Privacy Policy

1.1Purpose of This Policy

This Privacy Policy describes how True Pay 4 Performance Inc., operating as Truedy AI (“Truedy AI,” “we,” “our,” or “us”), collects, uses, discloses, retains, and protects personal information when you visit our website, create an account, subscribe to and use the Truedy AI platform, access our API, or interact with our GoHighLevel Marketplace integration (collectively, the “Services”).

We take our obligations under applicable data protection laws seriously. This Policy is designed to give you full transparency about our data practices so that you can make informed decisions about your privacy.

1.2Scope of Application

This Privacy Policy applies to:

1.3Customers as Data Controllers

When Customers upload contact data, configure call campaigns, and direct the AI agents deployed through our Services, the Customer is acting as a data controller and Truedy AI is acting as a data processor with respect to that data. Truedy AI will process Contact Subject data only on behalf of and at the direction of the Customer. Customers are responsible for ensuring they have a lawful basis for providing contact data to Truedy AI and for directing us to contact individuals on their behalf.

1.4Truedy AI as Data Controller

With respect to data Truedy AI collects directly about Customers and Authorized Users (such as account information, billing data, and usage analytics), Truedy AI acts as a data controller.

4.1Information You Provide to Us Directly

Full name or business name Email address Password (stored in hashed form, never in plain text) Company name, size, and industry (optional) Job title or role (optional) Phone number for account verification or support purposes

The last four digits of your payment card Card type and expiry date (via Stripe) Billing name and billing address Stripe customer identifier

Agent name, persona settings, and voice preferences Greeting scripts, conversation prompts, and objection handling instructions Call disposition categories and outcome definitions Phone numbers assigned to agents Integration settings and custom workflow logic

Full names of contacts Phone numbers (mobile, landline, or business) Email addresses Company names and job titles Custom fields defined by the Customer GoHighLevel contact identifiers and CRM data Truedy AI processes this contact data solely on behalf of and at the direction of the Customer as a data processor.

4.2Information Collected Automatically

Pages and features accessed, and time spent on each Actions taken within the platform (such as creating campaigns, modifying agents, or reviewing analytics) API requests made, including endpoints accessed, timestamps, and response codes Error logs and crash reports Preferences and settings configurations

IP address (which may be used to infer approximate geographic location) Browser type and version Operating system and device type Screen resolution Referring URL and exit URL Language preferences Time zone settings

Call direction (inbound or outbound) Calling number and called number Call start time, end time, and duration in seconds Call outcome classification (e.g., contacted, voicemail, no answer, busy) Telephony provider call identifier Geographic region of the call (country or area code level)

4.3Call Recordings and AI-Processed Data

If you enable call recording, we collect and store audio recordings of calls. We also generate, through automated AI processing, the following derived data from calls:

Machine-generated transcripts of the call audio Sentiment analysis scores (positive, neutral, or negative) Call outcome classifications based on transcript and metadata analysis Short summaries and key moment extractions from the call The collection and processing of call recordings is subject to the requirements set out in Section 8. Customers are solely responsible for obtaining required consent from call participants before enabling recording.

4.4Information from Third-Party Integrations

OAuth access tokens and refresh tokens authorizing us to act on your behalf Your GoHighLevel location (sub-account) identifier Contact data retrieved from GoHighLevel for call campaigns (name, phone number, custom fields) Workflow trigger event details as configured by you

Call status and disposition records Error codes and failure reasons Carrier routing information

Payment status and confirmation identifiers Customer billing profile data Subscription lifecycle events (e.g., trial started, payment failed, subscription cancelled)

User identity data including verified email addresses Organization identifiers and membership details Authentication event logs

4.5Information We Do Not Collect

We do not intentionally collect:

Government-issued identification numbers (e.g., Social Security Numbers or passport numbers) except where required by law Sensitive Personal Data such as health, financial account, or standalone biometric identifiers, except to the extent incidentally present in call recordings or transcripts (which are processed by Customers at their own direction and subject to Section 9) Information from individuals under the age of 18

5.1Providing and Maintaining the Services

We use your information to:

5.2Billing and Payments

We use billing information to:

5.3Customer Support and Communications

We use your information to:

5.4Service Improvement and Analytics

We use aggregated and anonymized usage data to:

We do not use identifiable Customer Content or Call Data to train AI models without express Customer opt-in. See Section 10 for our complete training policy.

