Privacy Policy

Effective October 2, 2026.

This policy explains what data Ligou handles, why, with whom and for how long. The data controller is RSM Venture Group LLC, a limited liability company organized in the State of Wyoming, USA, located at 30 N Gould St Ste N, Sheridan, WY 82801, USA ("Ligou", "we"). Privacy contact: privacidade@ligou.ai.

It applies to:

• the owners and users of the businesses that subscribe to Ligou;
• visitors to the website and users of the demo.

For the businesses' customers, the people who call them, Ligou processes data on behalf of the business and according to its instructions. The business is responsible for that data, and its own privacy notice also applies. Below we describe what we do with it.

1. Data we handle

Account and business

The name and email of the person who signs in, and basic Google profile data when signing in with Google (name and email). Also the business information you provide or approve:

• name, website and services;
• service area, hours and prices;
• answering rules and permissions.

Setup interview

Your voice is processed in real time during the interview. We keep the transcript and the information it produces for your review.

Website analysis

The public content of the business's website and public information about it on the internet, used to suggest the configuration.

Answered calls

• The caller's number and the date and length of the call.
• The conversation transcript and the information the caller provides, such as name, contact details, address, requested service and preferred time.
• The outcome of the call and the after-call summary.

The voice is processed in real time, and we do not keep audio recording files.

Calendar

When the business connects its Google Calendar, the calendar data described in section 3.

Text messages

The owner's mobile number, confirmed with a code, and the numbers of customers who receive the outcome of their request. We also keep the content and delivery status of each message.

Billing

Plan, invoices, minute usage and the Stripe customer and subscription identifiers. Card data is handled directly by Stripe; we never receive or store the card number.

Website demo

The voice of demo users is processed in real time, and we keep the transcript. We also keep whatever the person decides to share, such as name, company, website, contact details and interest. Permission for a later follow-up is recorded separately.

Technical data

Operational and security logs (times, errors and usage limits) and technical identifiers. The browser keeps preferences, such as reduced motion and whether the introduction was seen, identifiers needed to continue a conversation and the origin of the visit, described next.

Website measurement and advertising

To learn which ads and channels bring visits and sign-ups, the website and the dashboard keep in your browser (this site's local storage) the origin of the visit: the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the ad click identifiers (gclid, gbraid, wbraid, fbclid and msclkid), only the domain of the site that referred you, the first page visited, the time and a random visitor identifier. When you create an account, this origin is saved with it. It does not include your name, email, phone number or the content of any conversation. When the address carries an fbclid, the site also sets the _fbc cookie, in Meta's format, for 90 days.

When enabled, the website and the dashboard also load Google Analytics 4 and the Google Ads tag, from Google, and the Meta Pixel, from Meta. These tools receive from your browser:

• the address of the pages visited, with only the campaign parameters and no personal data (on a page whose address carries any other information, these tools are not loaded), the referring page reduced to the site's main address, your IP address, device and browser data, and those companies' own cookies and identifiers;
• the ad click identifiers;
• four events: demo started, account created, setup interview completed and payment confirmed (amount and currency).

We do not send them your name, email, phone number, the content of conversations and calls, calendar data or the business's data. We use this information to measure visits and ad results; Google and Meta use it to measure and optimize ads under their own policies.

If your browser sends the Global Privacy Control (GPC) signal, these tools are not loaded, the ad click identifiers are neither stored nor sent, and the Google and Meta advertising identifiers left by earlier visits (in cookies and in browser storage, such as _gcl_*, _gac_*, _fbp and _fbc) are deleted; the origin of the visit keeps only the campaign parameters.

You can also block third-party cookies in your browser, install the Google Analytics opt-out add-on, adjust ads in Google's My Ad Center and in Meta's ad preferences, or ask privacidade@ligou.ai to delete the origin saved with your account.

2. How we use it

• To provide the service: answer calls, respond with the approved information, book appointments, record requests, notify the owner and send the authorized messages.
• To set up and check the answering service: the interview, the website analysis, the review and the automatic check, which runs in an isolated test environment without creating real appointments.
• To keep the service secure and prevent abuse, bill for the service, provide support and meet legal obligations.
• To improve how Ligou works, based on operational metrics such as response time and failures.
• To measure visits and ad results (section 1, "Website measurement and advertising").

