Privacy. The short version:

1. We don't use tracking cookies or behavioral profiles

No ad tracking, pixels, heatmaps, session recording, advertising networks, or cross-session visitor profiles.

The public pages do not set tracking cookies. BridgeView is a private owner dashboard; when an authorized owner signs in, Supabase sets essential authentication cookies so the session can stay secure. Those cookies are not advertising or behavioral tracking.

We don't use Google Analytics, heatmaps, session recording, or tools that build a visitor profile. The site records first-party aggregate page views and approved email, phone, contact-page, and Chat with Sam actions so the owner can see whether the website is being used. These events are not joined into a visitor or cross-session profile. We may also use aggregate search-performance reports supplied by search engines; those reports describe our pages rather than following you around the site.

The browser loads the site's application assets from our Vercel deployment. Website activity, Assistant events, and forms post only to same-origin Bridge Builders routes; those server routes use the providers named below. The site does not embed third-party chat scripts, ad tags, tracking pixels, or remote fonts.

Website activity events contain a random event ID, sanitized route ID, event type, optional approved contact-action ID, and timestamp. They do not contain a name, email, phone number, query string, referrer, form content, cookie, or visitor/session identifier. The Assistant separately records bounded operational events so we can see whether approved topics were answered or handed off. Those events contain an event ID, session ID, approved topic IDs, outcome, optional thumbs-up or thumbs-down rating, and timestamps. They never contain the visitor's question, the Assistant's answer, or a transcript.

2. When you chat with our AI assistant

Your free-form conversation stays in your browser; only privacy-bounded operational events are recorded.

The RunaAI-powered Assistant runs in your browser and answers from Bridge Builders-approved information downloaded with the page. If it cannot match a confident answer, it asks one clarification and then offers a human handoff rather than guessing. The website does not transmit the words you type or the answers it generates to Bridge Builders or to an AI model provider.

We record the bounded event fields listed above to operate and improve the approved knowledge. We do not record free-form question text, answer text, or conversation history. A connection address is used transiently to enforce abuse limits; only a one-way keyed hash is stored, and it is deleted after two days.

Our code doesn't save a transcript, and closing the tab ends the conversation. Browser extensions, accessibility tools, browser sync, or other software on your device remain outside our control, as on any website.

If you choose the Assistant's Share my details form, the name, email, optional phone, and note you submit follow the form process below. The chat transcript is not attached.

3. When an AI receptionist answers a call

Press 1 first. Until then, the call is not recorded, transcribed, or sent to an AI model.

This section applies when a phone number is configured to use our AI Receptionist. Basic telephony transport and call-detail metadata exist when the call connects, but recording, transcription, speech recognition, AI streaming, automated intake, and call-content storage remain off while the fixed notice plays.

The notice names the business, identifies the system as an AI receptionist, explains recording/transcription/service-provider processing, and requires the caller to press 1. Pressing 2, speaking, staying silent, entering another key, or timing out does not consent and does not unlock protected processing. The caller is offered the configured non-recorded alternative or may hang up. After consenting, the caller may press 9 to revoke consent; protected processing must stop and remain blocked.

After consent, the system may process the caller's phone number, call audio, transcript, call summary, message, appointment request, routing choice, and whatever details the caller voluntarily provides for the request. Callers should not provide passwords, complete payment-card numbers, government identification numbers, medical details, or other information the business did not ask for.

The provider chain depends on the deployed build. Twilio carries the call in the client's phone account and, when enabled, holds recordings. The LiveKit build uses LiveKit Cloud for call rooms, the phone worker and inference, Deepgram for speech recognition, OpenAI for language processing, and ElevenLabs for speech output. Earlier ElevenLabs Agent builds instead use ElevenLabs for the voice conversation and Cloudflare for the media and language-model gateways to OpenAI. Cal.com receives appointment details only when booking is enabled. The proposal and launch evidence identify the selected build, providers and settings; not every service is used on every call. We do not claim zero provider retention. Before activation, we record the current provider configuration and retention evidence for that deployment, or keep the service inactive until the client accepts a documented limitation.

The consent audit keeps the provider call ID, exact notice text and version, language, notice start and completion times, consent or revocation response, and response time. It does not contain pre-consent audio or a pre-consent transcript. Before activation, the client accounts must be configured and tested so that call content is kept only on the schedule published here, unless the client's published policy and signed proposal document a lawful reason for a different period. Provider security logs and rolling backups follow the applicable provider contract.

