Privacy Policy
Last updated November 2, 2026
Small Biz Automated ("we", "us") runs automation for small businesses: booking, reminders, review requests, rewards, social posts, invoices, team tools and phone answering. This policy explains what we collect, why, and the choices you have. It covers our website, our client portal, and the messages we send for the businesses we serve.
Who this covers
- Business owners and their team members who use our portal ("clients").
- Customers of those businesses who book, get texts or emails, rate a visit, or call a business phone line we answer.
For customer information, the business you deal with decides what is collected and how it is used. We process it on their behalf.
What we collect
- Account details: name, email, phone, business name, address, hours, services and prices.
- Customer details a business gives us or a customer enters: name, phone, email, appointments, visits, rewards points, ratings and feedback, invoices and quotes.
- Messages and calls: the texts and emails we send, replies like STOP, and for businesses using AI phone answering, call times, length, a summary and sometimes a recording.
- Team tools: for businesses using them, team names, roles, clock-in and clock-out times, and training progress. We do not store Social Security numbers or tax ID numbers.
- Basic technical data: sign-in sessions and logs needed to run and secure the service.
We never ask for or store passwords to your other accounts. Accounts like Square and Facebook connect through their own sign-in screens. If you choose to connect your own Twilio, Vapi or Resend account, we store the access key you give us securely and only use it to run your automations.
How we use it
- To run the automations a business turns on: confirmations, reminders, review requests, "we miss you" messages, rewards, invoices, social posts and phone answering.
- To show businesses their results and keep their records.
- To bill clients and provide support.
- To keep the service secure and working.
We do not sell personal information. We do not use customer information for our own marketing.
Text messages (SMS)
Businesses send texts through us only to customers who agreed to receive them, for example when booking or joining a rewards program. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the service providers below that deliver the messages.
Who we share it with
Only service providers that help us run the service, under their own privacy and security terms:
- Supabase (database and sign-in) and Vercel (website hosting)
- Twilio (texts and phone lines) and Resend (email)
- Square (payments and sales, when a business connects it)
- Vapi and the AI model providers it uses (AI phone answering, when turned on)
- Meta (Facebook and Instagram posting, when a business connects it)
We may also share information if the law requires it, or to protect people from fraud or harm.
How long we keep it
We keep information while a business uses the service. When a client closes their account, we delete or anonymize their data within 90 days, except records we must keep for tax or legal reasons. Messages older than one day that were never sent are skipped, not sent late.
Your choices
- Stop texts: reply STOP to any message.
- Stop emails: use the unsubscribe link in any marketing email.
- See, correct or delete your information: email us at the address below, or ask the business you deal with.
- Disconnect an account: clients can disconnect Square, Facebook, Twilio, Vapi or Resend from the portal at any time.
Data deletion requests
To delete your data, including anything that came from a connected Facebook or Instagram account, email cballardinc@gmail.com with the subject "Data deletion request" and the email or phone number you used. We confirm within 7 days and finish within 30 days. Disconnecting Facebook in the portal also removes our access token right away.
Security
Data is encrypted in transit, access is limited by business and role, and connected-account keys are only readable by our servers. No system is perfectly secure, so please tell us right away if you think something is wrong.
Children
The service is for businesses and is not directed to children under 13. We do not knowingly collect their information.
Changes
If we change this policy, we will update the date above and tell clients about important changes in the portal or by email.
Contact
Small Biz Automated · Merritt Island, Florida · cballardinc@gmail.com