Privacy Policy

1. Our roles and the client-owned account model

Customer-controlled processing. For visitor, lead, caller, and end-user information processed through a customer’s production systems, the customer ordinarily decides why and how the information is processed. Red Sphere ordinarily acts as the customer’s service provider or processor, accessing the customer’s systems only to implement, maintain, secure, troubleshoot, and improve the purchased Services according to the customer’s documented instructions.

Red Sphere-controlled processing. Red Sphere acts for its own business purposes when processing customer and prospect contact details, sales communications, contracts, invoices, payment status, security records, and information needed to operate Red Sphere’s own business, comply with law, prevent misuse, and establish or defend legal claims.

Production arrangements. Red Sphere operates the managed AI Assistant Foundation and Commerce services and may process data through its contracted hosting, Meta/WhatsApp, AI and payment providers. Separately selected client-owned systems remain under the customer’s ownership with delegated Red Sphere access. The Order identifies the actual account owners, processing locations, vendors, access, retention and export/exit arrangements. A shared application must preserve isolated client contexts.

2. Information we collect

• Customer and prospect information: business name, contact name, title, business email, business telephone number, billing contact, account communications, service selections, proposals, and onboarding responses.
• Billing and transaction information: subscription status, invoices, payment confirmations, transaction identifiers, billing address, and related accounting records. Stripe or another identified payment processor may process payment details; Red Sphere does not receive full payment-card numbers from Stripe.
• Business content: services, hours, service areas, frequently asked questions, approved responses, knowledge sources, routing rules, scheduling information, branding, websites, documents, and implementation instructions supplied by a customer.
• Visitor, lead, caller, and conversation information: names, contact details, requested services, location or service area, appointment preferences, project or inquiry details, messages, call audio or transcripts where enabled and permitted, routing events, support tickets, and other information an individual chooses to provide.
• Messaging and AI review records: incoming and outgoing message content, related sender and recipient information, AI-generated drafts, relevant conversation context, review decisions and approval records, where those functions are enabled. These records support responding to the individual and reviewing the applicable customer’s service.
• Account, onboarding and connection records: workspace memberships and invitations; payment-to-workspace links; connection notices and the document versions presented; acceptance and withdrawal records; connection permissions; provider, account and telephone-number associations; and setup, registration and configuration status. These records relate to the customer personnel who authorize or manage the service and the customer workspace concerned. Supported account-establishment flows protect credentials; passwords, card details, private keys and tokens are not collected in ordinary client documents or email.
• Technical and usage information: message delivery identifiers and status; timestamps, device/browser or network information made available by providers; usage counts; integration, operation and audit records; errors, security events and quality evaluations. These records support delivery, troubleshooting, access control and accountability for the applicable customer service.
• Website submissions and necessary technologies: information submitted through Red Sphere’s own website, scheduling, contact, or checkout interfaces, together with ordinary technical information generated when those interfaces are used. We use necessary session, security, form-protection and preference technologies to operate the site, protect requests and remember a visitor’s privacy choice.
• Privacy choice: the site begins with optional analytics off. A first-party preference cookie named rs_analytics_consent_v1 stores only whether optional analytics was granted or denied, ordinarily for 180 days. Refusing optional analytics does not prevent access to site content, forms or the configurator.
• Optional analytics: if a visitor allows it, we use Google Analytics 4 and Google Tag Manager to measure page views and limited website interactions, such as opening the website assistant or using an identified homepage control. The consent flow grants analytics storage only; advertising storage, advertising user-data and advertising-personalization signals remain denied. Google Signals and user-provided data collection are disabled, and no Google Ads account is linked to the analytics property.
• Changing a choice and retention: a visitor may use the Privacy choices control to change a decision. Withdrawal stops future optional analytics loading after the site reloads and removes accessible Google Analytics cookies under Red Sphere’s control. The configured Google Analytics property retains event data for two months and user data for fourteen months, with the user-data period reset by new activity. Google may process device and approximate-location information and may retain provider-side or aggregated records under its own settings and terms; Red Sphere cannot represent a browser-cookie deletion as immediate deletion of every provider-held record.

3. Sources of information

• Directly from customers and prospects during sales, checkout, onboarding, implementation, support, and account management.
• From visitors, leads, callers, and end users interacting with a customer’s deployed service.
• From customer-owned platforms and integrations to which the customer grants Red Sphere access.
• From publicly available business sources and business-information providers when Red Sphere identifies or evaluates prospective business customers.
• From payment processors, calendars, CRMs, email systems, hosting providers, advertising platforms, and other service providers involved in the selected implementation.
• Automatically through operation, monitoring, security, testing, and support of the Services.

