← Back to opsManager

Privacy policy

Privacy Policy

Last updated: July 21, 2026

opsManager is a managed AI operations platform built and operated by JK Automations ("JK Automations," "we," "us"). This policy is a plain-English, self-drafted conservative baseline. It has not been reviewed by outside counsel and will be revisited with counsel before we sign a client outside a personal relationship with the owner. It describes what we collect, why, how long we keep it, who we share it with, and how to reach us about it.

1. Who this applies to

This policy covers opsManager itself (JK Automations staff and tenant/operator accounts) and the voice, SMS, email, and CRM data JK Automations processes on behalf of client businesses that use opsManager as their front-desk / operations platform. For that client data, JK Automations acts as a service provider/processor on behalf of the client, who is the business the caller, texter, or lead is actually dealing with. Client end-customers with questions about how their data is used should also contact the specific business they called or texted, in addition to JK Automations.

2. Data we collect

  • Voice calls: call metadata (time, duration, caller number), an AI-generated transcript, and an audio recording of calls handled by our AI front-desk agents.
  • SMS/text messages: the content and metadata of messages sent to and received from leads and clients through opsManager.
  • Email: inbound lead/contact emails and outbound replies processed through our email tooling.
  • CRM and lead data: names, phone numbers, email addresses, business names, notes, task status, and follow-up history entered by operators or captured from calls, texts, or web forms.
  • Account data: login/authentication data for opsManager operator and tenant accounts.
  • Usage and diagnostic data: basic application usage and error logs needed to operate and debug the product. When a Google Analytics 4 measurement ID is configured, page views use sanitized route patterns only. Query strings, fragments, tenant/user/contact identifiers, call and CRM record identifiers, transcript content, and message content are not included by our analytics integration. Analytics and advertising storage are denied by default, and advertising personalization and Google Signals are disabled. Google may still receive limited technical information in consent-mode measurement pings, such as browser/device headers, timestamp, consent state, and origin-level referrer information.

3. Call recording and consent (California Penal Code §632)

Calls handled by an opsManager AI voice agent are recorded. California law (Penal Code §632) requires the consent of all parties to a recorded confidential communication, so every opsManager voice agent discloses at the start of the call that the call may be recorded. Continuing the call after that disclosure is treated as consent to recording. If a caller objects after hearing the disclosure, the operator should stop the recording or end the call rather than continue over an objection. Client businesses deploying an opsManager voice agent are responsible for confirming the greeting includes this disclosure before the agent goes live, and for following their own state's consent requirements if stricter than California's.

4. SMS consent, STOP, and HELP

We only send SMS messages to numbers that have given express consent to be texted (for example, by submitting a contact form, calling in, or otherwise opting in with the client business). Message and data rates may apply. Reply STOP at any time to opt out of further texts from that business; reply HELP for help. We do not sell or rent phone numbers collected for SMS to third parties, and we do not send marketing texts without consent on file.

5. How we use data

We use collected data to operate client workspaces, answer and route calls, transcribe and summarize calls, triage and follow up on leads, draft messages for operator review and approval, generate reports, maintain a knowledge base for accurate answers, prevent abuse, debug issues, and improve JK Automations' managed operations. We do not use client or caller data to train third-party foundation models beyond the ordinary processing needed to generate a single response.

6. AI-assisted operations

opsManager uses AI (large language model and voice AI) providers to answer calls, draft messages, summarize activity, and generate recommendations. These outputs are review aids for operators and clients, not legal, medical, financial, tax, or compliance advice, and are not independently verified before generation. Human approval gates remain required for sensitive or outbound actions such as SMS sends.

7. Who we share data with (subprocessors)

We do not sell personal information. We share data only with service providers who process it on our behalf to operate the product:

  • Vercel — application hosting.
  • Supabase — database and authentication.
  • Retell AI — voice AI call handling, transcription, and call recording storage.
  • SignalWire — SMS sending and phone number provisioning.
  • MiniMax — AI language model processing for some assistant features. MiniMax is not a U.S.-based provider; data sent to it for processing may be transmitted outside the United States. We do not send MiniMax more data than necessary for the specific feature it powers.
  • Composio — third-party integration connections (for example, calendar and email) that a tenant explicitly authorizes.
  • Resend — transactional email delivery.
  • Google Analytics 4 — optional, consent-mode page-view measurement using sanitized route patterns; it is not loaded unless a valid measurement ID is configured.

We do not use additional subprocessors beyond what is listed here as of the date above. If that changes, we will update this page.

8. Retention and deletion

  • Call audio recordings are retained for approximately 30 days, then deleted from our voice provider.
  • Call transcripts are retained for approximately 180 days for quality review, dispute resolution, and lead follow-up.
  • CRM records (leads, tasks, notes, message drafts) are retained while the client's workspace is active, or until a deletion request is completed.
  • When Google Analytics 4 is configured, the property must use a maximum 14-month event-data retention setting for this pilot. Aggregate reports may remain after user-level event retention expires.
  • Full detail is in our internal data retention policy; a summary is available on request.
  • To request deletion, correction, or export of your data, contact us using the information below. We will remove UI access first, then backend storage, then provider copies where the provider supports it.

9. Security

opsManager uses reasonable safeguards appropriate for an early-stage managed service, including authenticated access, tenant data boundaries, server-side secret handling, approval gates for outbound and sensitive actions, and minimized logging of sensitive fields. We do not claim any third-party security certification (such as SOC 2 or ISO 27001) at this time. Do not upload highly regulated data (for example, health records subject to HIPAA, or payment card numbers) unless you have separately confirmed with us that storage and handling for that data type is in place.

10. Children's privacy

opsManager is a business operations tool and is not directed to children. We do not knowingly collect personal information from individuals under 13.

11. Changes to this policy

We may update this policy as the product and our providers change. Material changes will update the "Last updated" date above.

12. Contact

Questions, deletion requests, or opt-out requests: support@jk-automations.com.