Privacy Policy

Matthews Automation LLC ("Matthews Automation," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have to control it. It applies to our website at matthewsautomation.net, our client portal, our AI-receptionist product Hank, and every other service we offer.

Please read it carefully. If any part is unclear, email privacy@matthewsautomation.net and we'll walk you through it in plain English.

1. Who we are

Matthews Automation LLC is a Georgia limited liability company doing business as "Matthews Automation." Our principal place of business is in Marietta, Georgia. You can reach us at mike@matthewsautomation.net or (470) 467-7724.

For privacy questions, requests, or complaints, use privacy@matthewsautomation.net. That address is monitored by Mike Matthews (the founder) directly.

2. Information we collect

We collect the following categories of personal information. Not every category applies to every user — what we collect depends on how you interact with us.

2.1 Information you give us directly

• Contact form / audit inquiry: your name, email address, phone number (optional), and the description you write about your business or workflow.
• Client portal: your name, email address, phone number, business name, and (for customers who become clients) service address, billing information, integration credentials you choose to share (Google Calendar, ServiceTitan, etc.), and any files you upload.
• Job applications: your name, email, phone, location, work history, resume link, LinkedIn URL, and cover note.

2.2 Information from calls to our AI receptionist Hank

When you call a phone number operated by Matthews Automation (including numbers we operate on behalf of client businesses), our AI receptionist "Hank" answers. Every call plays a "This call may be recorded" disclosure at the start. If you continue speaking after that disclosure, you consent to the recording. We collect:

• Audio recording of the entire call between you and Hank.
• Text transcript generated from the audio.
• Structured summary generated by our AI (Anthropic's Claude models) — typically your name, phone number, reason for calling, appointment preference, and any notes you shared.
• Call metadata from Twilio: your phone number, the time of the call, its duration, and its outcome.

If you do not want your call recorded, hang up during the disclosure and call again during business hours when a human answers directly.

2.3 Information we collect automatically

• Device and browser data: IP address, browser type, operating system, referring page, pages viewed, and time on page.
• Cookies: essential cookies for session authentication on the client portal. We do not use advertising or tracking cookies. Analytics is server-side only (Vercel Analytics — no cookies).
• Rate-limit + security logs: IP addresses and endpoint patterns for anti-abuse purposes.

2.4 Information from third parties

• Stripe: we receive limited payment information when you pay us — cardholder name, last 4 digits of the card, billing ZIP, and Stripe's internal customer ID. We do not receive or store your full card number, CVV, or bank credentials.
• Public directories: when we conduct sales outreach, we may use publicly available business directories to identify prospective customers. That data is limited to business name, business address, business phone, and owner name where public.

2A. SMS / Text Messaging

When you check the SMS consent box on our signup form at matthewsautomation.net/start (or provide equivalent written consent), you opt in to receive account and service text messages from Matthews Automation at the mobile number you provided.

Message types. Appointment confirmations, onboarding updates, service notices about Hank going live or being paused, follow-ups from Mike about your account, and replies to messages you send us. We do not use this channel for third-party marketing.

Message frequency. Frequency varies. During onboarding, expect roughly 1–5 messages per week. After Hank is live, most customers receive fewer than 4 messages per month unless there is a service issue to address.

Message and data rates. Message and data rates may apply. Your mobile carrier's standard messaging rates apply to any SMS you send or receive from us.

Opt out. Reply STOP to any message to unsubscribe from all further texts (except a final confirmation). Reply HELP for help and support contact information. You may also opt out by emailing privacy@matthewsautomation.net.

Supported carriers. Supported on all major U.S. carriers, including AT&T, T-Mobile, Verizon, and Sprint. Carriers are not liable for delayed or undelivered messages.

Consent is not a condition of purchase. You can buy or use our services without agreeing to receive SMS.

We do not share or sell mobile opt-in information or SMS consent to any third parties or affiliates for their own marketing purposes. Text-messaging originator opt-in data and consent are not shared with any third parties.

3. How we use your information

We use your information only for these purposes:

• Providing the service: answering your calls, booking appointments, sending you booking links, notifying you or the business owner about the call.
• Communicating with you: replying to your inquiries, sending you the written assessment you requested, sending contract and invoice emails.
• Billing and payment: charging the service fees you agreed to.
• Improving the product: aggregated, de-identified metrics only. We do not train external AI models on your calls or data (see Section 5).
• Legal compliance: maintaining records required by TCPA, tax law, and other regulations. Responding to lawful requests from courts or government agencies.
• Security: detecting and preventing fraud, abuse, and unauthorized access.

4. When we may share your information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We share information only in these limited circumstances:

• With service providers ("subprocessors") who help us run the service. Each is contractually bound to protect your information and use it only for the purpose we specify. Full list in Section 5.
• With the client business who received the call. When Hank answers on behalf of a client (e.g., a plumber's shop), we share the call recording, transcript, and structured summary with that client. That client is a separate business responsible for its own use of your information under its own privacy policy.
• With law enforcement or courts when required by a valid subpoena, warrant, or court order.
• In connection with a business transaction — sale, merger, or asset transfer. In that case, we would ensure the acquiring party is bound by equivalent privacy commitments.

5. Subprocessors (the third parties that help us operate)

We rely on the following subprocessors. Each one processes only the categories of information necessary for its role, and each is contractually bound by a Data Processing Addendum to protect it.