We do not create voiceprints, identify callers by the sound of their voice, make consequential eligibility decisions, or use call content to train AI models as part of the standard service. Outbound automated calls and texts are disabled unless separately scoped with the required consent, opt-out, suppression, and recordkeeping controls.

4. When you message SemperChat

SemperChat is a separate AI messaging service. What you write to it is stored by SemperChat and sent to its AI providers to write the replies.

SemperChat is our AI messaging assistant. Its app is served at app.semperchat.com. It answers messages sent to Bridge Builders AI (today, on Sam's chat page at chat.bridgebuildersai.com, which the chat buttons on our website open, and by email to our SemperChat address) and, for clients who use it, messages sent to their business on the channels they connect, such as website chat, email, Instagram, Facebook Messenger, WhatsApp or SMS. It always says it is an AI. It replies to people who contact the business first; it does not start conversations or add anyone to a marketing list.

To reply, SemperChat stores the messages you send, the conversation so far, the name, email address or phone number the channel provides, and anything you choose to share, and sends them to the AI model providers SemperChat uses to write replies: currently Anthropic, Google and OpenAI, depending on how the request is routed. This data is not used to train AI models, and those providers process SemperChat's requests under terms that prohibit training on it. SemperChat stores and processes data mainly in the European Union. Email us for the full list of SemperChat's service providers.

If you give Sam your email address and don't see one of his replies within 15 minutes, SemperChat emails you that reply with a link back to the chat. Tell Sam, or email us, if you'd rather not get these.

If Sam sends you an order link, it can carry the name, email and business name you gave him after a "#" in the link, so the order form opens filled in. Browsers don't send that part of a link to any server, and our page removes it from the address bar once the form is filled. The details reach us only if you submit the order, and you can change any of them first.

When you pay for an order, our website sends SemperChat your first name, email address, business name, what you bought and a short order reference, so Sam can email you a welcome, mark you as a customer and stop any sales follow-up emails. For 15 days after that, Sam doesn't send you automatic emails; replies from us come from a person. No payment details are sent.

If you book a callback, the appointment (your name, email, phone number and the time) is added to our Google Calendar, and you may receive a calendar invitation. When you book a callback or ask for a person, your name, contact details and a short summary are also copied into the private BridgeView lead store and follow the form rules in the next section. Bridge Builders reads SemperChat conversations to follow up with you and to check the assistant's work.

If you ask for a free SemperChat preview on our SemperChat page, we keep what you enter in the form (your name, email address, business name, website, industry and, if you give it, your phone number) as a request, like our other forms. Nothing more happens until you open the link we email you. Then SemperChat reads up to 15 public pages of your website, our server reads your homepage for your logo and brand colour and keeps a copy of it for your preview (with its scripts and links removed), and the details found are shown to you to check and correct. If you give an Instagram or Facebook page instead of a website, we don't read it: you fill in your details yourself. Your preview assistant is set up in a separate SemperChat account that holds only your preview while it runs, and answers only from your website and the details you confirmed. Your preview opens on its own page at demo.semperchat.com: the copy of your homepage, or a sample website made from your details, with your assistant in the corner. Unlike this website, that page loads the chat assistant from SemperChat's server, and the copy's pictures and styles from your own website. Anyone you share your preview link with can chat with it, and those chats are stored in SemperChat. We switch your preview off after 7 days and delete it then, with its chats, what it read from your website and the copy of your homepage. To have it deleted sooner, email us.

SemperChat conversations are kept in SemperChat while the contact exists in our account. We delete a contact, with its conversation history, when you ask, and contacts with no activity for 730 days are deleted automatically. If SemperChat's service ends, the remaining data is deleted within 30 days and its backups are cleared within 90 days.

Please don't send passwords, full card numbers, government ID numbers, medical details or other information nobody asked for. If you would rather not message an AI, email a person at hello@bridgebuildersai.com instead.

5. When you contact us, send an order, or share your details

Submitted forms are saved to the private BridgeView lead store and send an email alert to Bridge Builders.

The contact form, order form, and Assistant details form send the fields you deliberately submit to a same-origin server route. Draft text is not sent. After validation and abuse controls, the submission is stored in a Bridge Builders Supabase project and appears in the authenticated BridgeView dashboard. Bridge Builders operates that project and holds the contact details you submit in it as a processor, on behalf of the business whose form you used.

