Privacy Policy

Who we are

Bellvanta provides an AI front desk for small businesses. A business signs up for Bellvanta (a "Business"), sets up its AI, and shares a hosted page or website chat with its own customers ("Visitors"). This policy explains what we collect from both, how we use it, and the choices you have.

Information we collect from Businesses

When a Business creates an account and sets up its AI front desk, we collect:

• Account details: email address, password (stored hashed), and optional two-factor authentication settings.
• Business details: business name, type, description, phone, email, address, hours, website, booking and social links, logo, services, prices, FAQs, and the instructions and rules the Business gives its AI.
• Team members: email addresses and roles of people the Business invites.
• Usage records: conversations handled, AI usage, and actions taken in the dashboard, so we can operate the service, bill accurately, and show the Business its results.
• Billing details are handled by our payment processor. We do not store full card numbers.

Information we collect from Visitors

When a Visitor chats with a Business's AI front desk, we collect on behalf of that Business:

• The messages the Visitor sends and the AI's replies.
• Contact details the Visitor chooses to share, such as name, phone number, email, the service they want, and preferred appointment times.
• Basic technical data: a hashed form of the Visitor's IP address used only to prevent abuse, and, when present, which link the Visitor arrived from (for example, Instagram).
• We automatically remove patterns that look like Social Security numbers and payment card numbers before messages are stored, and the AI is instructed not to request them. Please do not share sensitive information in chat.

Cookies, browser storage, and analytics

Bellvanta uses a small number of cookies to keep Businesses and their team members signed in to the dashboard. The chat on a Business's hosted page keeps the current conversation in the Visitor's browser session storage for up to 12 hours so the conversation survives a page refresh; it is cleared when the browser tab closes or the Visitor starts a new conversation. We do not use third-party analytics, advertising trackers, or tracking pixels.

How we use information

• To run the AI front desk: answer Visitor questions using the Business's approved information, capture leads, and record appointment requests.
• To notify the Business about new leads, appointment requests, and conversations that need a person.
• To provide the Business dashboard, including conversation history and lead management.
• To secure the service, prevent abuse, enforce usage limits, and detect errors.
• To bill Businesses and understand our costs.
• To improve Bellvanta. We do not use Visitor conversations to train AI models.

AI processing

Bellvanta uses OpenAI's API to generate replies. Each Visitor message, recent messages in the same conversation, and the Business's approved information are sent to OpenAI to produce a response. Under OpenAI's API data usage policies, API inputs and outputs are not used to train OpenAI's models by default. Bellvanta keeps conversation history in its own database and does not rely on OpenAI to store conversations.

AI replies can be wrong or incomplete. The AI is instructed to answer only from the Business's approved information and not to give professional advice (tax, legal, medical, or financial). Businesses remain responsible for the information they provide to their AI.

Who we share information with

We share information only with providers that help us run Bellvanta, under their data-processing terms:

• Supabase (database, authentication, and file storage, hosted in the United States).
• Vercel (website hosting).
• OpenAI (AI responses, as described above).
• Resend (email delivery for invites, password resets, and lead alerts).
• Our payment processor, for Business billing.
• An error-monitoring service that receives technical error reports (such as a failed request) but not chat contents.
• We may also disclose information if required by law, to protect the rights and safety of Bellvanta, Businesses, or Visitors, or as part of a business transfer.
• We do not sell personal information, and we do not share Visitor information with anyone other than the Business the Visitor contacted and the providers above.

Businesses control their Visitor data

Each Business owns the Visitor conversations, leads, and appointment requests collected through its AI front desk. Bellvanta processes that data on the Business's behalf. Businesses can delete individual conversations and leads from their dashboard, may request bulk deletion through Bellvanta, and Bellvanta can also assist Businesses with access, correction, or deletion requests. Visitors who want to access, correct, or delete their information should contact the Business directly or email us at the address below.

Security

Every Business's data is isolated from every other Business's data at the database level. Data is encrypted in transit and at rest by our providers. API keys and credentials are stored only in server-side secret storage. Two-factor authentication is available to all accounts and is enforced for Bellvanta platform administrators. No system is perfectly secure; if we learn of a breach affecting your data, we will notify affected Businesses without undue delay.

Retention

We keep Business account data for as long as the account is active. Visitor conversations and leads are kept for as long as the Business's account is active, or until deleted at the Business's request. When a Business closes its account, we delete its data within 30 days, except where we must keep records for legal, billing, or security reasons. Backups roll off on their own schedule.

Your choices and rights

Businesses can update their information in the dashboard at any time and can ask us to delete their account. Depending on where you live, including California under the CCPA, you may have rights to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising those rights. To make a request, email us at the address below. We will verify your identity before acting on it.

Children

Bellvanta is for businesses and their adult customers. We do not knowingly collect information from children under 13. If you believe a child has provided information through a Bellvanta chat, contact us and we will delete it.

Changes

We may update this policy as Bellvanta changes. We will post the new version here with a new date and, for material changes, notify Businesses by email.