Privacy Policy

1. Scope

This Privacy Policy applies to Granvure’s websites, accounts, AI receptionist service, support, and related business operations. Granvure LLC is located at 7901 4th St N, STE 300, St. Petersburg, FL 33702. Customers control the business information and caller data they submit to the service; Granvure processes that data to provide the service.

2. Information we collect

• Account data, including name, organization, email, authentication identifiers, roles, and consent records.
• Business configuration, knowledge content, hours, routing, voicemail, transfer settings, and support communications.
• Contact inquiries and mobile-messaging consent evidence, including the normalized phone number, consent status, collection source and method, disclosure version and text, timestamp, and limited request metadata such as IP address and user agent when appropriate.
• Subscription identifiers, plan, status, invoices, and billing events. Stripe receives payment-card details; Granvure does not store full card numbers or security codes.
• Call and message metadata, such as caller, sender, and destination numbers, timestamps, delivery status, routing outcome, provider identifiers, and safe provider error details.
• AI conversation data, including transcripts, summaries, extracted intent, urgency, and follow-up information when generated by the configured service. Granvure does not enable call recording by default and discards provider recording URLs and secrets.
• Website and document content supplied for knowledge processing. Uploaded source files are processed for extraction and are not retained after extraction by the application.
• Calendar connection identity, configuration, encrypted access and refresh tokens, availability, and appointment details.
• Technical and security data, including session cookies, request metadata, audit events, error information, and rate-limit signals.

3. How we use information

• Provide, authenticate, secure, support, and bill for the service.
• Provision and operate customer-configured AI, telephony, knowledge, and scheduling workflows.
• Synchronize provider events, detect abuse, investigate errors, and preserve service integrity.
• Communicate transactional, security, billing, support, and policy information.
• Improve reliability and usability using operational information that is appropriately limited and protected.
• Comply with law, enforce agreements, and protect rights and safety.

4. Cookies

Granvure currently uses essential cookies for Supabase authentication and a short-lived, HTTP-only calendar OAuth state cookie. These cookies are necessary for sign-in, session refresh, security, and connected-calendar authorization. Granvure does not currently deploy advertising cookies or cross-site behavioral advertising trackers. See the Cookie & Privacy Notice for details.

5. How information is disclosed

Granvure discloses information only as needed to operate the service, follow customer instructions, complete transactions, protect the service, or comply with law. Current processor categories include cloud hosting and delivery (Vercel), authentication and database hosting (Supabase), payment processing (Stripe), AI voice and conversation processing (Vapi and its configured model/voice providers), telephony (Twilio when configured), email delivery, and calendar providers selected by the customer. Granvure does not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined.

6. Customer responsibilities and caller information

Business customers determine the purpose and configuration of their AI receptionist and are responsible for lawful notices, consent, call routing, retention, and handling of caller requests. Callers should contact the business they called about that business’s use of their information. Granvure will assist customers with appropriate requests where required.

7. Retention

Granvure retains information while an account is active and as reasonably necessary for service delivery, security, billing, dispute resolution, and legal obligations. Some records currently have no automated deletion schedule. Account deletion, caller-data deletion, exports, and legal holds require verified support handling. The Data Retention Policy describes current system behavior and limitations; it does not promise deletion that the product cannot yet automate.

8. Security

Granvure uses organization-scoped access controls, row-level security, encrypted transport, provider-secret separation, signed webhooks, protected server credentials, and audit controls. Calendar provider tokens are encrypted before storage. No security method is perfect, and Granvure cannot guarantee absolute security. Report suspected security issues to hello@granvure.com.

9. Rights and choices

Depending on location and applicable law, individuals may request access, correction, deletion, portability, or information about processing, and may appeal a denied privacy request. Granvure does not currently provide automated privacy-request or account-deletion controls. Submit a request to hello@granvure.com. We will verify identity and authority before acting and may retain information where legally permitted or required. Authorized agents must provide evidence of authority.

10. Children

Granvure is a business service not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Customers must not configure Granvure to collect children’s information without establishing all required authorization and safeguards.

11. International use

Granvure is operated from the United States. Information may be processed in the United States and other locations where service providers operate. Customers are responsible for confirming that their use is permitted in each relevant jurisdiction.

12. Mobile messaging and choices

Granvure sends corporate text messages only after a separate affirmative opt-in for the stated purpose. We collect and use the mobile number, message content and delivery data, consent status, collection source and method, exact disclosure and version, consent or revocation time, supported keyword source, and applicable legal-document versions to deliver and support messages, document consent, prevent abuse, and honor choices. Message frequency varies and message and data rates may apply. We do not sell or rent mobile information, or share it with third parties or affiliates for their own marketing or promotional purposes. Messaging carriers and operational service providers may process mobile information only as needed to deliver and administer Granvure services or as required by law.

Reply STOP to a Granvure message to opt out and HELP for help. Supported START or UNSTOP instructions may restore SMS only through an explicit carrier-managed action. An opt-out applies to the relevant messaging program and does not prevent non-SMS communications that are otherwise permitted. Granvure customers independently control messages they send to their own customers through the platform; contact that business for its privacy practices and choices. Granvure processes those messages on the customer’s instructions. Privacy and mobile-messaging questions may be sent to hello@granvure.com.

13. Changes and contact

We may update this policy prospectively and will post a new effective date. Privacy questions, mobile-messaging help, and requests may be sent to hello@granvure.com or Granvure LLC, 7901 4th St N, STE 300, St. Petersburg, FL 33702.