Privacy Policy

Noiseless HQ is a public-facing service brand operated by VILLALOBOS ALLIANCE LLC, doing business as Noiseless where applicable. References to Noiseless HQ, we, us, or our mean the business operating this website, client tools, connected workflows, and service integrations.

Privacy and data requests can be sent to support@noiselesshq.com.

This policy covers noiselesshq.com, the guided project planner and estimator, project inquiry forms, public booking pages, public site chat, client portal features, authorized workspace tools, module activation, contract and payment workflows, and connected communication channels such as Facebook Messenger, Instagram messaging, WhatsApp, SMS and text messaging, email, Google Calendar, and AI-assisted service tools.

This policy is intended to explain the personal information and platform data processed by Noiseless HQ in connection with those services.

We may collect information you choose to provide through contact forms, project inquiries, account access, client portal features, uploads, contracts, payments, direct messages, calls, email, and support conversations.

This may include your name, email address, phone number, company, business address, project-planner answers and generated estimate range, project details, website or social profile, messages, files, billing details, tax IDs (such as an EIN or a GST number), signature details, payment status, account information, preferences, and support history.

If you contact Noiseless HQ through Facebook Messenger, Instagram, WhatsApp, or another connected Meta product, we may process message content and related platform data needed to receive, organize, and respond to that communication.

Depending on the channel and what Meta provides, this may include your platform user ID or business account ID, username or display name, profile picture URL, message text, attachments, reactions, referrals, postbacks, timestamps, read or delivery status, account/page IDs, webhook metadata, and conversation history.

We use this data to provide customer support, keep a reliable conversation history, route messages to authorized Noiseless HQ staff, link conversations to leads or clients, schedule follow-ups, prevent abuse, and maintain records needed to operate the service.

We do not sell Meta Platform Data. We do not use private message content for unrelated advertising, data brokerage, or building unrelated customer profiles. We process Meta-connected message data only for the business communication, support, workflow, security, audit, and platform-compliance purposes described in this policy.

This section applies to the Noiseless HQ SMS program. We may collect your mobile phone number, message content, delivery status, and records of when, where, and how you consented or opted out.

We use this information to provide customer care, respond to inquiries, send ARC onboarding and appointment confirmations and reminders, deliver account, service, and billing notices, and send product updates or offers only when you separately consent to marketing text messages.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Service providers acting on our behalf may process this information only as needed to operate and deliver the Noiseless HQ SMS program; they may not use it for their own marketing or promotional purposes.

Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. You may also contact support@noiselesshq.com.

Consent to receive text messages from Noiseless HQ is not a condition of purchase. Consent is specific to Noiseless HQ and is not transferred to another business. When a subscribing business sends messages under its own name, that business must collect its own consent and its own privacy policy applies.

Some Noiseless HQ features run on behalf of the businesses that subscribe to them: website chats answered under the business's own name, public booking pages, and connected message channels. When you interact with one of those, your information belongs to your relationship with that business, and Noiseless HQ processes it so the business can respond, schedule, and follow up.

This may include your name, contact details, message content, chosen appointment times, and notes. Bookings may create an event on the business's own calendar, and conversations may be saved as a customer record (a lead) in that business's workspace.

If the business asks you to pay through the conversation, we store the amount, what it is for, and whether it was paid, linked to your conversation with that business. Card details are entered with the payment provider and are never stored by Noiseless HQ.

If a health-care business, like a med spa, uses ARC, any health information about its customers in its conversations, bookings, notes, and payments is stored and transmitted electronically to the providers that run the service (hosting, messaging, email, calendar, payments, and AI).

If a business uses ARC's customer form, your health answers, your signature, and the signed form you complete on that business's tablet, or online through a link it sends you, are stored encrypted on the business's behalf. They aren't sent to any AI provider or to the AI coding assistants our team uses. Your name and contact details from the form are also added to your customer record with that business, like the rest of the contact information it keeps in ARC.