The stored lead can include your name, email, optional phone, source, topic, message, business name, order selections and estimate when applicable, submission time, and notification status. The free-form Assistant conversation is not included.

When you pay for an order, you pay on a checkout page hosted by Stripe. Your card details go to Stripe, never to our servers. Stripe tells us whether the payment went through, and we keep the order: what you bought, your contact details, the amounts, the date of the terms you accepted, and the Stripe references for you as a customer, the payment and, from go-live, the monthly subscription. Stripe keeps your card on file to charge the monthly from the day your service goes live, and processes payments under its own privacy policy.

Resend delivers the initial notification. When the synchronized BridgeView inbox is active, business replies and your email responses also pass through Resend and are stored as text in the private conversation record. HTML and attachments are not retained there. Direct business email may still be held in the Google-hosted inbox. If email delivery is delayed, the durable BridgeView record remains available.

A one-way keyed hash derived from the connection address is used only to enforce submission limits and is automatically deleted after two days. We do not use it for advertising or visitor profiling.

Please don't submit passwords, full card numbers, government ID numbers, medical details, or other information we did not ask for.

6. What your browser remembers

It's browser storage, not a cookie — and it stays on your device.

If you use an estimator or start an order, your browser saves your choices locally so you can close the tab and come back to your quote instead of starting over. The BridgeView demo does the same if you rearrange it.

If you close the invitation next to our chat button, or open the chat, your browser remembers that until you close the tab, so the invitation doesn't keep coming back.

If you apply to be a sales partner, we keep what you send in the application (your name, contact details and answers) to review it and write back to you. If you sign the Sales Partner Agreement online, we also keep the record of your signature: the name you typed, the date and time, and the network address and browser it came from, with the signed copy. None of it is shared with anyone outside Bridge Builders.

If you apply to be an installer, we keep your application answers, quiz results, the screening terms you accepted (with the name you typed, the time, and the network address and browser it came from), your task submission, its grading result and our review notes. Our AI tools examine submissions and may learn from them; we never copy an applicant's code. Ninety days after your round closes, an automatic job deletes your answers, submission, grading result and review notes, and we keep only that you applied, the terms you accepted and the outcome.

If you arrive through a link from one of our sales partners, your browser also remembers that partner's code for 30 days, so an order you place or a message you send later is credited to the partner who helped you. It is sent to us only with an order or a message you choose to send.

If you arrive by clicking one of our ads, or a link we tagged to measure a campaign, your browser also remembers that link's campaign tags and the click identifier the ad platform added to it (for Google Ads, the "gclid") for 30 days. It is sent to us only with an order you choose to place or a request form you choose to send (the contact form or a SemperChat demo request), and we keep it with that order or request so we know which ads lead to customers. If you came from one of our Google ads and then pay, or send one of those forms, we tell Google Ads that the click led to a purchase or a request: we send Google that click identifier, the time and, for a purchase, the amount paid. We never send Google your name, email, phone number or anything you wrote.

That sits on your own device and our website doesn't transmit it anywhere. We're not being coy: code running on a website can technically read that site's own browser storage — ours simply doesn't send it to us, which is why there's no copy of your half-finished quote on our side to lose.

You can clear it any time by clearing this site's data in your browser. Bear in mind that browser sync, device backups, or extensions are outside our control, as they are for any site.

7. What our web host can see

Our website is delivered by a company called Vercel. To serve and secure a page, their systems process the technical information any web server needs — your IP address, an approximate location derived from it, your browser and device type, which page you asked for and when, where you came from, and security and diagnostic logs.

That's how the web works and no website can switch it off. Some of it Vercel handles for us; some it handles for its own security, operational, and legal purposes, under its own terms.

We don't use any of it to identify or profile anyone. We're a small shop — we look at logs when something is broken.

If you're a customer, your site runs in a Bridge Builders Vercel project dedicated to you, and we process those host logs on your behalf rather than pooling them with anyone else's. If you leave, that project transfers to an account you name.

8. Text messages (SMS)

We only text our own team. Nobody who calls or writes to us is added to a text list.

Bridge Builders AI sends internal text-message alerts to its own staff and contractors when our AI receptionist takes a caller's message, so the caller can be called back. A staff member joins that list by giving us their mobile number for this purpose and agreeing to receive the alerts; we record who agreed and when.

