How we handle your information.

Who we are

Prime Circa, Inc. (“Prime Circa,” “we,” “us”) is a California corporation with its principal place of business in Cypress, Texas. We build AI agents that work for small businesses — including Vera (reputation), Vanessa (receptionist), and the other services listed at primecirca.com. This policy explains what information we collect when you use our website, services, or speak with our AI agents.

Information we collect

From our websites and web app

• Server logs: IP address, browser type, pages visited, referrer.
• Website and funnel analytics: page path (without query strings), referring site, browser/device category, approximate location, campaign tags, and coarse actions such as starting a test call or creating an account. We do not send phone numbers, email addresses, OTP codes, call content, business names, or record IDs to analytics.
• Audit submissions (when you use vera.primecirca.com): business name, city, optional website URL — to perform the audit.
• Contact form / email submissions: name, email, message content.
• Public voice demo: if you choose to start the demo at /for/home-services, your browser sends microphone audio to Vapi so the dedicated demo assistant can respond. The demo is recorded and transcribed so authorized Prime Circa staff can review what prospective customers tested and improve Vanessa. Vanessa's latest words are also displayed in your browser; no call content, business name, phone number, or address is sent to website analytics. Vapi stores and processes the audio and transcript as our voice infrastructure provider. The demo ends when you choose End demo, when Vanessa says goodbye, or after four minutes. Use sample phone and address details during the practice call and do not provide payment, account, or other sensitive information.

When Vera calls a business

• The phone number we dialed (publicly listed on Google Business Profile).
• Audio recording of the call.
• Transcript of the call.
• Any mobile number provided verbally during the call (with explicit consent for SMS follow-up).
• The substance of any consent given.

Vera identifies herself as an AI assistant in the first sentence of every call. The call is recorded for compliance and training. You may decline to engage and ask to be removed from our list at any time.

SMS / text messages

If you give us your mobile number — by checking the consent box on our website (primecirca.com/sms) or by providing it on a recorded phone call — we may text you about your account, setup, and product updates. We collect:

• Mobile numbers you provide with explicit consent (a web consent checkbox or a recorded call).
• Messages we send and replies you send back.
• Delivery receipts and message timestamps.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of information described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with, or sold to, any third parties.

Message frequency varies (typically a few messages per setup). Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Full program terms are on our SMS Program page and in our Terms of Service.

The Vanessa app (web & Android)

Vanessa is our AI receptionist for small businesses. The app — in the browser at app.primecirca.com or installed from Google Play — is used by the business owner to set Vanessa up and manage her. It collects:

• Account information: email, phone number, and password handled by our authentication provider (Clerk).
• Payment information: card details collected and stored by Stripe, our payment processor. Prime Circa never sees or stores your card number.
• Microphone audio (RECORD_AUDIO): during the three setup questions, the app records your spoken answers about your business so Vanessa can be trained on what to say. Audio is processed on-device for speech recognition and sent to our backend only as a text transcript unless you opt in to share the recording for support. The Vanessa's app does not use the microphone after setup. The separate public voice demo described above uses a visitor's microphone only after that visitor starts the demo.
• Business profile: what you tell Vanessa during setup — business name, hours, services, pricing, never-say-this rules, when to reach you.
• Uploaded business documents: if you choose to upload documents such as price lists, service menus, or policies, we store them privately and use an AI model to read them so Vanessa can answer callers from their contents. This happens two ways, and only one of them is reviewed: facts we pull out into your business profile — prices, hours, policies — are drafts you approve or reject before Vanessa can use them, while Vanessa can also look up relevant passages in the document itself during a call, which means she may answer from wording you did not individually approve. Deleting the document stops the passage lookup and discards drafts you had not approved; facts you already approved stay in your business profile until you remove them. Please do not upload customer lists, employee records, or documents containing personal details such as ID numbers or health information.
• Phone number assignment: the dedicated phone number Vanessa answers on (provisioned through our voice infrastructure provider) and your existing business number (so we can forward to Vanessa).

When Vanessa answers your business calls

After setup, Vanessa runs on our infrastructure (not on your phone). When she answers a call from one of your customers we receive:

• Caller phone number (from the telecom carrier).
• Audio recording and text transcript of the call.
• Any details the caller voluntarily provides — name, callback number, the reason for the call, address, appointment time.

Vanessa identifies herself as an AI assistant at the start of every call. Recordings are made available to you (the business owner) in the app and used to improve transcription quality. We treat caller information as confidential to your business and do not use it for our own marketing.

How we use information

• To provide the services you requested (review-response drafts, audits, SMS follow-up).
• To verify and document consent for SMS messaging.
• To improve the quality of our AI agents (with personally identifiable information removed where reasonable).
• To respond to inquiries and provide customer support.
• To understand which pages and product steps help people successfully evaluate and set up Prime Circa.
• To comply with legal obligations (TCPA, FCC, state telecom laws).

We do not sell your personal information to third parties. We do not share it for third-party marketing.

Google Business Profile connection

When you connect your Google Business Profile to Prime Circa, we access only the information needed to read your business listing details and reviews, and to post owner replies that you have personally approved.