We do not sell personal data, and we do not authorize its use to train third-party artificial intelligence models. The only advertising-related use is the website measurement described in section 1. Conversation, call and calendar data are never used for advertising.

3. Google user data

With your authorization, Ligou accesses your Google account with these permissions:

• Sign-in (openid and email): to identify your account.
• Calendar availability (calendar.freebusy): to know which times are free before offering a time to a customer.
• Calendar list (calendar.calendarlist.readonly): to let you choose the calendar Ligou will use.
• Events (calendar.events): to create, change and cancel the appointments from calls and to show them in the dashboard.

This data is used only for the calendar features you see in the dashboard and in calls. It is not used for advertising, it is not sold, and it is not read by people, except:

• with your permission;
• to investigate abuse or security issues;
• to comply with the law.

Long-term access to your Google account is stored encrypted. You can revoke that access at any time in your Google account's security settings ("Third-party apps with account access") or by request to suporte@ligou.ai. After that, Ligou stops reading and changing the calendar.

Ligou's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who we share it with

We share data only with the providers needed to deliver the service. Each receives only what it needs for its part:

• OpenAI: voice and language model processing.
• Supabase: database and sign-in.
• Amazon Web Services: servers and backups.
• Vercel: website hosting.
• Google: sign-in and calendar.
• Stripe: payments.
• Twilio: phone and text messages.
• Google (Analytics and Ads) and Meta (Pixel): website measurement and advertising, when enabled (section 1).

A business's call records are available to that business. We may also share data when the law requires it or to protect people's rights and safety. If Ligou is sold or reorganized, the data remains protected by this policy.

5. Text messages

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. Mobile numbers are processed only by the providers that deliver the service, such as Twilio, which delivers the messages, and never for marketing.

• Reply STOP to stop receiving messages and HELP for help.
• The owner can also revoke the mobile number registered for alerts in the dashboard.
• Message and data rates may apply.

6. How long we keep it

• Transcripts of customer calls for active accounts: deleted 12 months after the call.
• Other transcripts (setup interview, tests and calls of accounts in simulation): the text is deleted 30 days after the conversation is summarized.
• Records of each call (date, length, summary and usage receipts): kept while the account exists.
• Temporary technical data (session requests, phone events, sign-ins in progress and appointment offers): deleted 24 hours after they expire.
• Account, configuration and business records: while the account is active. After closing, for up to 90 days, unless the law requires keeping them longer.
• Website demo: conversations are kept until a deletion request.
• Origin of the visit: in your browser, until you clear the site's data (the _fbc cookie expires after 90 days); the copy saved with an account, while the account exists. Google and Meta keep what they receive under their own policies.
• Backups: the database is copied every week. A replaced copy is deleted 28 days later, and the database provider keeps its own copies for a short period.

7. Security

We use encrypted connections, isolation of each business's data in the database, restricted staff access and encrypted backups. Integration credentials, such as the Google access, are also stored encrypted. No system is completely immune to failures; if an incident affects your data, we will notify you as the law requires.

8. Where data is kept

Data is processed in the United States, where our servers and those of our main providers are located.

9. Your rights

• You can request access to, correction of, a copy of or deletion of your data. You can also withdraw permissions, revoke calendar access and close the account.
• Requests go to privacidade@ligou.ai and are answered within 30 days.
• Residents of California and other places with their own privacy laws have the rights those laws provide. We do not sell personal data. The Google Ads and Meta Pixel tags described in section 1 may be considered "sharing" for cross-context behavioral advertising under California law; to opt out, turn on Global Privacy Control in your browser (we honor it automatically, and those tags do not load) or write to privacidade@ligou.ai. We do not treat you differently for exercising your rights.
• If you are a customer of a business that uses Ligou, please send your request to that business. We help it respond.

10. Children

Ligou is a service for businesses and is not directed to anyone under 18. We do not knowingly collect children's data.

11. Changes to this policy

Material changes are announced in the dashboard or by email before they take effect. The date at the top shows the version in effect.

12. Contact

RSM Venture Group LLC · 30 N Gould St Ste N, Sheridan, WY 82801, USA · privacidade@ligou.ai