5.5Safety, Security, and Fraud Prevention

We use information to:

5.6Legal Compliance

We use information to:

5.7Aggregate Research and Benchmarking

We may compile Aggregate Data about platform usage, call volumes, AI accuracy metrics, and industry benchmarks. This Aggregate Data is de-identified and does not contain information attributable to any specific Customer or individual.

6.1Performance of a Contract

We process Account data, billing data, and Customer-provided configurations to the extent necessary to perform our obligations under the Terms of Service, including providing the Services you have subscribed to.

6.2Legitimate Interests

We process Usage Data, technical data, and security logs based on our legitimate interest in:

Where we rely on legitimate interests, we have considered the impact on your interests, rights, and freedoms, and we believe our processing is proportionate.

6.3Compliance with Legal Obligations

We process certain data, including records of transactions and security logs, to comply with our legal obligations under applicable laws.

6.4Consent

Where we send marketing communications or use non-essential cookies, we rely on your consent, which you may withdraw at any time as described in Section 16.

6.5Data Processing on Behalf of Customers (Processor Role)

When processing Contact Subject data at the direction of a Customer, Truedy AI acts as a data processor. The Customer is the data controller and is responsible for identifying and documenting the legal basis for such processing. Customers may request a Data Processing Agreement (DPA) by contacting privacy@truedy.ai. Truedy AI will consider such requests on a case-by-case basis.

7.1We Do Not Sell Personal Data

Truedy AI does not sell, rent, trade, or lease Personal Data to third parties for their own marketing or commercial purposes.

7.2Service Providers and Sub-Processors

We share Personal Data with trusted third-party vendors who process data on our behalf to support the delivery of the Services. These vendors are contractually bound to process data only as directed by us, to maintain appropriate security measures, and not to use data for their own independent purposes. Our key service providers and sub-processors include:

We may update our list of sub-processors from time to time. We require sub-processors to maintain data security practices appropriate to the nature of data processed.

7.3GoHighLevel Integration Data Sharing

When you enable the GoHighLevel Integration, data flows between Truedy AI and GoHighLevel as directed by your workflow configuration. This may include:

Contact identifiers and phone numbers sent to GHL when a call event triggers a workflow Call outcome data, summary text, sentiment scores, and recording URLs included in trigger payloads sent to GHL Workflow Builder OAuth tokens exchanged for accessing GHL API endpoints on your behalf You direct and control these data flows through your GHL workflow configuration. Truedy AI does not share data with GHL beyond what your configured workflows require.

7.4Business Transfers

In the event of a merger, acquisition, reorganization, sale of all or substantially all of True Pay 4 Performance Inc.’s assets, or similar transaction, Personal Data may be transferred to the acquiring entity as part of that transaction. We will provide notice of any such transfer and the privacy choices available to you.

7.5Legal Requirements and Safety

We may disclose Personal Data if we believe in good faith that disclosure is necessary to:

We will, where legally permissible, notify you before disclosing your data in response to legal process.

7.6With Your Consent

We will share your Personal Data with third parties not described above only where you have given express consent to such sharing.

8.1Call Recording

If you enable the call recording feature, audio recordings of calls conducted through the Services will be captured and stored in encrypted form on our cloud infrastructure. Call recordings are:

8.2Transcript Generation

We use automated speech-to-text AI services to generate written transcripts from call recordings or live call audio. Transcripts are:

8.3AI Analysis and Derived Data

Beyond transcription, our AI systems generate derived analytical outputs from call data, including:

All AI-generated outputs are probabilistic and are provided for informational purposes only.

Customers are responsible for validating these outputs before using them for business decisions.

8.4Customer Responsibility for Consent

Call recording and AI processing of call audio involves the processing of personal data of call participants, including third-party call recipients who are not Customers of Truedy AI. By enabling call recording, you represent and warrant that:

Truedy AI is not liable for your failure to obtain required consents. You indemnify Truedy AI for any claims, fines, or penalties arising from your unlawful recording of calls.

8.5No Use of Call Data for Model Training

Truedy AI does not use your call recordings, transcripts, or call content to train, fine-tune, or improve AI models sold to third parties. See Section 10 for our complete model training policy.

9.1Voice Recordings May Constitute Biometric Data

Voice recordings made through the Services may constitute biometric identifiers, biometric information, or biometric data under applicable state and international laws, including various U.S. state biometric privacy laws and similar laws enacted in other jurisdictions.