If you ask for your copy by email or text, you'll get a link, not the form. The message doesn't include any of your answers, and the link asks for the date of birth on the form, can be opened up to five times, and expires after a week.

If a business's subscription lapses, its incoming messages and leads continue to be received and stored so nothing is lost, and they become available to the business again when it reactivates. For questions about how a specific business uses your information, contact that business; for how Noiseless HQ stores it, contact us.

When a business account, calendar, payment, signature, email, review, analytics, campaign, or messaging integration is connected, we may store configuration details needed to operate it, such as account IDs, calendar IDs, page IDs, business IDs, ad account IDs, location IDs, authentication tokens, technical response metadata, and error logs. For Google Calendar the stored details are the authorization and the identifiers of the events our own product created, so that an appointment can later be moved or cancelled. We do not store the contents of the events already on the calendar.

Access tokens and secrets are treated as confidential operational credentials and are not displayed publicly. They are used only to operate the requested integration, troubleshoot delivery, maintain security, and comply with platform requirements.

The website and service providers may collect basic technical information such as device type, browser, pages visited, referring pages, approximate location derived from IP address, cookies, session data, UTM parameters, ad click identifiers such as fbclid where present, webhook delivery records, and security logs.

We use this information for authentication, security, performance, analytics, attribution, fraud prevention, debugging, and operation of the website and connected workflows.

When configured on the public Noiseless HQ website, Google Analytics and the Meta Pixel may receive page, device, cookie, and ad-attribution information under their own privacy terms. If you submit a form, they also receive the project type, the budget range, and whether the request is flagged for a free audit. To limit how Meta uses this information to show you ads, change your ad preferences in Meta's Accounts Center or use the opt-out tool at aboutads.info/choices. We do not send private customer message content to those public-site analytics tools.

Our website doesn't respond to browser Do Not Track or Global Privacy Control signals: outside the European Union, the European Economic Area, and the United Kingdom, Google Analytics and the Meta Pixel load the same way whether or not your browser sends one. When you use our website or services, other parties, including Google and Meta, may collect information about your activity over time and across different websites.

When you submit a form on the public website, our server also sends Meta a conversion event so we can measure our ad campaigns. We don't send it if you're visiting from the European Union, the European Economic Area, or the United Kingdom. The event includes your email and name, hashed; an identifier derived from your email; the Meta advertising cookies stored by your browser and, if you came from Facebook, Instagram, or another Meta app, the ID of that click; your IP address; your browser's user agent; and the page you sent the form from. It also includes two details about your request: the type of project (or the form's name) and the source or campaign it came from. It doesn't include your phone number. Hashing means your email and name aren't sent as plain text, but Meta can match them against its accounts and recognize you if you have one. Meta may also use the event under its own terms, including to personalize the ads it shows you. If you don't want the event sent, don't submit the form: email support@noiselesshq.com instead, and we'll reply by email without sending anything to Meta.

Noiseless HQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at https://developers.google.com/terms/api-services-user-data-policy.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. This covers the availability our product derives from a business calendar, which is derived data.

We use Google user data only to provide and improve the user-facing features that the business asked us to operate, and for no other purpose. This section governs Google user data and prevails over the rest of this policy: where any other part of it describes a broader purpose for handling, retaining, disclosing or transferring information — including but not limited to business records, auditing, documenting integrations, troubleshooting, platform compliance, analytics, attribution, advertising, or enforcing agreements — that purpose does not apply to data obtained through Google APIs.

When a business connects Google Calendar, we request a single permission: to see, create, change and delete calendar events. We use it only to read when the calendar is busy so the business can offer its open times, and to create, move and remove the events for appointments booked through Noiseless HQ. We never change or delete an event the business created itself: every event we move or remove is addressed by the identifier we saved when we created it.