4. How we use information

• Provide, configure, test, launch, maintain, monitor, support, secure, and improve the customer’s purchased Services.
• Answer approved questions; capture, classify, summarize, qualify, route, or deliver inquiries; support scheduling, callbacks, tickets, notifications, and customer-authorized workflows.
• Implement approved content, routing, integration, and configuration changes.
• Process payments, administer subscriptions, maintain business and tax records, and prevent billing errors or fraud.
• Identify, evaluate, and communicate with prospective business customers about Red Sphere services that may be relevant to their business.
• Measure usage and quality, diagnose errors, investigate incidents, protect systems, and enforce contractual limits.
• Comply with law, respond to lawful requests, enforce agreements, and establish or defend legal claims.
• Create aggregated or de-identified operational information that does not reasonably identify an individual. When Red Sphere relies on information as de-identified, it maintains the information in de-identified form and does not attempt to re-identify it except as permitted by law to test the effectiveness of de-identification controls.

Red Sphere does not sell Customer Data, visitor information, lead information, call content, or conversation content, and does not use Customer Data for targeted advertising. Red Sphere does not independently use identifiable visitor, lead, or caller information to market Red Sphere services to that individual unless the individual separately contacts Red Sphere or provides permission.

5. Artificial intelligence and human review

The Services may use artificial intelligence to interpret questions, generate responses from approved sources, classify or summarize requests, route leads or tickets, extract structured fields, support quality evaluation, and perform customer-authorized workflows. AI outputs may be incomplete or incorrect and should not be used as a substitute for appropriate human review in consequential situations.

Authorized Red Sphere personnel may review configurations, transcripts, submissions, call records, and technical logs when reasonably needed for setup, testing, quality assurance, troubleshooting, security, incident response, and support. Access is limited to the applicable customer and task.

6. How we disclose information

Applicable customer. Visitor, lead, caller, conversation, ticket, appointment, and workflow information is made available to or routed to the customer for whose business the Service operates.

Service providers and customer-selected platforms. Information may be processed by Red Sphere-selected hosting/infrastructure, AI/model, Meta/WhatsApp, messaging, email and payment providers for the actual service, and by customer-selected CRM, calendar, form, telephone or other systems where the Order requires them. Red Sphere-selected providers and customer-contracted vendors have distinct roles. We disclose data only as reasonably needed and preserve client separation; a listed vendor is not necessarily used for every client.

Messaging and AI providers. Where the selected service uses Twilio for messaging, relevant message content, sender/recipient details and delivery information pass through Twilio. Where OpenAI is enabled, relevant message text and the context or approved knowledge needed to generate a response may be processed by OpenAI. The data sent depends on the enabled function; these examples do not mean every provider receives every category of information.

Red Sphere service providers. Red Sphere may use Stripe for billing and may use professional hosting, communication, support, security, document, or accounting providers for Red Sphere’s own operations. Providers receive only information reasonably necessary for their function.

Optional form tools. Jotform or another conventional form provider may be used only when an Order specifically selects a form, document-upload, signature, or structured intake workflow. Jotform is not the default conversational-agent platform.

Legal and business events. Red Sphere may disclose information when reasonably necessary to comply with law, respond to lawful requests, protect rights or security, investigate misuse, complete a business transaction, or establish or defend legal claims.

Government and public-authority requests

If Red Sphere receives a request from a government or public authority for personal information, we will verify the requester and review the request’s legal basis, jurisdiction and scope before disclosing information. We will seek qualified legal advice where needed and seek clarification, narrowing or an appropriate legal challenge when there are grounds to consider a request unlawful or overbroad, consistent with applicable law and binding orders.

Any disclosure will be limited to the information legally required or otherwise lawfully justified for the specific request. We will protect unrelated client and user information, document the request, our legal reasoning, the people involved and our response, and use a secure delivery method. We will notify the affected customer or individual where legally permitted and appropriate. Preservation requirements and legal restrictions may limit deletion or notification. These rules do not grant authorities standing access to our systems.

7. Sensitive information, health information, and recorded communications

Sensitive and health information. Red Sphere does not intentionally collect protected health information or other specially regulated data in an ordinary implementation. A customer may select a separately approved regulated-data architecture, such as public/non-sensitive Voiceflow interactions that hand off to a HIPAA-enabled Jotform Gold or Enterprise account, or another vendor configuration with the required agreements. Before such processing begins, the customer and Red Sphere must identify the exact data, purpose, account owner, vendor plans, BAAs or other contracts, access, retention, destination, and human responsibilities. No vendor feature alone establishes compliance for the complete workflow.

