Privacy Policy

Introduction

This Privacy Policy for MSA Mercantile LLC, doing business as OrifoneAI ("we," "us," or "our"), describes how and why we collect, store, use, and process your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.orifone.ai or any website of ours that links to this Privacy Policy;
• Access or use the OrifoneAI platform for AI voice automation;
• Engage with us in other related ways, including sales, marketing, or support.

By using our Services, you agree to this Privacy Policy. If you do not agree, please discontinue use immediately. We may update this Privacy Policy from time to time by posting changes on our website and updating the "Last Updated" date above. Your continued use of the Services after any changes constitutes your acceptance.

Questions or concerns? Contact us at support@orifone.ai.

SUMMARY OF KEY POINTS

What personal information do we process? We collect information you voluntarily provide, information collected automatically through your use of the platform, and call data processed on behalf of your business.

Do we process sensitive personal information? We may process call recordings and voice data, which may contain sensitive information. We do so only as necessary to provide the Services.

Do we sell your personal information? No. We do not sell your personal information to third parties.

Do we share your information? We share your information only with service providers who help us operate the platform, and only as necessary. We do not share your data for advertising purposes.

How do we keep your data safe? We implement industry-standard technical and organizational security measures, including encryption, access control, and audit logging.

What are your rights? Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data. Contact us at support@orifone.ai to exercise these rights.

TABLE OF CONTENTS

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. When and With Whom Do We Share Your Personal Information?
4. Do We Use Cookies and Other Tracking Technologies?
5. How Do We Handle Call Recordings and Voice Data?
6. How Long Do We Keep Your Information?
7. How Do We Keep Your Information Safe?
8. Do We Collect Information from Minors?
9. What Are Your Privacy Rights?
10. TCPA, DNC & Telemarketing Data
11. Do United States Residents Have Specific Privacy Rights?
12. International Users & GDPR
13. Do We Make Updates to This Notice?
14. How Can You Contact Us?

Related: Data retention policy · Data subject rights (request form)

1. WHAT INFORMATION DO WE COLLECT?

1.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you register, use, or contact us about our Services. This may include:

• First and last name
• Email address
• Business name and registered address
• Phone number
• Billing and payment information
• Contact preferences
• Account credentials
• Call scripts, campaign configurations, and call recipient lists you upload

1.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain technical information, including:

• IP address and device identifiers
• Browser type, version, and settings
• Operating system and language preferences
• Pages viewed, features used, and actions taken on the platform
• Date and time of access
• Referring URLs
• Crash reports and error logs

1.3 Call Data

As a voice AI platform, MSA Mercantile LLC d/b/a OrifoneAI processes call-related data on your behalf, including:

• Phone numbers dialed and received
• Call duration, timestamps, and outcomes
• Call transcripts generated by the platform
• Call recordings (where you have enabled recording and obtained required consents)
• AI-generated call summaries and analytics

You are solely responsible for ensuring you have all required consents from call recipients before enabling call recording features. See Section 5 for more details.

1.4 Payment Information

We use Stripe to process payments. OrifoneAI does not store your full payment card details on our servers. Stripe collects and processes payment information directly. You can review Stripe's privacy practices at https://stripe.com/privacy.

1.5 Third-Party Authentication

If you use OAuth or other third-party authentication to access the Services, we receive basic profile information (such as name and email) from that provider as permitted by your account settings with them.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for the following purposes:

• Account creation and authentication — to create and manage your account securely.
• Service delivery — to operate the platform, configure AI voice agents, process calls, and provide analytics.
• Billing and payments — to process subscriptions, invoices, and handle payment disputes.
• Customer support — to respond to your inquiries and resolve issues.
• Communications — to send service updates, billing notices, and policy changes.
• Platform improvement — to analyze usage trends, identify bugs, and improve features.
• Security and fraud prevention — to detect and prevent unauthorized access and abuse.
• Legal compliance — to comply with applicable laws, respond to legal requests, and enforce our Terms of Service.

We process your information only when we have a valid legal basis to do so, including your consent, contractual necessity, legal obligation, or legitimate business interests.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We do not sell your personal information. We may share your information with the following categories of third parties only as necessary to provide the Services:

All third-party service providers are bound by data processing agreements requiring them to protect your information and use it only as instructed by us.

We may also share your information in the following situations:

• Business Transfers: In connection with any merger, acquisition, or sale of company assets, your information may be transferred as part of the transaction.
• Legal Obligations: We may disclose your information when required by law, court order, or government authority, or to protect the rights, property, or safety of OrifoneAI, our users, or the public.
• With Your Consent: We may share your information for other purposes with your explicit consent.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

Yes. We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your interactions with our website and platform. These technologies help us:

• Keep you logged in to your account;
• Remember your preferences and settings;
• Analyze platform usage and performance;
• Improve user experience.

You can control cookies through your browser settings. Note that disabling certain cookies may affect platform functionality. We do not use cookies for third-party advertising.

