Your privacy policy and orb22

A short guide for businesses. Last updated: September 30, 2026

Before you publish an agent, orb22 asks for a link to your own privacy policy. Visitors see that link before every call. Your policy should tell them, in plain words, that your site has an AI voice assistant and what happens to their conversation. This page explains what to cover, what to do in the main regions where your visitors may be, and gives you text you can copy.

This is practical guidance, not legal advice. Laws differ by country and state, change often, and some businesses, such as health providers, have extra rules. You are responsible for the notices and consents your business needs. If you are unsure, ask your lawyer before you go live.

Checklist before you go live

Update your privacy policy with the paragraph below, and link it in Launch.
Keep the AI label and the notice that shows before each call. You can add to the notice, but do not remove what it says about AI, your providers, and the transcript.
Show the agent only on pages for adults. Use the "only these pages" setting to keep it off pages aimed at children or teens.
Do not collect sensitive data. Do not ask about health, finances, ID numbers, or other sensitive topics unless we have signed a written addendum with you.
Get marketing consent separately before you connect Klaviyo or another email tool. An email typed to receive results is not permission to send marketing.
Honor deletion and access requests. You can delete any call in the dashboard. To find a visitor's calls by email or to get an export, email support@22floor.com and we will help within a few business days.
Check your cookie banner if you use one. Our widget only uses browser storage needed to run the call and prevent abuse (and, with purchase tracking on, the items below), but your own site may need consent for other tools.
If you turn on purchase tracking (Launch, Track sales), update your cookie banner and your privacy policy first. With it on, the widget adds a call reference to your order links and, after the visitor agrees to analytics cookies, stores a random visitor ID and that call reference in the visitor's browser storage and a first-party cookie (up to 90 days). Your thank-you page, Shopify pixel, or Shopify order webhook sends us the order number, total, currency, and discount codes, and the email only as a one-way hash. List this under analytics in your cookie banner, and add the purchase tracking sentence below to your privacy policy. Keep "Respect cookie consent" on if you have visitors in the EU or UK. Visitors with Global Privacy Control turned on are never tracked.
Review transcripts in the first days after launch, and fix knowledge that gives wrong answers.

What orb22 collects when a visitor talks with your agent

Voice, in real time only. Nothing is sent until the visitor taps Start. Then the visitor's microphone audio streams to our voice AI provider (OpenAI) to power the conversation. We do not record or store audio, and we do not create voiceprints or identify people by their voice.
A text transcript of what the visitor and the agent said. Email addresses and long numbers, such as phone or card numbers, are masked in the stored transcript. Transcripts are deleted automatically after 90 days, and you can delete any call sooner.
Answers to your intake questions, and a written summary or assessment if you turned one on. AI summaries are on unless you turn them off in Calls; they are written by Anthropic's AI from the transcript, labeled as AI, and deleted with the call.
Name and email, only if the visitor gives them.
Call details: start time, length, the page the call started from, the traffic source (such as a campaign tag), which offers or products were shown or clicked, and the version of the notice the visitor accepted.
Abuse limits: a random device ID in the visitor's browser storage on your site, and short-lived counters based on that ID and the IP address. The counters expire within 2 days.
Calls that continue on another page: when your agent opens a page of your website for the visitor (on by default: Conversation, "can open pages on your website"), or the visitor follows one of your site's links during a call, the widget keeps a small resume state (the call's ID and token, its language, the last lines of the call and the cards on screen) in your site's sessionStorage for that tab only. It is deleted once the next page picks the call up and ignored after 90 seconds. On Shopify, your agent can also add a product to the visitor's cart with your store's own cart (/cart/add.js); nothing is bought until the visitor checks out.
Purchases, only if you turn on purchase tracking: the order number, total, currency, and discount codes of orders that match a call, kept for 90 days. Orders that do not match a call are not stored.

Who processes it

orb22 (DSBC LLC), as your service provider (processor). We process the data only for you, under our Data Processing Addendum.
Our subprocessors: Cloudflare (hosting and storage), OpenAI (real-time voice) and Anthropic (written answers, summaries and assessments). The widget's fonts are served by orb22 itself. See the subprocessor list. Our AI providers do not use the data to train AI models.
Tools you connect, such as your Klaviyo account or your own webhook. Name them in your policy if you turn them on.
Apps you connect in Integrations (Klaviyo, Mailchimp, HubSpot, Brevo, ActiveCampaign, Pipedrive, Salesforce, Zoho CRM, Google Sheets) get each lead through Composio, our connection provider, in your own account: the email and name if given, whether the visitor ticked the opt-in, and later the AI summary and purchases as notes. Marketing lists only with the visitor's tick. Name the apps in your policy.

