without delay.

If we make material changes to this policy, we will tell you by email and update the date at the top. Continued use of GBI after the effective date means you accept the updated policy.

Questions about this policy or how we handle your data:

Note: This privacy policy is a good-faith description of how GBI operates. It is recommended that you have this reviewed by a licensed attorney, particularly if you serve customers in California (CCPA) or the European Union (GDPR).