We update this list as it changes. Material additions of a new subprocessor category will be reflected here at least 30 days before the change takes effect for existing customers.

5A. Google user data

If you choose to connect your Google Calendar so that Hank can book appointments for you, we access a limited set of Google user data. This section explains exactly what, why, and what we will never do with it.

5A.1 What we access

• Calendar events (https://www.googleapis.com/auth/calendar.events) — we read your existing busy blocks so Hank can offer a caller a time you are actually free, and we create a new event when a caller books an appointment. We do not read the contents, attendees, or descriptions of your existing events for any other purpose.
• Your Google account email address (https://www.googleapis.com/auth/userinfo.email) — so we can show you which account is connected and so you can confirm it is the right one.

That is the complete list. We do not request access to your Gmail, your Google Drive, your contacts, or any other Google service.

5A.2 Limited Use commitment

Matthews Automation LLC's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we affirm that we do not:

• Use Google user data for serving advertising of any kind.
• Sell, rent, or transfer Google user data to data brokers, information resellers, or any other party for advertising, marketing, or resale.
• Use Google user data to train, fine-tune, or improve generalized or general-purpose AI models. Your calendar data is never sent to a model provider for training.
• Allow humans to read your Google user data, except: (a) with your explicit prior consent for a specific issue you have raised with us; (b) where necessary for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified.

5A.3 How it is stored and for how long

Your Google authorization token is stored encrypted at rest in our database (Supabase, listed in Section 5) and is used only by our own servers to create and read calendar events on your behalf. It is scoped to your business account only and is never shared with another client. We retain it for as long as your calendar remains connected, and delete it when you disconnect or when your account closes — whichever comes first.

5A.4 How to revoke access

You can disconnect your calendar at any time from the Account tab of your client portal, which deletes our stored token immediately. You can also revoke our access directly from Google at myaccount.google.com/permissions. Revoking access stops Hank from booking onto your calendar; it does not delete events already created, and it does not cancel your service.

6. How long we keep your information

We retain personal information only as long as we need it for the purpose we collected it. Specifically:

• Call recordings and transcripts: 90 days by default. Client businesses may request longer retention for their own records; in that case, retention matches their agreement with us. If you dispute a bill or file a legal claim, we may retain the specific call at issue longer.
• Account records (name, email, portal history): for the duration of your account plus 3 years after account closure, to defend against post-relationship claims.
• Payment records: 7 years (tax law requirement).
• Outbound call and SMS logs (TCPA audit trail): 5 years, per FCC 47 CFR 64.1200(d)(6).
• Marketing contact information you provided but never became a customer: until you opt out or 2 years, whichever comes first.

7. Your rights

You have rights over the information we hold about you. To exercise any right, email privacy@matthewsautomation.net. We will respond within 30 days.

• Right to know what information we hold about you, where we got it, and who we've shared it with.
• Right to delete your information, subject to legal retention obligations (tax records, TCPA logs).
• Right to correct inaccurate personal information.
• Right to export. If you are a client business, you may request a copy of your call recordings, transcripts, structured summaries, persona, and rule configuration at any time, as files in a readable format, whether or not you are leaving. This right survives termination of your account and is also stated as a contractual commitment in Section 16 of the Terms. If you are an individual caller, you may request a copy of the calls in which you participated.
• Right to opt out of "sale" or "sharing": we do not sell or share your personal information as those terms are defined by CCPA. This right is preserved as a matter of standard.
• Right to non-discrimination: we will not deny you our services, charge you a different price, or provide a different level of service because you exercised a right under this Policy.
• Right to opt out of marketing: reply STOP to any SMS. Unsubscribe from any marketing email. Contact us to opt out of outbound calls (we will add you to our internal do-not-call list, honored for 5 years or forever, whichever is longer).

If you are a California resident, you may exercise these rights yourself or through an authorized agent. We may ask you to verify your identity before honoring a request. If we cannot verify you, we will explain why.

8. Security

We use commercially reasonable technical and organizational measures to protect your information:

• Encryption in transit (HTTPS/TLS) for all data movement.
• Encryption at rest for our database (Supabase) and file storage.
• Row-level security enforced on tenant-scoped data.
• Access logging on administrator actions.
• Two-factor authentication available on the portal.
• Rate limiting on all public endpoints.

No system is perfectly secure. If a data breach affecting your personal information occurs, we will notify you and, where applicable, the Georgia Attorney General and the three nationwide consumer credit reporting agencies, in accordance with O.C.G.A. § 10-1-912 and any other applicable law.

9. Children

Our services are not directed to individuals under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have collected such information, contact us at privacy@matthewsautomation.net and we will delete it promptly.

10. International users

Our services are offered from the United States. If you access them from outside the United States, you understand your information will be processed in the U.S., which may have different privacy laws than your country of residence.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date at the top and, for material changes, notify you by email or a prominent notice on the site.

12. Contact

Matthews Automation LLC
Marietta, Georgia
privacy@matthewsautomation.net
(470) 467-7724

This Policy is a starting draft prepared with reasonable diligence; it has not yet been reviewed by an attorney. If any provision is inconsistent with any law that applies to you, that law governs and the rest of this Policy stays in effect.