Those texts contain the caller's name, callback number and the gist of their request, and a link to the private BridgeView inbox. Message frequency varies with call volume. Message and data rates may apply. Anyone on the list can reply STOP at any time to leave it, or HELP for help.

Twilio keeps a separate copy of message content and telephone-number metadata. Our current account makes message records accessible through its Console and Messages API for 30 days; that is an access window, not a deletion deadline. Backup storage is currently enabled, so older records remain archived indefinitely until deleted or the setting is changed. Deleted message bodies may remain in backups for up to 30 days. Message-body and phone-number redaction are not enabled on our account. Deleting a BridgeView record does not delete Twilio's copy.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. The mobile numbers on the alert list are used only to send those alerts, and are held with our messaging provider, Twilio, for that purpose.

9. Who else is involved

The provider list is short and specific.

Vercel delivers and secures the website. Supabase holds the lead, Inbox, task, Website-event, and Assistant-event stores in a Bridge Builders Supabase project, along with the authenticated BridgeView session, row-level access controls, rate limiting, and scheduled retention. Resend sends new-lead notifications and, when activated, synchronizes business email replies; Google hosts the ordinary Bridge Builders inbox.

Phone processing uses the named providers described in the AI Receptionist section: Twilio; LiveKit, Deepgram, OpenAI and ElevenLabs on the LiveKit build; or the earlier ElevenLabs and Cloudflare gateway path. Optional Cal.com booking receives the appointment information needed to make the booking. Bridge Builders manages its service-provider accounts; the client owns their Twilio account and optional Cal.com account.

Using the Assistant: no model provider receives the free-form chat. The bounded event metadata goes to Supabase through our same-origin server route.

SemperChat, our separate AI messaging service, is hosted mainly in the European Union and uses its own service providers, including Anthropic, Google and OpenAI for AI processing and Mailgun for email delivery; email us for the full list. Callback bookings are added to our Google Calendar.

If you email us directly, Porkbun forwards mail for our domain and Google holds the inbox. Ordinary invoicing, payment, accounting, or legal providers may become involved when you become a customer.

We do not sell your information to any of these providers, and none is used here for targeted advertising.

10. What we do with what you send us

Mostly, we reply to you. That's why you sent it and it's why we want it.

Beyond that, we use it for the ordinary business the message is part of: preparing a proposal, doing the work you asked for, invoicing you, supporting you afterwards, keeping the records a business has to keep, and dealing with a problem if one comes up. Nothing else.

We keep your message so we can pick the conversation up where we left it, the way anyone keeps their email.

We don't add you to a mailing list because you asked a question. If we ever start a newsletter, you'll have to actually ask for it.

If you become a customer, we'll hold the practical things we need to do the work — your contact details, what we agreed, and access to accounts that are in your name.

11. What we will never do

We don't sell your data. There's no asterisk on that sentence.

We don't sell, rent, or trade your information, or your customers' information, to anybody. Not to advertisers, not to data brokers, not to "partners". We don't hand it over for targeted advertising. The one thing an ad platform learns from us is described under "What your browser remembers": if you buy after clicking one of our Google ads, Google Ads learns that the click led to a purchase and its amount, not who you are.

We don't run ads on this site, or on yours.

Installers may draft public website copy from client-approved public facts only in tools covered by their signed Bridge Builders approval. They must not put client keys, customer records, call content, messages, setup-form answers or logs into any AI tool, even an approved one. Approval to view a client's incident evidence does not authorize copying it into AI tools. This rule does not replace the separately disclosed, consented processing performed by the operational service providers described on this page and in the applicable proposal and launch evidence.

We use the providers named on this page to run the requested service, including hosting, storage, mail, phone processing, AI messaging, optional booking and payments. This necessary service-provider processing is different from selling information or sharing it for advertising.

The exception nobody can avoid: if the law genuinely required it, we'd comply — and we'd tell you, unless we were legally forbidden from doing so.

12. If you're a customer: your data and your customers' data

The accounts that could be used against you are in your name — your domain, your phone number, your payment processor, and the account your email is sent from. The website and database we run for you sit in Bridge Builders projects dedicated to you, and transfer to an account you name if you leave. We also keep the ordinary things: our emails with you, invoices, and working copies of your content while we build.

Your customers' data belongs to you. Where we hold it we hold it on your behalf, as your processor, and it comes with you if you leave.

If your site takes payments, your customers enter their card details on your payment processor's own secure page, never on a form we built. We never see, store, or transmit card numbers, and we're never in the money flow.

