Privacy policy

Who this policy covers

This policy describes Cindy’s public website and CRM for home-service businesses and marketing agencies. The operator and privacy contact are identified in the business and contact section below.

Businesses and agencies use Cindy to manage information about their own customers and leads. They decide which information to enter and how to use it. If you contacted one of those businesses, its privacy notice also applies. You can contact that business or Cindy about information held in its workspace.

Information we collect

Website inquiries: the name, email address, business details, and message you send when contacting us or requesting a demo. Earlier website forms also stored a submission reference and time.
Accounts and business settings: names, email addresses, sign-in and recovery information, business contact details, team membership, roles, services, service areas, hours, and booking preferences.
CRM records: lead names, phone numbers, email addresses, service locations, form answers, appointment details, notes, assigned team members, and available marketing-source and advertising-spend information.
Conversations: SMS content and delivery status, call details, transcripts, and related summaries. When the AI receptionist is enabled, live audio is processed to conduct and transcribe the conversation. Audio recording is not enabled in the current voice flow.
Technical information: sign-in sessions, request identifiers, timestamps, errors, and connection information processed by our hosting and communications services.

Please avoid sending passwords, payment card details, government identifiers, or unrelated sensitive information in forms, messages, and calls.

Why we use information

We use this information to respond to inquiries; create and protect accounts; provide the CRM; deliver calls and texts; qualify and route leads; schedule appointments; show available campaign and source performance; and diagnose service problems. The features available to a business depend on its configuration.

Authorized business users and agency members can see information in the workspaces they are permitted to manage. AI-generated transcripts, summaries, and responses may contain errors and should be reviewed when accuracy matters.

Planned Meta integration

Cindy’s Meta integration is being built and is not publicly available. Planned features include campaign reporting and management, delivery of Meta lead-form submissions into the CRM, and Facebook and Instagram messaging. The Meta app is named Cindy (App ID 2109578926303608).

If you authorize the integration when it becomes available, the data needed for the features you enable may include connected business, ad account, Page and Instagram account identifiers; authorization tokens and granted permissions; campaign settings, performance metrics and spend; lead-form answers and contact details; and message content, participant identifiers and timestamps.

The intended uses are to show reports, carry out authorized campaign changes, import and route leads, and receive or send messages for the connected business. Data needed to perform authorized changes or send messages would be sent to Meta. These planned data flows do not mean Cindy currently has access to your Meta accounts. This policy does not indicate Meta approval, partnership, or certification.

Service providers and sharing

The current implementation uses these services for the functions described:

Cloudflare, through the earlier Sites website: stored demo-form submissions in a D1 database. Records submitted through that earlier form may still be held there.
Amazon Web Services: hosts this public website through Amplify, hosts the CRM and API, stores CRM records in Amazon RDS, supports account authentication with Cognito, sends account emails with SES, and provides operational logging.
Twilio: supplies configured phone numbers and processes call traffic, SMS content, and delivery information.
xAI: processes live audio, conversation context, and the business information needed by the enabled AI receptionist to respond and use Cindy’s booking tools.
Meta, when connected in the future: would exchange the data needed for the authorized features described above.

Using a connected service also involves that provider’s terms and privacy practices. A business or agency may independently retain information it receives or exports from Cindy.

Storage and security

This public website is hosted as static pages. Contact links open your email app; correspondence is handled through our monitored inbox. Earlier website form submissions and CRM records use separate storage systems. The CRM applies authentication and workspace access checks, and encrypted, certificate-verified database connections. Public pages and application endpoints use HTTPS. These measures reduce risk; no service can guarantee absolute security.

The public marketing site does not currently include advertising pixels or analytics tracking scripts, and its font is served locally. The CRM uses sign-in session cookies. Your browser and our service providers process the technical information needed to deliver the service.

Retention, deletion, and choices

CRM records and website inquiries are stored until they are removed through an applicable operational process; there is no single automatic expiration period for all customer data. Closing a browser, signing out, or disconnecting an integration does not delete previously stored records. Backup copies and provider-held records are separate from active CRM records.

You can request access, correction, or deletion by contacting team@usecindy.com. See data deletion instructions for what to include and the difference between revoking Meta access and deleting imported data. The scope of a request may depend on your identity, the business’s instructions, and applicable requirements. Contact us for the status of your request.

Contact and updates

For privacy questions or requests, contact team@usecindy.com. This page’s date identifies the latest revision. Future changes to available integrations or data practices will need to be reflected in this policy.