To work out availability we ask Google only for the fields that decide whether an hour is taken: the start and end of each event, whether it was cancelled, whether it is marked as free, its identifier, and, for each guest, only whether that guest is the calendar owner and their response status — so that an event the owner declined does not count as busy. Titles, descriptions, locations, and the names and email addresses of guests of the events already on the calendar are never requested, never stored, and never sent to any AI service provider. Mia, the Noiseless HQ assistant, receives only the resulting open times. The one event title that does exist is the one we compose ourselves for an appointment booked here, from the business name and the name the customer gave us in that same conversation.

We do not use Google user data for targeted advertising, personalized, retargeted or interest-based advertising; we do not sell it; we do not transfer it to data brokers or information resellers; we do not use it to determine credit-worthiness or for lending purposes; and we do not use it to create databases. Google Workspace APIs are not used to develop, improve, or train non-personalized artificial intelligence or machine learning models, nor any generalized or standalone model. Our AI service provider processes requests through its paid business API, does not train its models on that traffic, and we have not enrolled in any program that would allow it to.

Human access to Google user data is limited to what you explicitly ask us to do, what is needed for security purposes such as investigating abuse, what applicable law requires, and data that has been aggregated and de-identified. You can withdraw the permission at any time from your Google account, and you can ask us to disconnect the integration and delete the stored credentials by writing to support@noiselesshq.com with the subject line “Privacy request”.

We use information to respond to inquiries, understand project needs, prepare proposals, provide services, operate connected workflows and the client portal, process payments, prepare contracts, deliver notices, schedule calendar follow-ups, improve workflows, protect accounts, communicate updates, and maintain reasonable business records.

We may also use information to test, secure, audit, and document integrations with services such as Meta, WhatsApp, AI service providers, payment and signature providers, secure data storage providers, hosting providers, and email providers. Data obtained through Google APIs is not used to test, secure, audit or document integrations: its use is limited to what the section on Google user data and Limited Use describes above.

In ARC and on our website, Noiseless HQ uses one AI service provider, OpenAI, through its business API, to help authorized staff draft replies, summarize conversation context, classify requests, prepare support notes, generate guidance, or improve service workflows. No aggregator, gateway, or model hub sits between ARC and OpenAI.

Our team also uses AI coding assistants to build, test, fix, and support ARC: Codex, from OpenAI, and Claude, from Anthropic. In that work, these assistants may process personal information, including messages between a business and its customers, for example when we look into a problem with a conversation, a booking, or a payment. OpenAI and Anthropic process this information as our service providers, under their business terms and data processing addenda, and may review it to keep their services secure, prevent abuse, and comply with the law.

Some connected message channels may use Mia, the Noiseless HQ assistant, to prepare or send AI-assisted replies according to the subscribing business's channel settings and platform rules. When automated replies are enabled, a reply may be sent without prior human review; authorized team members can monitor, pause, resume, correct, or take over conversations.

Mia is an AI assistant. She says so whenever someone asks.

AI-assisted output is intended to support service and support workflows. It is not a guarantee of accuracy and is not legal, financial, tax, medical, or professional advice. Noiseless HQ does not sell message content or use customer conversations to build unrelated AI products.

Client portal data may include project updates, files, invoices, messages, requests, account details, module activation status, care plan settings, billing records, usage summaries, contract records, signature events, and payment status.

Access is intended to be limited to authenticated users, authorized client contacts, authorized Noiseless HQ team members, and service providers needed to operate the requested service.

We do not sell personal information. We may share information with service providers that help operate the website, host data, store conversation and workspace records, process payments, prepare signatures, deliver email, manage calendar events, provide AI-assisted service tools, provide analytics, or support security.

Service providers may include messaging platforms, calendar providers, AI service providers, payment and signature providers, hosting and data storage providers, email providers, analytics providers, domain providers, and project management tools. These providers process information according to their own terms, privacy practices, and our configuration of the services. We do not authorize service providers to use Meta Platform Data for unrelated advertising, data brokerage, or unrelated profiling.