If you collect information from your own customers, you're the one responsible for what you collect and why — you'll need your own privacy policy for your site. We'll help you understand what your site does; we can't be your legal advisor.

13. Client-approved installer diagnostics

No real-call diagnostics without explicit client approval; approved access expires after 24 hours.

An assigned installer can inspect only their own registered synthetic test calls by default. During an open incident after a client's service is Live, the installer can request a private approval email sent to that client's recorded contact. Opening the email link does not grant access. The client chooses one call reference from their own dashboard and explicitly approves on the private page, or asks the installer to work from the client's own inspection instead.

Approval permits read-only diagnostics for that client and that call: consent and call states, start/connect/end times, and whether a message, lead, Inbox entry or task was saved. It does not expose caller names, phone numbers, email addresses, message text, summaries or transcripts, and grants no bulk browsing, export, deletion or permission to send diagnostics to an AI tool.

Access is logged and expires 24 hours after the first approval. The same private link can revoke it sooner. Incident closure, reassignment, a changed client contact or loss of installer eligibility also ends it. Reopening or resending an email cannot extend approved access. Approval requests expire after 48 hours if not approved. Audit receipts record the grant, read, actor and outcome, not call content.

14. How long we keep it

Website and Assistant operational events are automatically deleted after 90 days. Website events contain only the bounded fields listed above; Assistant events do not contain question text, answer text, or a transcript.

Submitted lead records and synchronized Inbox message records are automatically deleted from their operational stores after 730 days. Archived Inbox threads and completed or cancelled tasks are also removed after the documented 730-day operational window. If an inquiry becomes a customer relationship, contracts, invoices, project records, and necessary correspondence may be retained separately for tax, accounting, support, and dispute-resolution obligations.

AI Receptionist call records and message content are automatically deleted from our operational store after 30 days, subject to a recorded legal hold. Provider retention varies by provider and configuration and is disclosed in the proposal, privacy notice, and launch evidence for that deployment. Scheduled deletion resumes when a legal hold ends.

One-way rate-limit hashes are automatically deleted after two days. Supabase scheduled jobs run the deletion policy daily, and job execution records are reduced after 30 days.

We may suspend scheduled deletion where we are required to preserve records for a legal claim, investigation, or similar obligation. A suspension is recorded, applies only for as long as the obligation lasts, and scheduled deletion resumes when it ends.

You can ask us to delete an inquiry sooner, subject to records we must keep for legal or accounting reasons. Copies in ordinary email or provider backups may remain until those backup cycles expire.

15. How we protect it

We use reasonable safeguards: multi-factor authentication on provider accounts, server-only service credentials, same-origin and size validation, idempotent submissions, abuse limits, an allowlisted BridgeView owner account, Supabase row-level security, and access limited to what a job needs.

We use account invitations rather than asking you for passwords. If anyone ever emails you asking for your password and claims to be us, it isn't us.

We're not going to claim perfect security, because nobody can. Email, devices, and websites can all be compromised, and a policy that promises otherwise is lying to you. If something did go wrong with information we hold, we'd tell you — promptly, and with what we actually know rather than a press release.

16. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" or "Global Privacy Control" signal asking sites not to track you or sell your information.

We don't change anything when we receive one, for the simplest possible reason: we already don't do those things. We don't follow you across other websites, we don't sell personal information, and we don't disclose it for targeted advertising. There's nothing for the signal to switch off.

We also don't let anyone else collect your activity across other sites through this one — there's nobody else here to do it.

17. Your data, your call

Ask us what we have about you and we'll tell you. It won't be a long list.

Ask us to correct something and we'll fix it. Ask us to delete it and we will.

Two honest limits. We may need to check you're you first — handing your information to whoever asks for it would be a strange way to protect it. And we may need to keep some things: invoices and tax records, or anything caught up in a live dispute. If that happens we'll tell you exactly what we kept and why, rather than hiding behind the word "legal".

There's no form for this and no ticket system. Send an email; a person reads it.

18. Children

This is a website for business owners. It isn't aimed at children, and we don't knowingly collect anything from anyone under 13. If you think a child has sent us something, tell us and we'll delete it.

19. Changes to this policy

If what we do changes, this page changes first — not months later. The date at the bottom tells you when it last moved.

One future change we already know how to treat: connecting a private RunaAI escalation service would make messages leave your browser. That would be a genuine change to this policy, and we'll make it here before we ship it, not after.