Effective Date: July 23, 2026

This Privacy Policy explains how Arcus AI Solutions LLC (“Arcus,” “we,” “us,” or “our”) collects, uses, and protects information in connection with our website (arcusaisolutions.com), our AI voice receptionist product (“Riley”), and related services. This Policy applies to visitors of our Site, individuals who call or text Riley or Arcus, and prospective and current clients, unless a separate signed agreement states otherwise for a specific client relationship.

1. Information We Collect

Information you provide directly, such as when you fill out a form, request a demo, schedule a strategy call, or contact us: name, phone number, email address, business name, and any other details you choose to share.

Call and voice interaction data, when you call or interact with Riley: the phone number used to call, call metadata (such as time, date, and duration), the content of your conversation, and — where notice or consent sufficient under applicable law has been given — a recording and/or transcript of the call.

Text messaging data, if you text with Riley or Arcus, or opt in to SMS: your phone number, message content, and opt-in/opt-out status and history. See our separate SMS Terms & Conditions for details on our own messaging program.

Website and analytics data, such as IP address, browser and device type, pages visited, referring website, and similar usage data, typically collected through cookies or similar tracking technologies.

Payment information, if you become a paying client: payment details are collected and processed by our payment processor; Arcus does not store full payment card numbers.

Sensitive information related to insurance. If Riley is deployed for an insurance agency client, callers may share information related to policies, vehicles, property, claims, or other insurance-related matters, and in some cases may share financial or health/Medicare-related details. We do not intend to collect Social Security numbers, full payment card numbers, or detailed medical records through Riley, and we ask callers not to volunteer such highly sensitive information unless specifically instructed to do so by the agency they are contacting. Where sensitive information is shared, we handle it consistent with this Policy and any applicable agreement with the relevant agency.

2. How We Use Information

We use information we collect to:

• Operate, provide, and improve our website and Riley services;

• Respond to inquiries, schedule demos and strategy calls, and provide requested information;

• Route calls and messages appropriately, including to human staff or licensed agency personnel where applicable;

• Send transactional and, where you have opted in, promotional messages (see our SMS Terms for our own program);

• Maintain records of consent, recording notices, and opt-in/opt-out status;

• Detect, investigate, and prevent fraud, abuse, or security incidents;

• Comply with legal obligations and enforce our agreements.

Arcus does not sell personal information. We do not intentionally authorize our service providers to use client call content to train general-purpose AI models for their independent benefit. Vendor processing, model settings, and any permitted service-improvement use are governed by our vendor arrangements and, where applicable, the relevant client agreement. Because technology and vendors change, clients should rely on their signed agreement and data-processing terms for deployment-specific commitments.

3. Service Providers and Vendors

We work with third-party service providers to operate our services. Depending on the specific feature, these may include categories of vendors such as:

• AI voice platform providers (for example, Retell AI or similar providers) that power Riley’s conversational and voice capabilities;

• CRM and messaging automation platforms (for example, GoHighLevel or similar providers) used for scheduling, customer relationship management, and SMS/email automation;

• Telephony and messaging carriers (for example, Telnyx or similar providers) used to route calls and text messages;

• Payment processors (for example, Stripe or similar providers) used to process payments for paying clients;

• Cloud hosting and data infrastructure providers (for example, Google Firebase or similar providers) used to store and process application data;

• Analytics providers used to understand website usage.

These vendors may change over time as our technology stack evolves. We select vendors that provide reasonable security commitments, but we cannot guarantee the security practices of any third party, and each vendor’s own privacy practices also govern their handling of data to the extent applicable.

We may also disclose information: (a) to the client agency or business on whose behalf Riley handled an interaction; (b) when reasonably necessary to comply with law, legal process, or a lawful government request; (c) to protect rights, safety, and security or investigate fraud and abuse; (d) to professional advisers under appropriate duties of confidentiality; or (e) as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law. We do not disclose SMS opt-in consent or mobile information to third parties for their independent marketing.

4. Recording and Transcription

Where Riley records or transcribes a call, we aim to provide notice or obtain consent sufficient to satisfy applicable state and federal law before recording begins. Recordings and transcripts may be used for quality assurance, training, dispute resolution, and improving Riley’s performance for the relevant client. Access to recordings and transcripts is limited to Arcus personnel, the relevant client (such as the agency Riley was deployed for), and service providers who need access to operate the service. We do not publish call recordings or transcripts publicly.

We do not commit to a single retention period for recordings and transcripts in this Policy, because retention may vary by client agreement, vendor configuration, and legal requirement. If you would like to know how long a specific recording is retained or request its deletion, contact us using the information in the Contact section or see our Data Deletion Policy.

4A. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide and secure the services, maintain consent and opt-out records, meet contractual and accounting needs, resolve disputes, and comply with law. Retention varies by category and context. For example, inquiry records may be kept while we respond and manage our business relationship; consent and opt-out records may be kept as evidence of compliance; client billing records may be retained for tax and accounting purposes; and call data may be retained under the relevant client’s configuration and agreement. Information in backups may remain until the backups are cycled out under ordinary procedures. A request for deletion is handled under our Data Deletion Policy and remains subject to lawful exceptions.

5. Cookies and Analytics

Our Site may use cookies and similar technologies to remember preferences, understand how visitors use the Site, and support basic functionality. You can control cookies through your browser settings; disabling cookies may affect some Site features. We do not currently respond to “Do Not Track” browser signals because there is no common industry standard for how to interpret them, but we will continue to monitor developments in this area.

6. Google User Data

If any part of our services accesses Google user data (for example, through Google Workspace, Calendar, or similar integrations used for scheduling or communications), such access, use, and sharing of that data will comply with the Google API Services User Data Policy, including the Limited Use requirements, where applicable to that integration.

7. Where We Process Data

We and our service providers primarily store and process information in the United States. If information is transferred outside the United States by a vendor, we expect that vendor to maintain appropriate safeguards, though we do not control every aspect of a third-party vendor’s infrastructure.

8. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your information as required by law, we will provide notice consistent with applicable legal requirements.

9. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information, which may include the right to know what information we have collected about you, request access to or a copy of it, request correction or deletion, and opt out of certain uses where applicable under your state’s law. These rights vary by jurisdiction and may not apply to everyone; we do not represent that all rights described here are available to every individual in every location.

To exercise applicable rights or ask a question about your information, contact us using the information in the Contact section, or see our Data Deletion Policy for our deletion process. We may verify your identity and authority before acting on a request. Where applicable law provides a right to appeal our response, you may appeal by replying to our decision or emailing us with the subject line “Privacy Appeal.” We will not discriminate against you for exercising a privacy right protected by applicable law.

If Riley was deployed on behalf of a specific insurance agency client and your request relates to data collected through a call or text with that agency, we may refer your request to that agency, since the agency may be the party responsible for determining how that information is used, consistent with our agreement with that agency.

10. Children’s Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can address it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Effective Date” above reflects the most recent revision. Material changes will be reflected by updating this page.

12. Contact Us

Arcus AI Solutions LLC Tecumseh, Oklahoma United States

Email: [email protected] Phone: (405) 500-1288 Website: arcusaisolutions.com