9.2Truedy AI’s Practices Regarding Voice Data

Truedy AI does not extract standalone voiceprints or biometric identifiers from call recordings for the purpose of identifying individuals. Call recordings processed through the Services are used for transcription, sentiment analysis, and call analytics — not for biometric identification. Audio data processed through our voice AI provider (Ultravox) is used solely to enable conversational AI functionality and is subject to Ultravox’s own data processing terms.

9.3Customer Responsibility for Biometric Compliance

Customers who use the Services to make or receive calls involving residents of Illinois, Texas, Washington, or other jurisdictions with biometric privacy laws are solely responsible for:

Truedy AI makes no warranties regarding the biometric privacy law compliance of any Customer’s call campaigns.

9.4Retention of Voice Data

Call audio retained through the Services is stored for the duration of your active Subscription (see Section 13.2). Audio files are encrypted at rest and in transit using AES-256. Upon deletion (upon explicit request or upon account termination), audio files are removed from active systems and will be overwritten from backup systems within 90 days.

10.1Default Policy: No Training Without Opt-In

Truedy AI does not use your Content or Call Data — including call recordings, transcripts, conversation logs, or agent configurations — to train, fine-tune, or improve any AI model that is offered to third parties, without your express prior written opt-in consent.

10.2Internal Platform Improvement

We may analyze aggregate, de-identified, and anonymized usage patterns across the platform (such as call outcome classification accuracy, transcription quality, or platform feature usage) to improve our Services. This analysis operates at the aggregate level and does not expose individual Customer Content in any identifiable form.

10.3No Third-Party Training Sharing

We do not share your Content with third-party AI providers (including Ultravox or ElevenLabs) for those providers’ independent model training purposes.

10.4How to Opt In or Opt Out

If you have previously opted in to data use for model training purposes, or wish to opt out at any time, you may do so by:

Opt-out requests will be processed within 30 days. Withdrawal of consent does not affect processing that occurred before the opt-out was processed.

11.1Data Received from GoHighLevel

When you authorize the GHL Integration, Truedy AI may receive the following data from GoHighLevel on your behalf:

11.2Data Sent to GoHighLevel

Based on your workflow configuration, Truedy AI sends data to GoHighLevel including:

11.3GHL OAuth Token Storage

Truedy AI stores GoHighLevel OAuth access tokens and refresh tokens in encrypted form in our database. These tokens are used only to perform integration functions that you have configured and authorized. Tokens are refreshed automatically as needed and are revoked from our systems when you disconnect the integration.

11.4GHL Data Processing Relationship

Truedy AI acts as a data processor with respect to contact data received from and sent to GoHighLevel at your direction. You, as the Customer, are the data controller responsible for the lawfulness of processing contact data through both platforms.

12.1What We Use

Truedy AI uses cookies and similar tracking technologies on our website and web application.

These include:

12.2Managing Cookies

You can manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, and configure alerts for new cookies. Note that disabling essential cookies will impair your ability to use the platform. For analytics and marketing cookies, you can also use available opt-out mechanisms provided by our analytics partners.

12.3Do Not Track

Some browsers transmit “Do Not Track” (DNT) signals. Truedy AI does not currently respond to DNT signals, as there is no consistent industry standard for how to respond to such signals.

However, you can control your privacy preferences through cookie settings and the opt-out mechanisms described above.

13.1Retention Principles

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

13.2Retention Schedule

13.3Post-Termination

Upon termination of your Subscription:

13.4Legal Hold

We may retain Personal Data beyond the standard retention periods described above if it is subject to a legal hold, active litigation, regulatory investigation, or a lawful preservation request.

14.1Security Measures

Truedy AI implements administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

We use role-based access controls, multi-factor authentication for internal systems, and the principle of least privilege.

15.1Location of Processing

Truedy AI’s primary operations and data storage are located in the United States. If you access the Services from outside the United States, your Personal Data will be transferred to and processed in the United States and potentially in other countries where our sub-processors operate.

15.2Transfers Outside Your Country

If you are located outside the United States, be aware that your Personal Data will be transferred to and processed in the United States. By using the Services, you acknowledge this transfer. If applicable data protection laws in your jurisdiction require a legal basis for such transfers, please contact privacy@truedy.ai to discuss your requirements.

15.3Sub-Processor Locations

Some of our sub-processors, including Stripe, Telnyx, and ElevenLabs, are based in the United States. These providers maintain their own privacy and data protection practices.

