Privacy Policy

1. Who we are

AIOS is a service of NoManagement B.V., a company registered in the Netherlands, operating the website aios.supply. AIOS provides AI agents that, on a business customer's behalf and at their direction, answer and place calls, send and reply to messages, qualify leads, book appointments and follow up. We act in two roles. For information about our own customers (the businesses that sign up and use AIOS) we are the controller, or the business under US law. For the contact data inside a customer's connected systems that flows through AIOS, we act as a service provider and processor on that customer's documented instructions. For the lead data we process on a business customer's behalf, our Data Processing Addendum applies.

2. The two kinds of data we handle

We keep these separate on purpose, because our role and your rights differ for each:

• Customer data: information about the business and the people who sign up for and use AIOS. We control this.
• Lead data: the contact records, call recordings, transcripts and message logs of a customer's own leads that pass through AIOS so the agent can do its job. We process this to deliver the service to that customer, and we may create de-identified data from it (with personal identifiers removed) to improve our services and models, as described in Improving our services and models below. We never sell it.

3. What we collect

Depending on how you interact with us, we may collect account and identity details, billing details (card data handled by our payment processor, not stored by us), usage and device data, connected-system data, and service-generated data. Specifically: pages viewed and features used; your IP address (kept raw on consent records as legal proof, and hashed on anonymous website demo sessions); your browser and device user-agent string; an approximate location (country, region and city) derived from your connection; a per-browser identifier and cookie or similar identifiers; the contact, calendar and conversation data inside any CRM or channels a customer connects; call recordings, transcripts, message content, appointment records and consent records created while the agent works; and, if you try the website voice demo, the demo conversation transcript with any company name, website or industry you provide.

4. How and why we use it

We use customer data to provide, bill, secure, support and improve the service, and, where permitted, to send relevant updates. We use lead data to operate the agent for the customer who provided it (answering, messaging, qualifying, booking and following up). We may also use data generated through the service, in de-identified or aggregated form, to improve and develop our AI services and models, as described below. We do not sell personal information.

5. Improving our services and models

We are building our own AI, and we may use the data generated through the service to make it better. Before we use any interaction data, such as call transcripts or messages, to improve or train our models, we remove direct personal identifiers so what remains reflects patterns and context, not identifiable people; we call this de-identified data. We do not sell this data, we do not use it to build profiles of individuals, and we never expose one customer's data to another. You can opt out of this use by emailing [email protected], and enterprise customers can obtain a written commitment that we will not use their data to improve our models at all. Where AIOS acts as a processor for a customer's lead data, we use only de-identified or aggregated data derived from it, consistent with our Data Processing Addendum and applicable law.

6. Legal bases we rely on (EU and UK)

For people in the EU and UK, we rely on a specific legal basis for each purpose. To provide and bill the service to our customers, we rely on performance of a contract (Article 6(1)(b)). To secure the service, prevent fraud, improve our product and send relevant updates to our own business customers, we rely on our legitimate interests (Article 6(1)(f)), balanced against your rights. For non-essential cookies and marketing measurement, we rely on your consent (Article 6(1)(a)) together with the Dutch Telecommunicatiewet. For lead data, we act on the legal basis chosen by the business customer who controls that data, not one we pick ourselves.

7. Mobile information and messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third parties, except with the providers that deliver the messaging or telephony on our behalf, and except as required to provide support. The business customer is responsible for obtaining the consent required to message or call their contacts; see our Terms of Service and SMS and Messaging Terms.

8. Call recording, transcripts and consent records

When an AIOS agent places or answers a call on a business customer's behalf, the call is recorded and transcribed so the service can work and to keep an accurate record. Your agent can be set to announce, at the start of the call, that it is an automated AI assistant and that the call is recorded, and the business that uses AIOS is responsible for making sure the disclosure its state and the contact's state require is given. We use speech-to-text to transcribe and text-to-speech to generate the AI voice; we do not create or store a voiceprint to identify you by your voice, and if we ever introduce voice-identification features we will obtain the consent the law requires first and publish how long we keep and when we destroy that data. We keep a tamper-evident consent record for each contact, including the exact wording the person agreed to, the time, and the method, so the business we serve can show consent was given. The business that uses AIOS, not AIOS, decides who is contacted and is the controller of its contacts' data; we process that data on the business's instructions. Where a business turns on immediate follow-up, the service may place a call or send a message automatically after a person submits a form, within permitted calling hours, based on that business's settings and the consent it collected.

