Privacy Policy

Last updated: August 15, 2026
Operator:eFlux AI LLC (“eFlux”, “we”, “us”), operating the service at efluxai.com.

This policy explains what information we collect, how we use it, and the choices you have. It covers both our website and the eFlux Front Desk Receptionist service.

Who this policy covers

• Salon owners and staff who sign up for the eFlux service as customers.
• End customers of our salon clients whose calls are handled by our AI receptionist.
• Visitors to efluxai.com and anyone who calls our public demo number.

What we collect

From our salon clients (account data)

• Business name, owner name, business phone and email, address.
• Salon configuration you provide us: services, hours, pricing, staff names, booking policies.
• Payment details, handled entirely by Stripe. We never see your full card number.
• Google Calendar connection tokens, if you choose to connect your calendar. See Google Calendar data and Google API Limited Use below for exactly what we do with that access, what we never touch, and how to revoke it.
• Usage data: number of calls, minutes used, bookings made.

From end customers who call a salon using eFlux

• Caller phone number (captured automatically by the phone network; on calls forwarded to eFlux from a salon’s existing business number, it is passed to us by the salon’s carrier as part of the call forwarding).
• Caller name and any booking details spoken during the call.
• SMS opt-in status, recorded when the caller gives verbal consent on the booking call.
• Audio recording of the call and its machine-generated transcript.

From our public demo callers

• Caller phone number, hashed with a rotating daily salt. We use the hash to enforce rate limits; we do not retain raw caller numbers beyond the call record’s retention window.
• Audio recording and transcript of the demo call.

From everyone who visits our website

• Basic request logs (IP address, browser, referring page, timestamp).
• If you submit the setup-call form: your name, salon name, phone, email.
• The marketing link parameters and referring site that brought you here, and the first page you landed on. Your browser remembers these in its local storage for up to 90 days, so that if you come back later and sign up we can tell which ad or post originally brought you. This record contains no name, email, phone number or other identifier: only campaign labels, the referring site’s address, and the page you landed on.
• Aggregate page-view and click data. We record a small set of product events on our own servers (page views, which demo button you clicked, whether a call connected), keyed to a random per-visit ID that is discarded when you close the tab. No names, phone numbers, email addresses or call content are ever attached to these events, and we keep them for 365 days. We also use Google Analytics 4, a Google service that sets cookies. We do not use cross-site ad pixels. If your browser sends a Global Privacy Control signal we load no analytics at all and record nothing.

We do not knowingly collect protected health information (PHI). eFlux is built for beauty salons and day spas booking cosmetic services. If a caller volunteers medical information during a call, our AI is instructed to deflect and not engage.

How we use it

• To operate the service: answer calls, book appointments, send reminders, sync with your calendar.
• To bill you for the service.
• To provide support when you email us.
• To monitor the service for abuse, outages, and security issues.
• To improve our product. Call audio and transcripts may be used internally to tune the AI voice model and prompts. We do not use identifiable customer-call data to train third-party foundation models. If we ever want to do anything else with your audio, such as publishing it in a marketing clip, we will ask for your explicit opt-in, per call, in writing. This bullet does not extend to Google Calendar data, which is governed by the stricter Limited Use commitment in the next section.
• To provide Call Insights, if you turn the feature on. See the “Call Insights and AI analysis” section below for exactly what is analyzed, what we never store, and the two separate opt-ins involved.
• To comply with legal obligations (tax records, lawful process).

Google Calendar data and Google API Limited Use

Connecting a Google Calendar is optional. If you connect one, eFlux asks Google for the https://www.googleapis.com/auth/calendar.events permission, plus your basic Google account identity (openid and email). This section describes exactly what we do with that access.

