Skip to content

Privacy Policy

Last reviewed: 2026-10-22

Effective date: 2026-05-13 Last reviewed: 2026-10-22

TenFour Pro LLC, a California limited liability company doing business as TenFour Pro (“TenFour Pro,” “we,” “us,” or “our”), operates the website at https://tenfourpro.com and provides an AI assistant service (“Service”) for small service-trade businesses. This Privacy Policy describes the personal information we collect, how we use and retain it, and your rights under applicable U.S. state privacy laws.

Who this Policy covers

This Policy applies to: visitors to https://tenfourpro.com, prospective customers who request a demo, customers of the Service (“Customer”), and individuals whose calls are answered by the Service on a Customer’s behalf (“Callers”). For Caller information, TenFour Pro acts as a service provider under the California Privacy Rights Act (“CPRA”), processing on the Customer’s behalf. The Customer is the controller-equivalent for that information.

Categories of personal information we collect

Using the categories defined in California Civil Code Section 1798.140(v):

Category Examples Source
Identifiers Business name, contact name, phone number, email, IP address (hashed) You, your Customers, Callers, Twilio caller-ID
Commercial information Subscription tier, billing history You, our payment processor
Internet or network activity Pages viewed and titles, referrer, campaign tags, browser, device, screen size, language, time zone, clicks, demo calls and their length, forms started or submitted, and, for account holders, how the Service is used (PostHog analytics; cookieless on the Site) Your browser; the Service
Geolocation (coarse) City- or area-code-level inferred from caller phone number Twilio
Audio, electronic information Call recordings, transcripts, call summaries Inbound calls to your forwarded number
Inferences Per-trade urgency scores, lead-quality signals Service models
Sensitive personal information Potentially: precise location if a Caller reads their address aloud, or health-adjacent information if a Caller mentions a medical condition during triage Inbound calls

We do not collect: Social Security numbers, driver’s license numbers, payment card numbers (handled by our payment processor under PCI scope), genetic information, biometric identifiers, or any racial, religious, sexual-orientation, or union-membership data.

We do not create voiceprints or other biometric identifiers from call audio, we do not use call audio for speaker identification or voice cloning, and we contractually require our subprocessors not to derive biometric identifiers from it. This is relevant under biometric-privacy laws such as the Illinois Biometric Information Privacy Act (740 ILCS 14), Texas CUBI, and Washington’s biometric statute.

Sensitive personal information

The Service may, incidentally, record a Caller mentioning a medical condition during a triage call (for example, “my elderly mother is in the house and the heat is out”). We treat this as sensitive personal information under Cal. Civ. Code § 1798.140(ae). We use it only to deliver the Service (specifically, to classify urgency) and we do not retain health-adjacent inferences beyond the retention periods in the table below for whichever store holds the mention — the call transcript (12 months) or the job/intake details (2 years). We do not sell or share sensitive personal information for cross-context behavioral advertising. The “Limit the Use of My Sensitive Personal Information” right under § 1798.121 does not currently apply because we do not use sensitive personal information for purposes other than delivering the Service.

How we use personal information

We use the personal information described above to:

  • Operate, maintain, and improve the Service
  • Respond to demo requests and contact prospective customers
  • Send owner-approval SMS notifications to the Customer’s designated phone number
  • Schedule non-emergency appointments to a Customer-authorized calendar
  • Comply with legal obligations, defend legal claims, and prevent fraud and abuse
  • Measure how the Site and the Service are used, using analytics events that contain no names, email addresses, phone numbers, or call content

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use personal information to train third-party AI models.

When a Customer (the business owner) signs up for the Service, they opt in to receive operational text messages from TenFour Pro (lead alerts, dispatch approvals, daily status summaries, and account notifications) at the mobile number they provide. This opt-in is a required part of completing signup, and we record the date and time it was given. Message frequency varies. Message and data rates may apply. Customers can reply STOP to opt out at any time, or HELP for assistance.

Text-messaging opt-in data and consent will not be shared with any third parties or affiliates for marketing purposes. We use the mobile number only to deliver the Service’s operational messages and route them through our SMS subprocessor (Twilio). No mobile information is sold or shared for promotional or marketing purposes.

Second phone number. A Customer may also give a second phone number belonging to someone at the Customer’s business, such as its dispatcher or office staff, to receive job alerts. We send that number one text asking it to reply JOIN, and nothing else until it does, other than replies to texts it sends us. After JOIN, it gets the same job alerts as the Customer’s own number and can accept or decline jobs by text. Replying STOP stops texts to that number only; the Customer’s own number is not affected. When the Customer removes the number, we stop texting it and delete it from the Customer’s alert settings. We keep a record of its opt-in and opt-out (the number and the times; no message content) as proof of consent, and so we don’t text a number that has opted out, for 4 years after the number is removed or the account’s data is deleted, and then delete that record. Records of texts already sent to it are kept on the schedule in Retention below: message content for 12 months, and delivery records (numbers, times, status; no content) as listed there.

