Privacy Policy

1. Introduction

Timberline Dynamics LLC ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what data we collect, how we use it, the legal bases for processing, and your rights regarding that data when you use our website (www.timberlinedynamics.com), mobile application, client portal, AI voice assistant services, and related communications (collectively, the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Information We Collect

2a. Information You Provide Directly

• Full name (first and last)
• Email address
• Phone number
• Business name and industry
• Service tier or package selection
• Support ticket details (subject, description, category)
• Account credentials (email and password, stored securely via hashed encryption)
• Training documents and custom instructions you upload for your AI agent
• Billing and payment information (processed securely by Stripe; we do not store full card numbers)

2b. Information Collected Automatically Through Our Services

• Call recordings and transcripts generated by our AI voice assistant
• AI-generated call summaries and outcome classifications
• Caller phone numbers and call metadata (duration, time, outcome)
• Voicemail and message content left by callers
• SMS message logs (messages sent to and from your business number)
• Website lead details submitted through a customer's "Text Us" widget (visitor name, mobile number, message, and SMS consent record)

2c. Information Collected Through Website and App Usage

• Device type, operating system, and browser type
• IP address and approximate geographic location
• Pages visited, features used, and interaction patterns
• Referring URLs and search terms that led you to our site
• Push notification tokens (mobile app, with your permission)

3. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver and manage our AI voice assistant and related services
• To create and maintain your client portal and mobile app account
• To process and respond to support tickets
• To send account notifications and service updates via email or push notification
• To send appointment booking confirmations and reminders
• To communicate about your service tier, billing, or account status
• To process payments and manage your subscription through Stripe
• To improve our services, AI accuracy, and user experience
• To comply with legal obligations and enforce our Terms of Service
• To detect and prevent fraud, abuse, or security incidents

4. Legal Basis for Processing

We process your personal information under one or more of the following legal bases:

• Contract Performance: Processing necessary to provide the Services you have subscribed to
• Consent: Where you have given explicit consent, such as for SMS messaging or marketing communications
• Legitimate Interests: For service improvement, security, and fraud prevention, where these interests are not overridden by your rights
• Legal Obligation: Where processing is required to comply with applicable laws and regulations

5. SMS / Text Messaging

When you provide your phone number, you may receive SMS/text messages from Timberline Dynamics LLC for the following purposes:

• Service notifications (e.g., new lead alerts, account updates)
• One-time passcodes (OTP) for login verification
• Appointment reminders and booking confirmations
• Support ticket status updates

Website Texting ("Text Us") widget. Some customers add our "Text Us" widget to their own websites. When a visitor submits the widget, they provide their name and mobile number and must affirmatively check a consent box agreeing to receive text messages about their inquiry. We record that consent (including a timestamp and the consent language shown) and use the visitor's number only to respond to and follow up on that inquiry on behalf of the business. Standard message and data rates may apply, and visitors can reply STOP at any time to opt out.

Mobile opt-in data and SMS consent information collected through our website, portal, or mobile app is never shared, sold, or disclosed to third parties or affiliates for marketing or promotional purposes.

6. Call Recording & AI Processing

Our AI voice assistant records and transcribes calls made to your business phone number. Important details about this processing:

• Callers are informed at the start of each call that they are speaking with an AI assistant and that the call may be recorded
• Call recordings, transcripts, and AI-generated summaries are stored securely and accessible to you through the client portal and mobile app
• Call data may be used to improve our AI service quality (see Section 10)
• Call recordings are retained according to our data retention policy (see Section 9)

7. Cookies & Tracking Technologies

Our website and services may use the following technologies:

• Essential Cookies: Required for authentication, session management, and security (e.g., login sessions, CSRF protection)
• Analytics: We may use privacy-respecting analytics to understand how visitors use our website and improve our services. This data is aggregated and does not personally identify individual users
• Local Storage: Used to store authentication tokens and user preferences in your browser or mobile app
• Advertising measurement (Meta Pixel): On our public website (not the client portal or mobile app), we use Meta's Pixel to measure how our Facebook and Instagram ads perform — for example, whether someone who saw an ad later visited our pricing page or started checkout — and to show our ads to people more likely to be interested. The Pixel uses cookies and sends Meta the page you visited and basic browser and device information. We never send Meta your name, email, phone number, or payment details, and the Pixel does not run on pages that contain account links or login information

You can turn off advertising measurement at any time using Your Privacy Choices at the bottom of every page. We also honor Global Privacy Control (GPC) browser signals as an opt-out. Turning it off does not affect your use of our website or services.