What we do with your calendar

• We write and update only the appointments eFlux booked. Every event eFlux creates carries a private tag of ours. We never create, change, or delete an event that we did not create.
• We read your primary calendar so those appointments stay in sync. If you move or cancel an eFlux booking directly in Google Calendar, we need to notice. Google’s Calendar API offers no way to watch or list only the events carrying our private tag, so this check cannot be narrowed on Google’s side. Events that are not ours are discarded in memory the moment we see they are not ours. We do not store them, display them, or send them anywhere.
• We check when you are busy, not what the event is. To offer open appointment times, we use Google’s free/busy endpoint, which returns only busy time ranges. It does not return event titles, descriptions, locations, or guests, and we never request them.
• We clean up after ourselves when you disconnect. Disconnecting your calendar in the eFlux portal deletes the future appointments eFlux created, revokes the token with Google, and stops all access.

We use your Google account identity (openid and email) for one purpose only: to show you which Google account is currently connected. We never use it to sign you in to eFlux. eFlux portal sign-in is a separate system.

Limited Use

In particular, and because eFlux is an AI product, we want to be unambiguous about one thing: we do not use, transfer, or sell Google user data, whether raw, aggregated, or derived, to create, train, or improve any foundational or generalized machine-learning or artificial-intelligence model. Google Calendar data is never included in the call audio and transcript material described in the “How we use it” section above, and it is never part of the anonymized “Help improve eFlux” contribution described below.

Where our AI receptionist needs to know whether a requested time is free in order to book an appointment, it receives only the availability answer for that time. It does not receive your event titles, descriptions, guests, or any other calendar content, and nothing derived from your calendar is retained for model training.

Your connection tokens

Google Calendar connection tokens are stored in our database, encrypted at rest along with the rest of your account data, and are used only to make the calls described above. When you disconnect, we revoke the token with Google and stop using it.

You can also revoke eFlux’s access to your Google account at any time, independently of us, from your Google Account permissions page at myaccount.google.com/permissions.

Call recording and disclosure

Every call handled by eFlux, whether placed directly to your eFlux number, forwarded to eFlux from your existing business number, or made to our public demo, begins with a spoken recording disclosure. We do this because U.S. state laws vary: some states require only one party’s consent to record a call, and others require all parties to consent. By announcing that the call may be recorded, we make the disclosure work in both situations. Continuing the call after the disclosure is the caller’s consent.

If a caller objects to being recorded, the AI will offer to connect them to a human or to take a message without recording.

Call Insights and AI analysis (optional)

Call Insights is an optional feature, controlled by the salon owner and off by default. It involves two separate opt-ins.

Call Insights (analyze my calls).When a salon owner turns this on, eFlux automatically analyzes that salon’s completed calls to produce a short, structured summary for the owner: a category (for example “booked” or “price question”), a one or two sentence reason, an optional suggestion, and a self-assessment of how well the AI receptionist handled the call. Before any transcript leaves our systems for this analysis, we redact it: card numbers, Social Security numbers, dates of birth, phone numbers, and known staff names are removed. The redacted transcript is sent to our AI analysis provider (Google, using a Gemini model) on a paid tier that does not train on or human-review our prompts. We store only the structured summary, never the transcript, and the summary is governed by row-level security so only that salon can see it. The owner can turn Call Insights off at any time.

Help improve eFlux (anonymized contribution). A second, independent opt-in, also off by default and only available once Call Insights is on, lets a salon contribute an anonymized, aggregated signal that helps us improve the AI receptionist for everyone. This contribution contains only counts of how the assistant performed, grouped by call category and outcome, for a given week. It carries no transcripts, no customer or staff names, no per-call detail, and nothing that identifies the contributing salon. We use it solely to find where the AI receptionist works well or breaks down across all salons. The owner can turn this off at any time.

Who we share your data with (sub-processors)

We use a small set of trusted infrastructure vendors to run the service. Each one processes data only as needed to do its job.

Deepgram, ElevenLabs, and the backup speech vendors Vapi may engage during an outage (PlayHT, Microsoft Azure, LiveKit) process call audio through Vapi’s accounts, under Vapi’s data processing terms.

We do not sell your data. We do not share it with advertisers. We do not share it with anyone outside this list except when required by law (valid subpoena, court order, or similar legal process) or to protect the safety of a person in immediate danger.