5. HOW DO WE HANDLE CALL RECORDINGS AND VOICE DATA?

OrifoneAI is a voice AI platform. Call recordings and transcripts are a core part of the Services. Here is how we handle this data:

• Call recordings are stored securely and accessible only to your account and authorized OrifoneAI personnel for support and compliance purposes.
• Transcripts generated by the platform are retained for the duration of your account, unless you request earlier deletion.
• You are solely responsible for obtaining all required consents from call recipients for recording, including compliance with two-party or all-party consent laws in applicable jurisdictions (e.g., California, Illinois, Washington).
• OrifoneAI does not use call recordings to train AI models without your explicit consent.
• Upon account termination, call recordings and transcripts will be deleted within 90 days unless retention is required by law.

If you process calls involving health information, financial data, or other sensitive categories, you are responsible for ensuring your use of the platform complies with applicable regulations.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required by law.

• Account data: Retained for the duration of your account and deleted within 90 days of account termination.
• Call recordings and transcripts: Retained for the duration of your account and deleted within 90 days of termination, unless you request earlier deletion.
• Billing records: Retained for up to 7 years as required for tax and accounting purposes.
• Legal hold data: Retained as long as required to comply with legal obligations or defend legal claims.

To request early deletion of your data, contact us at support@orifone.ai.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

We implement industry-standard technical and organizational security measures to protect your personal information, including:

• Security-focused infrastructure and technical controls;
• Encryption of data in transit (TLS) and at rest (AES-256);
• Role-based access controls limiting employee access to personal data;
• Regular security audits and vulnerability assessments;
• Multi-factor authentication for platform access.

Despite these measures, no system is completely secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law and provide information to help you take protective action.

8. DO WE COLLECT INFORMATION FROM MINORS?

No. OrifoneAI does not knowingly collect personal information from individuals under 18 years of age. Our Services are intended exclusively for registered businesses and adults. If we become aware that we have collected information from a minor, we will promptly delete that information. If you believe we have inadvertently collected information from a minor, please contact us at support@orifone.ai.

9. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on your location, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete information.
• Right to Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Right to Restrict Processing: Request that we limit how we use your information.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, contact us at support@orifone.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

Opting out of marketing: You may unsubscribe from marketing emails at any time using the unsubscribe link in our emails. You will still receive service-related communications necessary for your account.

10. TCPA, DNC & TELEMARKETING DATA

Because OrifoneAI is a voice AI platform used for outbound calling, the following applies specifically to call recipient data:

• You are solely responsible for ensuring all phone numbers you upload comply with TCPA requirements and have valid prior express written consent.
• You are responsible for cross-checking all call lists against the National Do-Not-Call Registry and applicable state DNC lists before each campaign.
• OrifoneAI does not independently verify consent records but reserves the right to audit campaign configurations and suspend accounts suspected of DNC or TCPA violations.
• Call recipient data you upload is processed on your behalf as a data processor. You remain the data controller for this information.
• Upon account termination, uploaded call recipient data will be deleted within 90 days.

If you receive a TCPA complaint or regulatory inquiry related to calls made through OrifoneAI, contact us immediately at support@orifone.ai so we can provide available records to support your response.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

California Residents — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, and share.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale: We do not sell personal information. You may still submit an opt-out request to support@orifone.ai.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of personal information collected in the past 12 months:

To exercise your California rights, contact us at support@orifone.ai. We will respond within 45 days as required by law.

12. INTERNATIONAL USERS & GDPR

MSA Mercantile LLC d/b/a OrifoneAI is headquartered in the United States at 8327 Ridge Crossing Lane, Springfield, Virginia 22152. If you access our Services from the European Economic Area (EEA), United Kingdom, or Switzerland, please be aware that your information will be transferred to and processed in the United States.

If you are subject to GDPR or UK GDPR, the following applies:

• Legal Basis for Processing: We process your personal data based on contract performance, legal obligation, legitimate interests, or your consent as applicable.
• Data Subject Rights: You have the rights to access, rectify, erase, restrict, port, and object to processing of your personal data.
• International Transfers: Where we transfer your data outside the EEA, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.
• Data Protection Officer: To contact our DPO or submit a GDPR-related request, email support@orifone.ai.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

If you require a Data Processing Agreement (DPA) for GDPR compliance, please contact support@orifone.ai.

13. DO WE MAKE UPDATES TO THIS NOTICE?

Yes. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by updating the "Last Updated" date at the top of this policy and, where appropriate, by sending an email notification to the address associated with your account.

Your continued use of the Services after any update constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

14. HOW CAN YOU CONTACT US?

For questions, concerns, or requests related to this Privacy Policy or your personal data:

MSA Mercantile LLC (d/b/a OrifoneAI) 8327 Ridge Crossing Lane Springfield, Virginia 22152 United States

• Email: support@orifone.ai
• Legal / Compliance: support@orifone.ai
• Website: https://www.orifone.ai

To review, update, or delete your personal data, email support@orifone.ai with your name, account email, and the nature of your request. We will respond within 30 days.