8. Third-Party Services

We use the following third-party services to operate our platform. Your data may be shared with these providers solely for the purposes described:

• Supabase — Database hosting, authentication, and backend infrastructure
• Stripe — Payment processing and subscription management
• Retell AI — AI voice agent platform that powers our virtual receptionist service. Retell, in turn, relies on its own sub-processors to provide the service — including Soniox (speech-to-text transcription) and Ironclad (contract and agreement management) — and maintains the current list of its sub-processors in its own Terms of Service and Privacy Policy.
• Twilio — Telephony infrastructure, phone number provisioning, and SMS delivery
• Google (Gmail API) — Email delivery for account notifications and support ticket updates
• Cloudflare — Website hosting, CDN, and DDoS protection
• Meta Platforms — Advertising measurement on our public website through the Meta Pixel (see Section 7)
• Expo / Apple / Google — Mobile app distribution and push notification delivery

Each third-party service provider is bound by their own privacy policies and data processing agreements, and where a provider engages its own sub-processors, those sub-processors are bound by equivalent data-protection obligations. We do not sell, rent, or trade your personal information to any third party for marketing purposes.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specific retention periods include:

• Account data: Retained while your account is active and deleted upon account deletion request
• Call audio recordings: Retained for 90 days (Basecamp plan) or 180 days (Ridgeline and Summit plans) from the date of the call, then permanently deleted
• Call transcripts, summaries, and call metadata: Retained while your account is active, even after the corresponding call audio has been deleted
• Billing records: Retained as required by tax and accounting laws (typically 7 years)
• Support tickets: Retained while your account is active

When you delete your account, we delete your personal data, call recordings, transcripts, messages, training documents, and configuration data within 30 days. Call recordings are erased from storage first, so they cannot outlive the records that reference them. Residual copies of database records may persist in our encrypted backups for up to 7 days after deletion; those backups are not restored to active use, and any restored copy is re-deleted. Some information may be retained where required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements, or complying with a legal hold).

10. Service Improvement & AI Training

Call recordings and transcripts may be reviewed by Timberline Dynamics to improve service quality, refine AI behavior, and resolve support issues. Call data is never shared with or used to train third-party AI models. Any analysis of call data is performed on anonymized and aggregated data where possible. You may opt out of service improvement reviews by contacting support@timberlinedynamics.com.

11. Data Security

We implement industry-standard security measures to protect your data, including encrypted connections (TLS/SSL), secure password hashing, row-level security policies on our database, and two-factor authentication (TOTP) available for your account. Access to production systems is restricted to authorized personnel only. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

All Users:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal data (available via the client portal, mobile app, or by contacting us)
• Opt out of non-essential communications
• Opt out of SMS messages at any time by replying STOP
• Opt out of service improvement data reviews

California Residents (CCPA/CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt out of the sale or sharing of personal information — we do not sell your personal information. Our use of the Meta Pixel on our public website may be considered "sharing" for cross-context behavioral advertising; you can opt out using Your Privacy Choices or a Global Privacy Control signal
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit the use of sensitive personal information — we only use sensitive information as necessary to provide the Services

Oregon Residents (Oregon Consumer Privacy Act):

• Right to know, access, and obtain a copy of your personal data
• Right to deletion of your personal data
• Right to correct inaccurate data
• Right to data portability
• Right to opt out of targeted advertising, sale of data, or profiling — we do not sell your data or engage in profiling. We use the Meta Pixel on our public website for advertising measurement and ad targeting; you can opt out at any time using Your Privacy Choices or a Global Privacy Control signal

European Economic Area / UK Residents (GDPR/UK GDPR):

• Right to access, rectification, and erasure of your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at support@timberlinedynamics.com. We will respond to verifiable requests within 45 days (or 30 days for GDPR requests). You may also delete your account directly through the client portal or mobile app at any time.

13. International Data Transfers

Our services are primarily hosted in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States where our servers and service providers are located. By using our Services, you consent to such transfers. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable law.

14. Children's Privacy

Our Services are designed for businesses and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If we learn that we have collected personal information from a child under the applicable age, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us at support@timberlinedynamics.com.

App-store age verification. To support compliance with app-store age-verification laws (including the Texas App Store Accountability Act and similar state laws), the Apple App Store and Google Play may verify a user's age and, for minors, obtain parental or guardian consent before our mobile app is downloaded or materially changed. Where an app store provides us with a user's age category or parental-consent status, we use that information only to comply with applicable law, enforce age-related restrictions, and provide safety features and default settings. We do not use it for advertising, marketing, profiling, or analytics, we do not sell or share it, and we delete it once the relevant verification is complete. Our mobile app does not currently request or store age signals from the app stores.

15. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no industry standard for DNT compliance, our website does not currently respond to DNT signals. We do honor Global Privacy Control (GPC) signals: if your browser sends one, we treat it as a request to opt out of advertising measurement, and the Meta Pixel is not loaded.

16. Third-Party Links

Our website and services may contain links to third-party websites or services that are not owned or controlled by Timberline Dynamics LLC. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. If we make material changes, we will notify you by email or through a prominent notice on our website. Continued use of our Services after changes constitutes acceptance of the revised policy.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Timberline Dynamics LLC
Tigard, Oregon
Email: support@timberlinedynamics.com