Text messages and mobile opt-in

The phone numbers and SMS opt-in and consent information we collect are never sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. We share phone numbers only with the service sub-processors listed above (such as Twilio) and only to deliver the text messages you asked for.

eFlux sends transactional text messages, such as appointment confirmations, reminders, reschedule or cancellation notices, payment links a salon asks us to send for a visit, and account or setup updates. We do not send marketing or promotional texts on this program. Message frequency varies and is low volume, typically two to five texts per appointment cycle. Message and data rates may apply. Consent to receive texts is optional and never a condition of any purchase or service. You can reply STOP to any message to opt out at any time, or HELP for help. For the full text program details, including exactly how you opt in and what we send, see our SMS Terms.

Where your data lives

Our infrastructure runs in the United States. Sub-processors may operate globally; each one’s handling is governed by its own data processing terms, which we require to meet industry norms.

How long we keep it

• Customer account data: for the life of your account, plus any period required by tax or legal obligations.
• Call recordings (customer salons): 90 days by default. Delete on request at any time.
• Call transcripts (customer salons): 12 months. Delete on request at any time.
• Demo call recordings and transcripts: 30 days. Automatically deleted by our nightly cleanup.
• Google Calendar connection tokens: for as long as your calendar stays connected. Revoked with Google and no longer used the moment you disconnect, and deleted with your account.
• Billing records: 7 years, per U.S. tax law.
• Website request logs: 30 days.

How we protect it

• All data in transit is encrypted with TLS 1.3.
• All data at rest is encrypted: account data and transcripts in our Supabase database, and call recordings in Vapi’s encrypted storage, reachable only through our authenticated portal.
• Access to customer data is gated by row-level security: a customer can only ever see their own rows.
• A small number of named eFlux staff can reach customer accounts through an internal operations console, in order to provide support, investigate problems, and carry out deletion requests. That access is limited to individuals we name in advance, and is logged every time: who looked, at which account, and when. Where a staff member has multi-factor authentication enabled, it is enforced on that console.
• We do not store raw card numbers. Stripe handles all of that.

Your rights

You have the right to:

• See the data we hold about you.
• Correctit if it’s wrong.
• Delete it. We will delete your account and associated data within 30 days of your request, except where law requires us to keep records.
• Export your data in a machine-readable format.
• Opt outof any communications that aren’t operationally necessary (billing, security notices, service-critical alerts can’t be opted out while you’re an active customer).

To exercise any of these rights, email us at privacy@efluxai.com. We’ll respond within 30 days.

If you are a resident of California, the European Economic Area, the United Kingdom, or another jurisdiction with its own data-protection law, you may have additional rights under that law. We honor them on the same privacy@ email route.

Children

Our service is not directed at children under 18. We don’t knowingly collect information from anyone under 18. If you believe we have, please email privacy@efluxai.com and we’ll delete it.

Cookies and tracking

Our website uses a minimal set of cookies needed to make the site work, plus Google Analytics 4, which sets its own cookies to count page views and clicks. We also record product events on our own servers, keyed to a random per-visit ID held only in your browser’s session storage. It is discarded when you close the tab, so it cannot be used to recognise you on a later visit. Separately, your browser’s local storage keeps the marketing link parameters, referring site and landing page of your first visit for up to 90 days, so a later signup can be credited to the ad or post that first brought you here. That record holds campaign labels only, never your identity, and you can clear it at any time by clearing your browser’s site data.

If your browser sends a Global Privacy Control signal, we load Google Analytics not at all and record no product events. Most privacy-focused browsers and extensions send it automatically, and you can turn it on in your browser settings.

We do not use third-party advertising cookies. We do not track you across the web.

Changes to this policy

We will update this policy from time to time. If we make a material change, we’ll post the updated version here with a new “Last updated” date, and we’ll notify active customers by email at least 14 days before the change takes effect.

Contact

Questions, concerns, or requests about your data, reach eFlux AI LLC at:

• Email: privacy@efluxai.com

We respond within 30 days.

Last updated: August 15, 2026

Back to home