16.1Access and Correction

You have the right to access the Personal Data we hold about you and to request correction of inaccurate or incomplete data. You can access and update most of your account information directly through the platform settings. For requests not addressable through the platform, contact us at privacy@truedy.ai.

16.2Deletion

You may request deletion of your Personal Data, subject to our legal obligations to retain certain data (such as billing records and TCPA consent documentation) and any active legal holds. When you delete your Account, we will delete your Personal Data in accordance with the retention schedule in Section 13.

16.3Data Portability

You may request a machine-readable export of Personal Data that you have provided to us and that is processed by automated means on the basis of your consent or for contract performance. You can initiate a data export through the platform or by contacting us.

16.4Objection to Processing

Where we process Personal Data based on legitimate interests, you have the right to object to such processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

16.5Restriction of Processing

In certain circumstances, you may request that we restrict the processing of your Personal Data (for example, while we verify the accuracy of data you have disputed).

16.6Withdrawal of Consent

Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

16.7Marketing Opt-Out

You may unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at privacy@truedy.ai. Note that you may still receive transactional and service-related communications even after opting out of marketing.

16.8AI Training Opt-Out

You may opt out of any use of your Content for AI model training at any time by submitting a written request to privacy@truedy.ai with the subject line “Data Training Opt-Out,” or by using the data preference controls in your Account settings where available. See Section 10 for our complete training policy.

16.9Contact Subject Requests

If you are a Contact Subject whose data was uploaded to the platform by one of our Customers, your rights with respect to that data are best directed to the Customer who collected your information, as that Customer is the data controller. If you contact us directly, we will forward your request to the relevant Customer and assist in facilitating a response where possible.

16.10How to Submit a Request

To exercise any of the rights described in this Section, please submit a request to privacy@truedy.ai with the subject line “Privacy Rights Request.” We will respond within 30 days, or within the timeframe required by applicable law. We may request identity verification before processing your request to ensure we are responding to the correct individual.

17.1Applicability

This Section applies to California residents whose Personal Information is collected, used, or disclosed by Truedy AI subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

17.2Categories of Personal Information Collected

In the preceding 12 months, Truedy AI has collected the following categories of Personal Information as defined by the CCPA:

17.3Sources of Personal Information

We collect Personal Information from: (a) you directly; (b) your Authorized Users; (c) Third-Party Services (such as GoHighLevel and Stripe); and (d) automated collection technologies (such as cookies and log files).

17.4Business Purposes for Collection

We collect Personal Information for the purposes described in Section 5 of this Privacy Policy, including providing the Services, billing, customer support, security, and service improvement.

17.5Disclosure of Personal Information

In the preceding 12 months, Truedy AI has disclosed Personal Information to service providers and sub-processors as described in Section 7.2 for business purposes. We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising purposes.

17.6Your California Rights

California residents have the following rights under the CCPA/CPRA:

17.7Submitting California Requests

California residents may submit requests to exercise their rights at privacy@truedy.ai. We will respond within 45 days of receipt of a verifiable consumer request, with the possibility of a 45 day extension in certain circumstances. We will not charge a fee for processing verifiable consumer requests unless they are manifestly unfounded, excessive, or repetitive.

18.1Applicability

This Section applies to individuals in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland whose Personal Data is processed by Truedy AI in connection with the Services.

18.2Controller and Processor Roles

As described in Section 1.3, Truedy AI acts as a data controller with respect to Account and Usage Data and as a data processor with respect to Contact Subject data processed at the direction of Customers.

18.3Your GDPR Rights

Under the GDPR (and equivalent UK and Swiss law), you have the following rights:

18.4Supervisory Authority

If you believe our processing of your Personal Data violates applicable data protection law, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement. A list of EEA supervisory authorities is available at the European Data Protection Board website (edpb.europa.eu).

18.5Data Processing Agreement

Customers who are subject to GDPR may request a Data Processing Agreement (DPA) from Truedy AI to govern our processing of Personal Data on their behalf. Please contact privacy@truedy.ai to request a DPA.

21.1Right to Update

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. The updated Policy will be posted on our website with a revised “Last Updated” date.

21.2Notice of Material Changes

Where changes to this Policy are material (for example, changes to the types of data we collect, how we use it, with whom we share it, or new categories of processing activity), we will provide notice through one or more of the following:

21.3Continued Use

Your continued use of the Services following notice of changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you must discontinue use of the Services and contact us to close your Account.