Privacy Policy

Louneh, LLC provides AI-powered phone answering, scheduling, and customer-communication services to small businesses (our “Customers”). When we provide those services on behalf of our Customers — for example, by answering calls placed to their published phone number — we typically act as a service provider or business associate, not as the data controller of the call content itself.

This policy covers personal information we collect in our own right (for example, when you sign up for an account or visit this website). For personal information our Customers entrust to us to operate the Services on their behalf, our Customers’ own privacy policies and our contracts with them govern.

Information you give us directly

• Early beta interest: your email address and consent to receive beta-access updates. Joining the list does not create an account or guarantee an invitation.
• Account information: name, email, business name, phone number, role.
• Billing information: handled by our payment processor (Stripe). We never store full card numbers on our systems.
• Communications: messages you send to support, sales, or partnerships.

Information we collect when you use the Services

• Usage metadata: pages viewed, features used, session duration.
• Device and connection metadata: IP address, browser, operating system, timestamps.
• Optional marketing analytics: when enabled and accepted, PostHog receives approved public-page events, campaign categories, a random session identifier, and verified inquiry or beta-interest conversions. Beta conversions use a random registration receipt identifier; email addresses are excluded. Analytics preferences lets you decline or withdraw consent. We honor Do Not Track and Global Privacy Control.
• Analytics preferences are stored locally; the optional analytics identifier lasts for the browser tab session. Form contents, patient activity, session recordings, raw URLs, and raw error messages are excluded from PostHog. Operational logs contain approved service, status, timing, and error-category fields.

Information from your callers (when we act on your behalf)

• Call audio recordings when enabled, subject to applicable consent requirements.
• Call transcripts and AI-generated summaries when enabled.
• Caller phone number, voicemail content, and SMS content; deposit payment metadata only when payments are enabled.
• For healthcare Customers, protected health information (PHI) only after a customer-specific Business Associate Agreement is executed and the relevant providers are approved.

• To provide, operate, and improve the Services.
• To bill you and collect payments owed.
• To send transactional notices about your account, security, or service changes.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations and respond to lawful requests.
• With your consent, to send you marketing communications. You can opt out at any time.

We do not sell personal information. We do not train any public foundation model on your data or your callers’ data.

We share personal information only as needed to run the Services, comply with the law, or protect rights and safety:

• Service providers: see our Sub-processor page for current and proposed providers and agreement review status.
• Payment processing: Stripe processes subscription payments and, only when enabled, patient deposits.
• With your direction: optional third-party integrations, only when configured and verified for your account.
• Legal and safety: to comply with valid legal process, to enforce our terms, or to protect rights and safety. We will challenge overbroad requests.
• Business transfers: if we are acquired or merged, your information may transfer, subject to the protections of this policy.

We retain personal information as needed for the purposes described in this policy, our agreements, and applicable law. Customer-controlled PHI requires a documented, customer-approved retention schedule that reflects application, provider, and backup behavior before live patient use. We do not state one universal deletion period for all recordings, transcripts, appointment requests, or audit records.

For account-data requests, see “Your rights” below. A healthcare Customer coordinates requests involving its patients.

Before a healthcare Customer sends PHI through the Services, the parties must execute a customer-specific Business Associate Agreement (BAA), and required provider agreements and safeguards must be verified. The public /baa page is an unsigned template for discussion.

Where this Privacy Policy and the BAA differ for PHI, the BAA controls.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict our processing of your personal information, and to object to certain processing. To exercise any of these rights, email privacy@louneh.ai from the email address on your account. We respond according to applicable law and the agreement governing your data.

If we act as a service provider for a Customer who controls the data, we will route your request to that Customer and assist them in responding.

The website is not directed to children under 13. Healthcare Customers may serve minors, so a patient or guardian should contact the practice about call or appointment data. For concerns about information submitted directly to Louneh, contact privacy@louneh.ai and we will review the request under applicable law and the governing agreement.

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information. Our current posture — encryption, access controls, audit logging, breach notification, sub-processor program — is detailed on our Security page. No system is perfectly secure; if we discover a breach of personal information, we will notify affected Customers and, where required, regulators.

We currently operate primarily in the United States. If you access the Services from outside the U.S., your information may be transferred to and processed in the U.S., which may have different data-protection laws than your country.

We may update this Privacy Policy from time to time. Material changes will be announced to Customers in writing at least 30 days before they take effect. The “Last updated” date above is authoritative.

Questions about this policy or our handling of personal information: privacy@louneh.ai. For security disclosures, use security@louneh.ai.