Legal
Last updated: September 25, 2026
Vanguard Reception AI ("Vanguard," "we," "us") provides an AI-powered phone receptionist service for businesses. This Policy explains how we collect, use, and protect information in connection with the Service.
TWO TYPES OF INDIVIDUALS ARE COVERED:
From Clients: name, email, phone number, business name, category, hours, and services; login credentials; team member names and PINs (PINs are stored only as salted cryptographic hashes, never in plain text or reversible form); and, once billing is enabled, billing information (processed by our payment processor; we do not store full card numbers).
From Callers: name, phone number, requested service, appointment date and time, and audio recordings and/or transcriptions of the call, as provided during the call.
Automatically: app and website usage data, minutes consumed, and basic device/browser information for support and security purposes.
From website and app visitors who use our support chat: the messages you send and our assistant's replies, your email address if you provide it or are signed in, and a one-way hash of your IP address that is used only to limit the number of messages per day. The chat automatically removes passwords, codes, and card numbers it detects; please do not share them.
From people who use our free website check: the website address and email address they enter, the date, and the results of the check. We keep a one-way hash of the IP address only to limit checks to one per day.
Calls answered by our AI receptionist may be recorded and transcribed for scheduling, quality, and record-keeping purposes. A verbal notice is provided at the beginning of each call. Some jurisdictions require consent from all parties to a recorded conversation, and some require disclosure that the caller is interacting with an artificial intelligence system. Callers who do not consent may end the call at any time. Clients are responsible for ensuring their use of the Service complies with recording and AI-disclosure laws applicable to their business and their callers — see our Terms of Service, Section 6.
We use support chat conversations to answer your questions, to open support cases that our team reviews, and to improve our help content. We use call and appointment records to send each Client a weekly summary of their own activity, including an estimate of the value of booked appointments calculated only from the prices the Client entered for their services. We use the email address from a free website check to confirm it belongs to the person who asked, to send them the report, and to follow up about Vanguard; we do not sell it or share it outside the providers in Section 4. We use Client information to provide, maintain, and bill for the Service, to communicate with Clients about their account, and to improve the Service. We use Caller information solely to operate the AI receptionist for the Client the caller contacted (e.g., booking the requested appointment, logging the call outcome) — we do not use Caller information to advertise to Callers or sell it to third parties.
Calls are processed using generative AI technology provided by Vapi, Inc., which in turn relies on its own subprocessors for language understanding, speech synthesis, and transcription. Client and account data is stored using Google Firebase / Google Cloud Platform (authentication and database services). Support chat messages are processed by Anthropic, PBC (Claude) to generate the assistant's replies. Support cases and account emails (such as email verification and password reset messages) are delivered through Resend. These providers process data on our behalf under their own data protection terms; we select providers that contractually commit to protecting data they process for us.
Who receives your information, and what for. We use the following providers to run the Service. Each receives only what it needs for its job, processes it on our behalf under its own data protection terms, and is not permitted to use it for its own purposes:
(a) Google LLC — Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Scheduler and Cloud Storage for Firebase: your account, your business profile, your appointments, your call records, your usage counters and the photos you add to your included website. Stored in the United States.
(b) Vapi, Inc. — answers and carries the phone calls, and holds the recording and the word-for-word transcript of each call for up to 14 days (see Section 6). For our configuration, Vapi passes call audio and text to its own subprocessors: OpenAI (the language model that understands the caller), Cartesia (the synthetic voice the caller hears) and Deepgram (speech-to-text), plus the telephone carriers that deliver the call.
(c) Anthropic, PBC (Claude) — generates the replies of our website and signed-in support assistants, and receives the messages sent to them. If Google Gemini (see (e)) is unavailable, Anthropic also does the automatic fill-in described in (e), and then receives what the Client uploaded or linked to for that purpose.
(d) Firecrawl (firecrawl.dev) — fetches the public pages of the business website a Client asks us to read, so that hours, services and prices can be extracted from them; the public pages of the websites a Client enters to compare their site with (their own and up to five competitors', up to three pages per site); and the public home page entered in a free website check.
(e) Google LLC (Gemini API) — reads the business website, menu photo, price list, screenshot or PDF when a Client asks us to fill in their business profile automatically, and extracts the business details from it (name, contact details, hours, services and prices). It receives what the Client uploads or links to. It also writes the plain-English explanation in website comparisons and free website checks; for that it receives only the results our software measured (for example, whether a page has a tap-to-call number or shows its hours), never the full content of the pages. It also carries out the changes a Client asks for in plain words in the website editor ("Tell us what to change"); for that it receives the Client's request and the business details already shown on their website, and it can only suggest changes to the style, the short texts, the order of services and photos, and which sections are shown — never to prices, services or hours. And it checks every photo a Client adds to their website before it can appear, to keep out photos that are sexual, violent or clearly not about the business; for that it receives the photo, and the type and name of the business, after we have removed the photo's hidden data (such as the location where it was taken). It is not used to answer phone calls.
(f) Resend (resend.com) — delivers our emails: email verification, password reset, the notice that a receptionist is ready, alerts when a Client has used 80% and 100% of the minutes in their plan, the weekly summary, the notice that the included website is ready, the confirmation and report of a free website check, and support notifications. It receives the recipient address and the contents of the message.
