Lena Privacy Policy

Lena is a product of Development United LLC.

Development United LLC ("Development United," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy describes what information we collect when you use our website, mobile application, AI phone and SMS agent services, business dashboard, and our personal assistant agent (collectively, the "Services"), how we use it, with whom we share it, and what choices you have.

By accessing or using our Services, you agree to this Privacy Policy. If you do not agree, please discontinue use of our Services immediately.

1. Information We Collect

1.1 Information You Provide Directly

• Name, email address, and phone number provided via our intake or sign-up forms
• Business name, industry, and use-case descriptions
• Payment information (collected and processed securely by our payment processor, currently Stripe; we do not store raw card numbers)
• Messages or questions you submit through our contact or intake forms
• Support communications sent to our team

1.2 Telephone & SMS Communications

Our Services involve initiating and receiving phone calls and SMS messages for appointments with businesses that use Lena, using our telephony and SMS provider (currently Twilio). When calls or messages are sent or received through our platform, we may collect:

• Your phone number (originating and destination)
• Call metadata: timestamp, duration, call direction (inbound/outbound), call status
• SMS message content sent or received through our platform numbers
• Records of your consent to receive text messages (see Section 4)
• Message and call identifiers from our telephony provider for audit and troubleshooting
• Carrier information and delivery status reports

All telephone communications are subject to applicable telecommunications laws, including the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and applicable state laws.

1.3 Call Recordings & Transcripts

Calls made through our AI voice agents may be recorded and transcribed for quality assurance, agent training, and service improvement purposes. You will be notified at the start of any recorded call via an automated disclosure message. If you agree during a call to receive text messages, the related transcript is kept as a record of your consent. Transcripts and recordings are retained per the schedule in Section 9.

1.4 Automatically Collected Information

• IP address and general geographic location (country / region)
• Browser type and version, operating system
• Pages visited, features used, and time spent on the platform
• Referral source (e.g., which link or campaign brought you to our site)
• Device identifiers and session identifiers

1.5 Information from Third Parties

• Payment processor (currently Stripe): payment confirmation and subscription status
• Telephony and SMS provider (currently Twilio): call and SMS delivery receipts, error codes, phone number metadata
• Voice AI infrastructure, speech, and language model providers: call audio, transcripts, and voice session data used to run our AI voice agents (see Section 8.1)
• Authentication and database hosting provider (currently Google Firebase): authentication tokens and database storage
• Google (Lena dashboard, optional): if you connect a Google account so your AI agents can send email from your own Gmail address, we receive your Google account email address, name, and the OAuth tokens needed to send that email. The dashboard does not read your mailbox. See Section 6.
• Google (our personal assistant agent, optional): if you connect a Google account to our personal assistant agent, we access your emails, calendar events, account email address, name, and OAuth tokens to do what you ask. See Section 7.

2. How We Use Your Information

• Provision and operate the Services, including placing and receiving AI-managed phone calls and SMS messages
• Authenticate your identity and secure your account
• Process payments and manage subscriptions through our payment processor
• Send you transactional communications: one-time verification codes (sent via Twilio Verify), appointment confirmations, and usage summaries
• Train and improve AI voice agents based on call transcripts and feedback (this does not include Google user data)
• Monitor for fraud, abuse, and compliance with our Terms of Service
• Respond to your support requests and legal inquiries
• Comply with legal obligations, including TCPA, FCC regulations, and law enforcement requests
• Analyze aggregate platform usage to improve our products

3. Telephone Consumer Protection Act (TCPA) Compliance

We take our obligations under the TCPA seriously. Our AI agents place and receive voice calls as part of the Services. We place automated or AI-generated calls only where the consent required by law has been obtained, and you can ask us to stop at any time.

Text messages are handled separately. Providing your phone number, calling a number on our platform, or requesting our Services does not by itself sign you up to receive text messages. We send text messages only when you opt in (for example, by agreeing during a call) or when you request a one-time verification code, as described in Section 4. Consent to receive text messages is not a condition of purchasing any goods or services.