Callers. A Caller who books an appointment through the Service is asked by the virtual receptionist, on the call and before the booking, whether the business may text a confirmation to the number they gave. A confirmation text is sent only if the Caller clearly says yes; a yes and a no are both recorded with the appointment. The message identifies the business, confirms the booked appointment, and carries STOP instructions. If the business owner later responds to the request, the Caller may receive one status text from the business, sent on the basis of that request and never to a Caller who said no. Message frequency varies. Message and data rates may apply. Callers can reply STOP at any time to stop further messages, or HELP for assistance. The full consent flow, including the exact question asked, is published at tenfourpro.com/legal/sms-consent. Caller mobile numbers and consent are used only to send those messages on the business’s behalf and are not sold or shared with third parties or affiliates for marketing purposes.

Who we share personal information with

We share personal information only with the following subprocessors, each bound by a contractual service-provider obligation to process only on our instructions:

  • Vapi (voice orchestration)
  • Twilio (SMS delivery and inbound voice routing)
  • Google (Calendar API)
  • Anthropic (AI call summaries, caller-detail guesses for calls that end early, and urgency classification, primary)
  • OpenAI (AI call summaries and urgency classification, fallback)
  • Cloudflare (Turnstile anti-spam, CDN)
  • Railway (US-region hosting and database infrastructure)
  • Resend (transactional outbound email)
  • Stripe (subscription billing and payment processing)
  • PostHog (website and product usage analytics, US cloud)
  • Sentry (error monitoring)

We may also disclose personal information when legally required (subpoena, court order, government request).

Google user data

When a Customer connects a Google Calendar to the Service, they authorize TenFour Pro to access a limited part of their Google account through Google’s OAuth consent flow. We request only what the Service needs:

Google scope Why we request it
https://www.googleapis.com/auth/calendar.freebusy Read free/busy availability (only whether a time is busy, never event details) so the Service never offers a caller a time the Customer is already booked.
https://www.googleapis.com/auth/calendar.app.created Create one secondary calendar named “TenFour Pro” in the Customer’s Google account, and create, update, and delete the appointment events the Service books, reschedules, or cancels on that calendar. The Service cannot write to any other calendar.
openid, https://www.googleapis.com/auth/userinfo.email Read the connected Google account’s email address, solely to show the Customer which account is linked.

How we use Google user data. We use this access only to check calendar availability on the Customer’s main calendar and to write, update, or remove the appointment events the Service books for the Customer on the “TenFour Pro” calendar it created. That calendar belongs to the Customer: it stays in their Google account if they disconnect. We do not use Google user data for advertising, we do not sell or share it, and we do not use it to develop, improve, or train generalized or third-party AI/ML models.

Storage and retention. We store the Customer’s Google refresh token encrypted at rest (it is never written to logs) so the Service can keep the calendar in sync, plus the connected account email and the granted scopes. A Customer can disconnect at any time by emailing support@tenfourpro.com: we stop using the token to access the Customer’s calendar immediately. The Customer can also revoke our access directly, and immediately, at https://myaccount.google.com/permissions. The encrypted token itself is deleted from our database when the account is terminated, at the end of the 30-day export window described in Retention below. Calendar appointment events follow the same rule described there: a future appointment already on the Customer’s own calendar stays there, and only a past or cancelled one is deleted.

Limited Use. TenFour Pro’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

The table below lists the categories of caller or customer information we hold and the maximum time we keep each one, counted from the call, message, or submission that created the record.

Data Retention period
Caller contact details and service address (name, phone, email, address, and the map coordinates and time zone derived from it) 2 years from the call
Job and intake details (the description of the work needed, and the reasons recorded for how the call was classified) 2 years from the call
Call recordings Up to 14 days from the call
Call transcripts and summaries 12 months from the call
Detailed call-event logs (technical, turn-by-turn records behind live call dashboards) 30 days from the call
Caller phone number recorded on the call 2 years from the call
Text message content 12 months from when it was sent or received
Text-message delivery records (numbers, times, status; no content) Kept indefinitely, for billing reconciliation
Inbound text-message webhook receipts (delivery/dedupe records; no message content) 90 days
Owner alert content (dispatch and approval notifications, which quote caller details) 12 months
Abuse and fraud screening evidence 2 years
Address lookup cache (address → map point, not linked to a caller) 12 months
Website contact-form submissions 2 years
Demo request submissions 12 months
Subscription, billing, and tax records 7 years (tax and accounting recordkeeping requirements)
Account contact details (your name, business phone, and email) Kept for the life of the account, then with your billing records
SMS opt-out records Kept to honor the opt-out; never deleted on a clock
Caller call and SMS consent timestamps Kept as evidence consent was given; never deleted on a clock
A second alert number Until the Customer removes it; deleted at the end of the 30-day termination window
A second alert number’s opt-in and opt-out record (the number and the times; no message content) 4 years after the number is removed or the account’s data is deleted
Records that a deletion request was carried out Kept as proof of compliance, containing no personal information; never deleted on a clock
Website and account analytics events (pages viewed and actions on the Site, and account events; no name, email, or phone number) Up to 7 years (PostHog event retention); not part of the account-termination purge