(g) Netlify, Inc. — hosts our marketing website and web dashboard and, as part of serving pages, receives visitors' IP addresses and browser information.
(h) Google LLC (Google Analytics 4 and Google Fonts) — website analytics and the fonts our pages load; both receive website visitors' IP addresses and browser information. See the Cookies section.
(i) Stripe, Inc. — will process payments and hold billing details once we begin charging. No payment information is processed today.
(j) Apple, Google or Microsoft — only if a Client connects their calendar with "Add to my calendar". The Client's calendar app (Apple Calendar, Google Calendar or Outlook) then downloads, from a private link, the Client's appointments from the previous day onward: the service, date, time and duration, the customer's name, and the customer's phone number only if the Client allows their team to see customer phone numbers. Call summaries and billing information are never included. That provider stores and refreshes the calendar under its own terms and on its own schedule. The link is long and random so that it cannot be guessed, but anyone who has it can see those appointments, so the Client should not share it; the Client can replace it at any time from the dashboard or the app, and the old link stops working immediately. We do not keep a separate copy of the appointments for this: the link reads the appointments already stored in Google Firebase.
(k) Google LLC (PageSpeed Insights) — receives the public address of a website in a comparison or free website check, to measure how fast it loads on a phone. No personal information is sent.
We do not sell personal information, and we do not share it with anyone outside this list except as described in the section on how we share information. If we add a provider that receives personal information, we will update this Policy and its version number.
We do not sell Client or Caller personal information. We share information only: (a) with the service providers described in Section 4, to the extent necessary to operate the Service; (b) with a Client, regarding Callers who contacted that Client’s business number; (c) as required by law, subpoena, or legal process; or (d) in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy commitments.
Call recordings, transcripts, and call logs: these are held by our voice-AI provider, Vapi, Inc., not in our own database. Under the Vapi service tier we currently use, Vapi retains this raw call data for up to 14 days and then deletes it. We do not copy recordings or full transcripts into our own systems, and the app and website do not provide links to recordings. If we change Vapi service tiers or storage arrangements, this period may change and we will update this Policy.
Website photos: we remove hidden data (such as location and camera details) before storing a photo. Photos are kept while the Client's account is active and are deleted when the Client deletes them or deletes their account. A photo that does not pass our automatic check is deleted right away and never shown.
Free website check: the email address, website address and results are kept for 12 months and then deleted automatically; you can ask us to delete them sooner at support@vanguardreceptionai.com. Weekly summaries are kept in the Client's account while it is active.
Appointment, call-record, and account data: appointment details (caller name, phone number, service, date, and time), call records (caller name as given, summary, duration, cost, and outcome), usage data, and account and business-profile information are stored in Google Firebase for as long as the Client’s account remains active. We do not currently delete this data automatically, and closing an account does not by itself trigger automatic deletion. Clients may ask us to delete their account and associated data, and Callers may ask us (or the Client business they called) to delete their information; we will act on a verified request within a reasonable time, except for records we are required to keep by law (for example, billing records). Clients can also delete individual appointments themselves in the app.
Deleting your whole account: a Client can delete their account and its data from inside the app (Settings, then Delete account), from the web dashboard, or by writing to us. Deleting the account immediately stops the AI receptionist, releases the Vanguard phone number assigned to that business, and deletes the account, the business profile, appointments, call records, usage counters, team members and their PINs, support conversations and the included website. Three things are kept on purpose: a record that the account was deleted and when; a one-way hash of the email address and phone number used for the free trial, so that the free trial cannot be claimed twice (these hashes cannot be turned back into an email address or a phone number); and billing and tax records for as long as the law requires them, where a charge was made. Anything our voice provider still holds is deleted on its own schedule (the 14 days described above).
Support chat: conversations with our support assistant are automatically deleted 12 months after the last message, and support cases created from them are automatically deleted 12 months after they are opened. You can ask us to delete a conversation sooner.
We use industry-standard safeguards, including encryption in transit, hashed credential storage, and access-controlled infrastructure (Firebase Security Rules enforcing per-business data isolation). No method of transmission or storage is completely secure; we cannot guarantee absolute security.
Clients are responsible for providing any notices to Callers required by law beyond what the Service provides by default (such as state-specific AI-disclosure requirements described in our Terms of Service, Section 6), and for handling any data subject requests from their own Callers in accordance with applicable law.
The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from individuals under 18 as Clients.
Clients may access, correct, or request deletion of their account information by signing in to the app/website or contacting us. Depending on your state, you may have additional rights under state privacy laws; contact us to exercise them.
Our marketing website uses Google Analytics (GA4), which sets cookies to help us understand overall site usage, such as which pages visitors view and how they navigate the site. This data is aggregated and is not used to identify you individually. We do not use advertising or retargeting cookies. The website does not currently respond to "Do Not Track" browser signals. The mobile app does not use advertising cookies.
We may update this Policy from time to time. Material changes will be reflected by an updated "Privacy Version" that you will be asked to acknowledge the next time you sign in.
support@vanguardreceptionai.com — Vanguard Reception AI, Garden City, Kansas, USA.