You may revoke consent at any time by replying STOP to any SMS message or by emailing privacy@asklena.ai.

Our agent text messages are sent from numbers registered under the A2P 10DLC program through our telephony and SMS provider (currently Twilio) to ensure compliant messaging. All campaign registrations are maintained in accordance with CTIA guidelines and carrier requirements.

4. SMS / Text Messaging

4.1 How You Opt In

• During a call: the Lena AI agent asks whether you would like Lena to text you about your appointment (for example, confirmations, reminders, and follow-ups). Texts are sent only after you verbally agree, and you then receive a confirmation text from Lena.

4.2 What We Collect

• Your mobile phone number
• A record of your consent: the time you agreed, the phone number, and the call transcript in which you agreed
• The content of messages sent and received
• Message delivery status

4.3 How We Share Mobile Information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent will not be sold, rented or shared with third parties for their marketing.

Lena is the sender of all text messages. We use your mobile number only to send the messages you agreed to receive. We do not share mobile numbers or SMS consent with third parties or affiliates for marketing or promotional purposes.

4.4 Frequency, Rates & Opting Out

Message frequency varies. Message and data rates may apply. Reply HELP for help, STOP to opt out. For questions, email privacy@asklena.ai. See also our SMS Terms.

4.5 Verification Codes

Verification codes are separate from the agent text messages described above. If you request a verification code, we send a one-time code to the phone number you provide using Twilio Verify. It is used only to verify your identity, expires after a short time, and is never used for marketing. Message and data rates may apply.

5. AI Voice Agents & Automated Calls

Development United's core service involves deploying AI-powered voice agents that place and receive phone calls. You should be aware that:

• Calls handled by our AI agents may be made using an artificial or pre-recorded voice
• Inbound callers to numbers managed by our platform interact with an AI agent, not a human
• Our agents are built to identify themselves as AI at the start of each call when required by applicable law
• Call audio and transcripts are processed by our third-party voice AI infrastructure, speech-to-text, text-to-speech, and large language model providers (see Section 8.1)
• During a call, the agent may ask whether you would like Lena to text you about your appointment. Texts are sent only if you agree (see Section 4)
• Agent behavior is governed by the configuration you or Development United provides: you are responsible for ensuring your agent's script and actions comply with applicable laws

6. Google User Data: Lena Dashboard

This section applies when you connect a Google account in the Lena dashboard, so that your AI agents can send email from your own Gmail address. It explains how we handle data received from Google for that feature.

6.1 Permissions We Request

• Send email on your behalf
• Your email address and basic profile, used to identify the connected account

6.2 What We Access

We access your Google account email address, your name, and the OAuth tokens that let us send email for you. We do not read, list, search, modify, or delete your messages, drafts, labels, or contacts.

6.3 How We Use It

We use this access only to send the emails that you, or the AI agents you have configured, are set up to send from your own email address.

6.4 Storage & Security

OAuth tokens are encrypted at rest and used only on our servers. Email delivery logs are kept only as long as needed to troubleshoot delivery.

6.5 Sharing

We do not sell Google user data. We do not share it with anyone except service providers strictly necessary to send the email you requested, or when required by law.

6.6 Limited Use

Development United LLC's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use Google user data for advertising.
• We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
• No human reads Google user data except with your consent, for security purposes such as investigating abuse, to comply with applicable law, or when the data is aggregated and anonymized for internal operations.

6.7 Revoking Access & Deletion

You can disconnect your Google account at any time in the dashboard or at myaccount.google.com/permissions. Your OAuth tokens are deleted promptly after you disconnect your account. To request deletion of any other data, email privacy@asklena.ai.

7. Google User Data: Our Personal Assistant Agent

This section applies only to our personal assistant agent. It does not apply to the Lena dashboard, which only sends email (see Section 6).

7.1 Permissions We Request

• Read your emails
• Send emails and replies on your behalf
• Manage calendar events: create and update the calendar events you ask for. Google describes this permission as viewing and editing events on your calendars.
• Your email address and basic profile, used to identify the connected account

7.2 What We Access and How We Use It

We access your emails, calendar events, Google account email address, name, and OAuth tokens only to do what you ask the agent to do. Email content is fetched when needed to complete your request and is not kept longer than necessary.