What to do by region

Where your visitors are	What to do
All regions	Keep the AI label and the notice. Link a privacy policy that includes the paragraph below. Give visitors a way to reach you about their data. Do not collect sensitive data or target children.
European Union and EEA	Name your legal basis in your policy (usually your legitimate interest in answering questions the visitor chose to ask, or steps before a contract). The EU AI Act requires that people know they are talking with an AI, which the label and notice do. Mention the transfer to the US and the safeguards (Standard Contractual Clauses). Consider a data protection impact assessment if your agent handles anything personal beyond product questions. If you are outside the EU, check whether you need an EU representative.
United Kingdom	Same as the EU under the UK GDPR, with the UK Addendum for transfers. Marketing email needs consent under PECR, unless the soft opt-in for existing customers applies.
California and other US states	California and several other states require the consent of everyone on a call before it is recorded, and plaintiffs have sued businesses over chat and voice tools. Keep the notice before Start and do not remove the words about the transcript and your providers. Disclose the AI in your policy and add "audio information" and "inferences" if relevant to your notice at collection. If your agent could receive health information, Washington's My Health My Data Act and similar laws may apply: talk to us first.
Canada	Explain the purposes in your policy and get meaningful consent (the Start step helps). In Quebec, name a person in charge of privacy, tell visitors that data is processed outside Quebec, and complete a privacy impact assessment before transferring data outside Quebec. Marketing email needs express consent under CASL.
Australia	Say in your privacy policy that data is disclosed overseas (United States) and to whom. Some state laws require the consent of everyone in a private conversation before it is recorded, which the notice and Start step are designed to get. From December 10, 2026, if you use automated decisions that could significantly affect people, describe them in your policy. Marketing email needs consent under the Spam Act 2003.
Israel	Your notice must say what the data is for, whether giving it is required, who receives it, and the visitor's right to access and correct it (section 11 of the Protection of Privacy Law, as amended). Marketing email needs prior express consent under section 30A of the Communications Law. Keep the Hebrew notice on for Hebrew agents.
Brazil	State your legal basis and the international transfer in your policy, and give visitors the contact for your data protection officer (encarregado).
Elsewhere (for example Japan, Singapore, India)	Tell visitors about the purpose and the overseas processing, and get consent where your local law requires it. Ask us if you need specific transfer terms.

What your privacy policy should say

That your site offers an AI voice assistant, and that visitors talk with an AI, not a person.
What is collected: the list above, in your own words.
Why you collect it and your legal basis: for example, to answer questions the visitor chose to ask, give a personal recommendation, and follow up by email when the visitor asks.
Who receives it: orb22 and its subprocessors, and any tool you connect.
Where it is processed: the United States and other countries, and the safeguards used.
How long you keep it: transcripts for 90 days in orb22, and how long you keep anything you export or send to other tools.
How visitors can reach you to access, correct, or delete their data, and how to complain to a regulator.

A paragraph you can copy

Replace the parts in square brackets. Remove the Klaviyo sentence if you do not use it, and the purchase tracking sentence if you do not use that.

AI voice assistant. Our website offers an AI voice assistant, [agent name], provided by orb22 (DSBC LLC), a service provider that acts on our behalf. When you choose to start a conversation, you talk with an AI, not a person. Nothing is sent until you tap Start. Your voice is then streamed in real time to our provider's AI voice service (OpenAI) to run the conversation. Audio is not recorded or stored, and your voice is not used to identify you. We keep a text transcript of the conversation, with email addresses and long numbers masked, together with your answers to the assistant's questions, your name if you give it, your email address if you type it, and call details such as the time, length, the page the call started from, and which offers were shown or clicked. Your conversation may be processed by Anthropic's AI to answer your questions and prepare a written summary or recommendation. We use this information to answer your questions, give you a personal recommendation, and follow up with you if you gave your email address. Our legal basis is [our legitimate interest in answering the questions you chose to ask us / taking steps at your request before a purchase]. [If you tick the box to join our email list, we add your email address to our list, managed by Klaviyo. You can unsubscribe at any time.] [If you agree to analytics cookies, we note whether you bought something after the conversation: a random visitor ID and a call reference are stored in your browser for up to 90 days, and your order number, total, and discount codes are matched to your conversation. Your email address is used for this only as a one-way hash. We never do this when your browser sends a Global Privacy Control signal.] To prevent abuse, a random device ID is stored in your browser, and short-lived counters based on that ID and your IP address expire within 2 days. The information is processed in the United States and other countries, with safeguards such as the European Commission's Standard Contractual Clauses. Transcripts are deleted automatically after 90 days. Our providers do not use this information to train their AI models. We do not use it to make decisions with legal or similarly significant effects on you. Please do not share sensitive information during a call. To access, correct, or delete your conversation, contact us at [your email]. You may also complain to your data protection authority.

The notice visitors see before a call

orb22 shows this notice by default. You may add to it, for example to name your company's full legal name or add a sentence required in your region, but you may not remove the parts about AI, your providers, and the transcript.

You're talking with an AI assistant, not a person. By tapping Start, you agree that [business] and its service providers (orb22, OpenAI, Anthropic) may process your voice and save a text transcript of this call, as described in the privacy policy. Please don't share sensitive information.

If your lawyer advises a fuller notice, for example for visitors in the EU, UK, or California, this longer version works:

You're about to talk with [business]'s AI assistant, not a person. When you tap Start, your voice is sent in real time to our AI providers to run the call. Audio is not stored, but a text transcript and anything you tell us are saved for up to 90 days and shared with [business]. By tapping Start, you agree to this. Please don't share health, financial, or other sensitive information. [Privacy policy]

Email and marketing

When a visitor types an email address to get results, you may send them those results. That alone is not consent to marketing email in most countries.
With the Klaviyo connection on, the email card shows a separate opt-in box that is unticked by default, and only addresses of visitors who tick it are recorded as an email subscription in your Klaviyo account. Other addresses stay with the call. Only turn it on if your agent asks for marketing consent in a way that is valid where your visitors are, for example a separate, unticked opt-in, and make sure every marketing email includes an unsubscribe link.

Good practice

If your business handles health or other sensitive information, tell visitors not to share it, and check with your lawyer and with us before you go live.
Keep the agent's instructions honest: no fake urgency, no claims you cannot prove, and no pretending to be a person.
If a visitor asks you to delete their call, delete it in the dashboard or email us, and delete any copies you exported or sent to other tools.

Questions? Email support@22floor.com.