The periods above are the maximums we commit to; we may delete a record sooner, including on request. A caller can ask us to delete their own information from a specific business’s records by emailing privacy@tenfourpro.com with the phone number they called from. Once we verify the request, we run the same targeted erasure described in the table above. Some things are not part of that erasure: the SMS opt-out record if the caller opted out (kept to keep honoring the opt-out), timestamps showing when SMS consent was given or declined, delivery records for text messages to or from their number (which hold no message content), any appointment already on the business’s own calendar, and a metadata-only record that the deletion happened, which itself contains no personal information. A Customer can request the same for their own account’s information, and can request the full data-retention schedule — every category we track internally and how each one is enforced — by emailing privacy@tenfourpro.com. When we carry out a Customer’s request, we also delete from PostHog the account events tied to that account’s internal ID. Records of server requests that carry the account ID (see Analytics below) are not removed that way; they are deleted when PostHog’s event retention period ends (up to 7 years).

Account termination. When a Customer’s subscription ends, by cancellation or by us, the Service stops working for that account immediately: it stops answering calls and sending texts, and the credentials it used to run the account are cleared. This starts a 30-day export window, during which the Customer may request an export of their operational data in a machine-readable format (see the Terms of Service). At the end of that window we permanently delete the caller and customer content listed above, regardless of each category’s own period, except: billing and tax records (kept 7 years); SMS opt-out records; callers’ consent timestamps; text-message delivery records without content; the account’s contact details kept with those billing records; the opt-in and opt-out record of a second alert number (kept 4 years); and the metadata-only record that the deletion happened. A future appointment already booked to the Customer’s own calendar is not deleted at termination — only a past or cancelled one is.

Your privacy rights

Your rights depend on the state you live in. We honor the rights described below for residents of any U.S. state, regardless of whether that state has its own comprehensive privacy law, and we apply the same request process to everyone.

Residents of states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, and other states as their laws take effect — generally have the right to access, correct, delete, and obtain a portable copy of their personal information, to opt out of the sale of personal information or its use for targeted advertising, and to be free from discrimination for exercising these rights. The specific statutory mechanics vary by state; we extend the substance of these rights to all U.S. residents.

California residents have these rights under the CCPA as amended by the CPRA:

  1. Know what personal information we have collected about you (Cal. Civ. Code § 1798.100, § 1798.110)
  2. Delete the personal information we hold about you (§ 1798.105)
  3. Correct inaccurate personal information (§ 1798.106)
  4. Opt out of sale or sharing for cross-context behavioral advertising (§ 1798.120)
  5. Limit the use of sensitive personal information (§ 1798.121)
  6. Non-discrimination for exercising any of these rights (§ 1798.125)
  7. Designate an authorized agent to exercise any of these rights on your behalf, subject to identity verification (§ 1798.135 regs)

We do not sell or share personal information for cross-context behavioral advertising, so no “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” control is required. Several states also require businesses to honor browser-based universal opt-out signals such as Global Privacy Control (GPC); because we do not sell or share personal information or use it for targeted advertising, GPC has no effect today. If any of this changes, we will add the required controls and honor GPC, and update this Policy before doing so.

To exercise any of these rights, contact us using either of the following methods:

We will respond within 45 days of a verified request, with one possible 45-day extension if needed and disclosed. We may need to verify your identity before responding. We will not discriminate against you for exercising any right.

If we deny your request, you may appeal by emailing privacy@tenfourpro.com with “Appeal” in the subject line. We will respond to your appeal within the time your state’s law allows (typically 45–60 days) and, where required, tell you how to contact your state attorney general if you remain dissatisfied.

For Caller information (information we hold on your callers as a service provider for our Customer), the right of deletion may also require the Customer’s coordination because they control the underlying account.