7.3 AI Processing

Email and calendar content may be processed by our large language model providers only to complete your request. See Section 8.1 for our list of service providers.

7.4 Sharing

We do not sell Google user data. We share it only with service providers strictly necessary to provide the feature, for security or abuse prevention, or when required by law.

7.5 Limited Use

Development United LLC's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use Google user data for advertising.
• We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
• No human reads Google user data except with your consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymized.

7.6 Security

We protect Google user data with the security measures described in Section 12.

7.7 Revoking Access & Deletion

You can disconnect your Google account at any time in the app or at myaccount.google.com/permissions. Tokens and any stored data are deleted promptly after you disconnect or ask us to delete them. To request deletion, email privacy@asklena.ai.

8. Sharing Your Information

We do not sell your personal information. We share data only as follows:

8.1 Service Providers (Processors)

• Voice AI infrastructure providers (currently LiveKit): run our AI voice agents in real time; process call audio
• Speech-to-text and text-to-speech providers: convert call audio to text and agent responses to speech
• Large language model providers (currently OpenAI): natural language processing for our AI agents and our personal assistant agent
• Telephony and SMS providers (currently Twilio): voice calls, phone numbers, and text message delivery
• Verification code delivery (currently Twilio Verify): sends and checks one-time verification codes you request
• Payment processing (currently Stripe): payments and subscriptions; we do not store raw card numbers
• Authentication and database hosting (currently Google Firebase): sign-in, database storage, and website hosting
• Analytics (currently Google Analytics via Firebase): measures website usage patterns using cookies (see Section 11)
• Email delivery provider: sends confirmation and transactional emails from our website

We may change these providers from time to time; we will update this list when we do.

8.2 Legal Requirements

We may disclose personal information when required by law, subpoena, court order, or government regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal information may be transferred as part of that transaction and will remain subject to this Privacy Policy. You will be notified via email and/or prominent notice on our website prior to such a transfer. SMS opt-in data and consent records will not be sold, rented, or shared with any third party for marketing purposes as part of such a transaction. Google user data will be transferred only after obtaining your explicit prior consent.

9. Data Retention

You may request deletion of your personal data at any time by emailing privacy@asklena.ai. Certain data may be retained longer where required by law or legitimate business interests such as fraud prevention.

10. Your Privacy Rights

10.1 California Residents (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Correct inaccurate personal information
• Limit the use and disclosure of sensitive personal information
• Non-discrimination for exercising your privacy rights

To exercise these rights, email privacy@asklena.ai. We will respond within 45 days.

10.2 European Residents (GDPR)

If you are located in the European Economic Area, UK, or Switzerland, you have rights including: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing. Our legal bases for processing are: contractual necessity, legitimate interests, compliance with legal obligations, and your consent where explicitly given.

To exercise GDPR rights, contact our Data Protection contact at privacy@asklena.ai.

11. Cookies & Tracking

We use essential cookies required for platform authentication and session management. We use analytics tools (currently Google Analytics via Firebase) that set cookies to measure usage patterns. You may opt out by configuring your browser to reject cookies, though certain features may not function correctly as a result.

12. Security

We implement industry-standard security measures including TLS encryption for all data in transit, encrypted storage of sensitive fields in our database, encryption at rest of Google OAuth tokens, API key rotation, and access controls limiting internal access to personal data to authorized personnel on a need-to-know basis. Despite these measures, no system is 100% secure and we cannot guarantee absolute security.

13. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, contact us immediately at privacy@asklena.ai and we will delete it promptly.

14. Third-Party Links

Our website and services may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to read the privacy policies of any third-party services you access through our platform.

15. International Data Transfers

Our Services are operated from the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using our Services, you consent to this transfer.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted at asklena.ai/privacy with a revised effective date. We will notify users of material changes via email or an in-app banner at least 14 days before the change takes effect.