• What we read: your reviews (so Vera can draft replies), your listing fields — name, address, phone, hours, categories, description (so Vera can monitor for drift across platforms).
• What we write: owner replies to your reviews, only after you have approved each individual reply (by clicking the “Approve & post” link in the email Vera sends, or by editing and posting from your dashboard). Vera never posts a reply without your per-reply consent.
• Where we store tokens: your Google OAuth access and refresh tokens are stored encrypted at rest using AES-256-GCM, with the encryption key held outside the database.
• Data sharing: we do not share your Google Business Profile data with third parties beyond the processors listed below. We do not use review content for any purpose other than drafting and posting your own owner replies.
• How to revoke: disconnect from your Prime Circa dashboard at any time, or revoke directly from your Google account permissions page. Revocation takes effect immediately.

Google Calendar connection

When you connect Google Calendar to Prime Circa, Vanessa can see when you are busy and put confirmed appointments on a calendar of her own. We ask for the two narrowest Calendar scopes that allow this, plus your sign-in identity (“openid” and “email”), and nothing else.

• What we read: busy time blocks only — a start time and an end time. We use Google’s free/busy query, which does not return event titles, descriptions, attendees, locations, or any other content. We cannot see what your appointments are, only that something occupies that time. We also re-read the bookings calendar we created (never your own calendars) to keep Vanessa in step with changes you make there; from those events we keep only the event ID, its status, its start time and our own booking reference — titles, descriptions, attendees and locations are discarded as they arrive.
• What we write: events on an app-created calendar named “Vanessa — Bookings”. The scope we request grants access only to calendars this app created, so Vanessa cannot add to, change, or delete anything on your personal or existing work calendars. Reconnecting creates a fresh bookings calendar, so disconnecting and connecting again can leave more than one in your account; any you no longer want is yours to delete.
• Your email address: we read the email address of the Google account you connect, so the app can show you which account is connected.
• Where we store tokens: your Google refresh token is encrypted at rest with AES-256-GCM, using a key held outside the database. No plaintext refresh token is written to the database or to logs, and access tokens are never stored at all.
• Data sharing: your busy blocks and the events on the bookings calendar stay on our servers. What leaves them is the result: the open appointment times we work out from your schedule are sent to the voice provider listed below so Vanessa can offer them to a caller. No busy block, event, title or other calendar content is sent. We do not use any of it for advertising, profiling, or training machine-learning models, and we do not sell it.
• How to revoke: revoke the connection from your Google account permissions page, or email us at info@primecirca.com and we will disconnect it for you. Either way we stop using the connection immediately. The bookings calendar remains in your Google account and is yours to keep or delete.

Service providers we use

We share data with the following processors strictly to operate the service:

• Vapi — voice agent infrastructure for Vera and Vanessa.
• ElevenLabs — text-to-speech voice for Vanessa.
• Clerk — user authentication and account management for the Vanessa app.
• Stripe — payment processing for the Vanessa subscription.
• Twilio — SMS delivery and phone-number verification.
• Google — Places API (business lookup), Calendar API (availability and booking, only if you connect it), Gemini (LLM for drafting and classification, and for reading the business documents you choose to upload so Vanessa can answer from them), and Google Analytics (privacy-limited website and signup-funnel measurement). Under Google’s paid API terms, content we send to Gemini is not used to train its models; Google retains it for fifty-five (55) days for abuse monitoring, under its published Gemini API abuse monitoring policy.
• Meta — aggregate ad and conversion measurement through Meta Pixel.
• Vercel — website and backend hosting, plus aggregate website analytics.
• Cloudflare — DNS and basic security.

Each is bound by their own privacy commitments and a data processing agreement with us. We use them only for the purposes described above.

How long we keep information

• Call recordings + transcripts: minimum 90 days as a consent record, deleted on request after that.
• SMS history: retained as long as required by Twilio and applicable law (typically 12 months).
• Audit submissions: retained for analytics and improvement; you may request deletion at any time.
• Uploaded business documents: kept in private storage until you delete them in the app or close your account. Deleting a document removes it and anything Vanessa learned from it that you had not yet approved; facts you approved stay in your business profile until you remove them. Google retains the document content we sent it for fifty-five (55) days for abuse monitoring under its own policy, which deletion on our side does not shorten.
• Google Calendar connection: revoking stops all use of the connection immediately, and we ask Google to invalidate the grant. The connection record — which holds your encrypted refresh token and the Google account email, never any calendar content — is marked revoked rather than erased, and is deleted when you close your account or ask us to remove it at info@primecirca.com. Busy blocks are read live for a single availability answer and are never stored.
• Server logs: rotated within 30 days.

Your rights and choices

• Stop SMS: reply STOP to any message we send.
• Stop calls: tell Vera to remove your number, or email us at info@primecirca.com. We add the number to a permanent internal do-not-call list across all channels.
• Access or delete data: email info@primecirca.com with your business name and the channel you contacted us on. We respond within 30 days.
• Browser privacy signals: Google Analytics does not load when your browser sends Global Privacy Control or Do Not Track. Google advertising storage and personalization remain disabled for everyone.
• California residents: you have rights under the California Consumer Privacy Act (CCPA) including the right to know, delete, and not be discriminated against. Submit requests to the email above.
• Texas residents: you have rights under the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, including the right to know, delete, correct, and opt out of certain processing. Submit requests to the email above.

Children's privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from anyone under 13.

Security

We use industry-standard practices to protect data: TLS for data in transit, encryption at rest where applicable, and access controls limited to people who need them. No system is perfect; we will notify affected parties promptly in the unlikely event of a material breach.

Changes to this policy

We may update this policy. The “Effective” date at the top reflects the last revision. Material changes will be announced on primecirca.com.

Contact

Questions, requests, or concerns: info@primecirca.com.