Call recording details

Calls to the TenFour Pro demo line and to your phone numbers using the Service are recorded for quality and product purposes after an audible disclosure at the start of each call. Call-recording consent rules vary by state: some require every party to consent (“all-party” or “two-party” consent — for example California under Cal. Penal Code §§ 631, 632, 632.7), while others require only one party. Because the Service announces at the start of every call that it may be recorded, and treats continued participation as consent (see Kearney v. Salomon Smith Barney, 39 Cal. 4th 95 (2006)), it is designed to meet the stricter all-party-consent standard as well as one-party states. A Caller who does not wish to be recorded can decline by ending the call; continued participation after the disclosure indicates consent. Because consent requirements differ by jurisdiction, the Customer is responsible for confirming recording is permitted for the calls they forward (see our Terms of Service).

Recordings are held by our voice subprocessor, Vapi, and are not copied to TenFour Pro’s own hosting. Access is limited to TenFour Pro personnel on a need-to-know basis and the Customer for their own calls. Recordings are deleted on the retention schedule above or sooner on request.

Call transcripts and call summaries are stored by TenFour Pro. The Customer, and the staff the Customer adds to its account, can read the transcript and summary of each of the Customer’s own calls in the TenFour Pro dashboard, including calls where the Caller hung up early, until they are deleted on the retention schedule above or sooner on request. Summaries are written by AI and may contain mistakes. Access by TenFour Pro personnel is limited to a need-to-know basis.

Children

The Service is not directed to individuals under 16, and we do not knowingly collect personal information from children under 13 (Children’s Online Privacy Protection Act). If you believe we have inadvertently collected such information, contact us at privacy@tenfourpro.com and we will delete it.

Security

  • Data in transit is protected by TLS.
  • Customer credentials (Twilio auth tokens, Vapi webhook secrets) are encrypted at rest with a key managed by TenFour Pro.
  • Access to production systems is limited to authorized personnel and logged.
  • We do not currently maintain a published security certification (SOC 2, ISO 27001) and we are in early access; certification is on our roadmap.

Cookies and tracking technologies

  • PostHog analytics runs on the Site in cookieless mode: it sets no cookies and keeps nothing in your browser’s local or session storage, so it cannot recognize you on a later day. It records:
    • the pages you view and their titles, and the page that referred you (for a page on another site, only that site’s address);
    • the campaign tags in the page address (utm_source, utm_medium, utm_campaign, utm_content, and utm_term, leaving out any value that could be an email address or phone number, or that is over 100 characters) and Google’s ad-click identifier (gclid), kept only when it is a code of letters, digits, hyphens, and underscores, up to 200 characters long, that could not be a phone number;
    • your browser and operating system and their versions, device type, screen size, language, and time zone;
    • clicks on our main buttons and links (sign-up, pricing, sample calls and the demo, automation, and booking) and on our phone number;
    • demo calls you start or end, how long they lasted, and how they ended; and
    • forms you start or submit. For a form it records only which form it was, the trade you selected and, for signup, the plan you chose, never your name or contact details.
  • PostHog uses your IP address and browser details to count visits without a cookie, and removes the IP address before it stores the event. Pages whose web address carries a checkout or onboarding identifier, such as the page shown after a completed checkout and the onboarding form, load no analytics, and neither does the “page not found” page. On every other page we remove all web-address parameters except campaign tags (the utm_ tags and gclid listed above, leaving out the values described there) before an event is sent.
  • Cloudflare Turnstile runs on our lead-capture form. It may set a short-lived challenge token in the browser to prevent automated abuse. The token is not used for tracking.
  • We do not use Google Analytics, Facebook Pixel, or any other ad-targeting cookies.

Analytics

PostHog also receives events from our servers about customer accounts: signup, checkout, onboarding, provisioning, completed calls, booked appointments, plan changes, and account closure. These carry an internal account ID and details such as trade, plan tier, timestamps, durations, call outcome, and whether a call was a demo.

We also send technical records of server requests and background jobs. A request record holds the route pattern (never the real web address), the method, status code, duration, and a request ID, plus the account ID when the request came from a signed-in account. A record of a failed background job holds the job’s queue and name, how many attempts it took, and the kind of error, with no account ID.

None of these include names, email addresses, phone numbers, street addresses, business names, call recordings, or transcripts. Nothing that identifies a caller is sent: a call appears only as its length and outcome.

Changes to this Policy

We may update this Privacy Policy. We will revise the “Last reviewed” date at the top and email account holders for any material change. Continued use after the effective date of a change constitutes acceptance.

Contact us

Sources consulted: Cal. Civ. Code §§ 1798.100 et seq. (CPRA, as amended by CPRA regs at Cal. Code Regs. tit. 11, §§ 7010-7028); Cal. Penal Code §§ 631-632.7; Kearney v. Salomon Smith Barney, 39 Cal. 4th 95 (2006); 47 U.S.C. § 227 (TCPA); Twilio A2P 10DLC guidance. This document is not a substitute for legal advice.