A healthcare-sensitive workflow may not process protected health information until the parties approve the exact data flow, the selected vendors and plan support the use, required data-processing or business associate agreements are executed, access and retention are configured, and Red Sphere confirms the workflow in writing. References to security or compliance features do not certify that a customer’s organization is compliant.

Customers are responsible for determining and implementing notices, consent, recording disclosures, and other requirements for calls, transcripts, messaging, cookies, advertising, and industry-specific processing. Red Sphere will implement agreed technical controls but does not determine the customer’s independent legal obligations.

8. Data retention, deletion, and offboarding

Retention depends on the type of record, its service purpose, customer instructions and applicable legal obligations. Message content and AI review records support the relevant interaction and service review; connection and onboarding records support authorized access and setup; operational records support security and troubleshooting; billing and transaction records support accounting and legal obligations. These purposes do not authorize indefinite retention. The applicable service arrangements identify the relevant retention periods or criteria, including treatment of backups and provider copies.

After termination. Red Sphere will remove its access and delete or return personal data in its possession according to the accepted Order or written customer direction, ordinarily within thirty (30) days after termination, except for information that must be retained for law, accounting, security, dispute resolution, backups, or establishment of legal claims. The customer remains responsible for its production accounts, data, retention settings, exports, and subscriptions.

Cancellation and withdrawal. Ending a subscription, stopping automated replies, withdrawing a connection permission and requesting deletion are separate actions. Their effects depend on the service and provider involved. A request to stop processing does not by itself erase records that must lawfully be retained; the termination commitment above and applicable privacy rights continue to apply.

Backups and providers. Residual copies may remain temporarily in routine backups or third-party systems according to ordinary deletion cycles and provider terms. Red Sphere may retain contracts, invoices, payment records, approvals, and necessary business records for as long as reasonably necessary or legally required. Removing content from an active system does not itself remove older backup copies. Applicable backup cycles and restrictions on retained records continue to apply.

9. Data security

Red Sphere uses commercially reasonable administrative and technical measures appropriate to the Services, which may include role-based access, least-privilege invitations, separate client work areas, secure provider authentication, controlled releases, logging, testing, and incident response. No online system is completely secure.

Customers are responsible for their account ownership, billing, user administration, credentials, endpoint security, notices, retention choices, and prompt removal of former personnel. Customers should not send passwords, private keys, authentication tokens, or payment credentials by ordinary email or chat.

10. Privacy requests and appeals

Customers may request correction of business contact information or request return or deletion of data in Red Sphere’s possession, subject to contractual, operational, legal, billing, security, and dispute-resolution requirements.

A visitor, lead, caller, or end user seeking access, correction, deletion, or another privacy right relating to a customer’s Service should ordinarily contact that customer first. Red Sphere will provide reasonable assistance with verified requests when required and technically feasible.

Where applicable law provides additional rights, a verified individual may submit a request to oscar@red-sphere.com. Red Sphere may verify identity and authority. If Red Sphere denies a request made directly to Red Sphere, the requester may appeal by replying to the decision with the word “Appeal” and an explanation. Red Sphere will respond as required by applicable law. A requester is not required to create a new account solely to submit a request. A request to stop Red Sphere marketing can be sent to the same address; necessary service, billing and security communications are handled separately.

Provider-held records. Red Sphere’s response covers information it holds or controls and the assistance required of it for customer-directed processing. A provider may independently retain records under its own legal obligations and privacy terms. Red Sphere cannot promise to delete independent Meta, Twilio or other provider records outside its control; this does not remove Red Sphere’s obligations for data processed on its behalf.

11. International processing

Red Sphere operates from the United States. Information may be processed in the United States or other locations where the customer’s selected providers and Red Sphere’s service providers operate. Any required cross-border transfer mechanism must be addressed before the relevant processing begins.

12. Children

The Services are designed for business use and are not directed to children. Customers may not intentionally configure a Service to collect personal information from children in a manner requiring parental consent without Red Sphere’s prior written approval and implementation of required safeguards.

13. Changes to this Policy

Red Sphere may update this Policy prospectively. For material changes affecting active customers, Red Sphere will provide reasonable notice and obtain additional acceptance where required. Each published version will identify its effective date.

14. Contact

Red Sphere Design Studio, Inc.
Florida Document Number: P02000070428
Email: oscar@red-sphere.com