9. Who we share data with

We share data only with vendors that help us run the service, under contracts that require them to protect it and use it only for us. The current list, with each vendor's function and location, is at our Subprocessors page. By category, these are:

• Cloud hosting, database and content delivery providers.
• AI and language-model providers that power the agent's understanding and replies.
• Voice and telephony providers that carry calls.
• Speech-to-text and text-to-speech providers used during calls.
• Messaging and SMS providers used to send and receive messages.
• The CRM and channels you choose to connect (your own systems, on your instruction).
• Payment processors for billing.
• Analytics providers used to measure and improve the site (described in our Cookie Policy).

10. Legal disclosures

Separately from the sharing above, we may disclose information where required by law, to enforce our terms, or to protect the rights, safety and security of our users, the public or AIOS. This is not a sale or sharing for advertising.

11. Your US privacy rights (CCPA, CPRA and other states)

If you are a California resident, and as a guide for residents of other US states with similar laws, you have the right to know what personal information we collect and why, to access and delete it, to correct it, to receive a portable copy, to opt out of any sale or sharing and of targeted advertising and certain profiling, and to limit the use of sensitive personal information, without being treated differently for exercising these rights. We do not sell personal information and we do not sell or share the lead data our customers entrust to us. On our own marketing pages we use analytics and advertising-measurement technologies that, under some state laws, may count as sharing for cross-context behavioral advertising; the providers and how to control them are described in our Cookie Policy. You can opt out of analytics and advertising cookies using the Privacy settings control in our footer, and we detect and honor recognized opt-out preference signals such as the Global Privacy Control. You can also opt out through your browser settings and by emailing [email protected]. To exercise a right, email [email protected]. We respond within 45 days, with one 45-day extension where allowed. For lead data, we route the request to the business customer who controls it and assist them. Oregon residents may ask for the specific named third parties to which their personal data was disclosed.

12. Your rights in the EU and UK (GDPR)

Because our company is established in the EU, you may have the right to access, correct, delete, restrict or object to processing, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). For lead data, these rights are exercised against the business customer who is the controller, and we assist them.

13. Data retention

We keep each category of personal information only as long as needed for the purpose we collected it, to meet legal, tax and accounting obligations, and to resolve disputes, then we delete or de-identify it. Account information is kept while the account is active and for a limited period afterward. By default, call recordings, transcripts and message logs are kept while the customer's account is active; each customer can set an automatic deletion window per category (for example call recordings, transcripts and messages), after which our system deletes or de-identifies that data on a recurring schedule. Consent records are kept as long as needed to prove consent and meet legal duties. Website-demo data is kept for a short defined period. A legal hold can pause deletion where the law requires it. A record marked deleted in the service is purged or de-identified within the applicable retention window, not kept indefinitely.

14. International transfers

Our primary processing takes place in the European Union. We operate from the Netherlands and use some specialist vendors in the United States and elsewhere, so personal information may be transferred internationally, including from the EU to the US. Where it is, we rely on the EU-US Data Privacy Framework for providers certified under it, and on the European Commission's Standard Contractual Clauses together with a transfer impact assessment for the rest. We keep the Standard Contractual Clauses in place as a backup even where the Data Privacy Framework applies.

15. Security

We protect information with encryption in transit and at rest, access controls, vaulted credentials, tenant isolation and audit logging, and we work to notify affected parties and authorities promptly if a breach occurs. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. More detail is on our Security page.

16. Children

AIOS is a business tool not directed to children. We do not knowingly collect personal information from children under 13 in the United States (COPPA) or under 16 in the EU. If you believe a child has provided us information, contact us and we will delete it.

17. Cookies and tracking

We use strictly necessary cookies to run the site and keep it secure, and analytics and advertising-measurement cookies. In the EU we treat consent for non-essential cookies as opt-in, and we do not set them until you agree. The specific trackers we use, and how to control them, are listed in our Cookie Policy. You can change your choices any time through the Privacy settings control in our footer, which also detects and honors the Global Privacy Control, or through your browser.

18. Changes to this policy

We may update this policy as the service and the law evolve, and we review it at least every 12 months. We will post the new effective date at the top, and for material changes we will provide additional notice where required.

19. Contact us

For any privacy question or to exercise a right, email [email protected]. You can also write to NoManagement B.V. (KVK 80968724), Spijkerkade 31, 1021 JS Amsterdam, Netherlands. If you are in the EU, you may contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).