We may disclose information when required by law, to protect rights and safety, to investigate abuse, to enforce agreements, or in connection with a business transfer. Google user data is narrower: we transfer it only with the user's consent, when necessary for security purposes such as investigating abuse, when required by applicable law, or as part of a merger, acquisition or sale of assets with notice to the user.

This website may use cookies or similar technologies for authentication, security, performance, preferences, analytics, attribution, and basic website functionality.

You can control cookies through your browser settings, but some features may not work correctly without them.

The chat on this website saves the most recent messages in your conversation, along with an identifier for it, in your browser's local storage, so you can pick up where you left off in the same browser. That copy expires 30 days after the last message and is deleted when you select “Start over” or create an account. You can also clear it in your browser settings. Clearing that copy doesn't delete the conversation from our servers; you can ask us to delete it as described in “Data deletion and privacy choices.”

We keep information for as long as reasonably needed to respond to inquiries, provide services, maintain workspace and portal records, process contracts and payments, comply with legal obligations, resolve disputes, protect security, and enforce agreements.

How long we keep certain records:

Photos sent or received by text message (MMS) are kept for 90 days and then deleted automatically. We don't keep copies of WhatsApp, Instagram, or Messenger attachments; they're fetched from Meta each time they're opened.

The raw data Meta and Twilio send us for each message is deleted after 90 days.

We keep a record of each email we send (who it went to, when, whether it was delivered, and its subject line) for 2 years; the rest of its content is deleted from that record after 90 days.

We keep a record of each task Mia handles for a business's team (what was asked, what was decided, and how it turned out) for 1 year after it's closed.

A business's conversations, contacts, appointments, and payments are kept while it uses Noiseless HQ. If it cancels its subscription, they're deleted after 90 days; nothing is deleted because of non-payment.

Consent and opt-out records are kept with no time limit, so each person's choice is respected.

Customer forms signed on a business's tablet or online are kept for as long as that business decides. They're deleted when the business deletes them, or 90 days after it cancels its subscription.

We keep a record of each time a business accepts our Terms of Service (which version and text were accepted, who accepted them, when, in what language, the IP address and browser it was recorded from, and, for a purchase, what was bought) while the account exists and for 5 years after it's deleted, or longer while a dispute or claim is open, so we can prove they were accepted. If someone answers “I don't agree,” we also keep who and when, for the same period.

If your business was based in New Zealand when a record was made, we keep that record, including what it declared about GST when buying, for 7 years after the account is deleted instead of 5, so we can show that we only sold ARC there to GST-registered businesses.

Logs and integration metadata may be retained to troubleshoot delivery, prove platform compliance, prevent abuse, and maintain business records. We may delete, de-identify, or anonymize information when it is no longer needed. None of the retention purposes in this section applies to Google user data, which is kept only for as long as the feature the business authorized needs it. A business can withdraw the permission at any time from its own Google account, and we delete the stored authorization and the stored event identifiers when the business asks us to disconnect the integration by writing to support@noiselesshq.com with the subject line “Privacy request”.

We aim to use reasonable technical and organizational safeguards for project, account, workspace, integration, and payment information, including access controls, reputable hosting providers, encrypted transport where available, secure operational practices, and limited access to credentials.

No internet-based system can be guaranteed to be perfectly secure.

Depending on where you live and the law that applies, you may ask us to confirm whether we process your personal data; request access, correction, deletion, or a portable copy; and opt out of targeted advertising, the sale of personal data, or qualifying profiling. You may also opt out of non-essential marketing communication. We will not discriminate against you for exercising an applicable privacy right.

We do not sell personal information for money. Some laws may define certain analytics or advertising disclosures more broadly than a monetary sale, so you may still submit an opt-out request.

Send a request to support@noiselesshq.com with the subject line “Privacy request”. Describe the right you want to exercise and provide enough information for us to locate and authenticate the relevant records. Data deletion instructions are linked at the bottom of this page.

Where applicable law sets a deadline, we will respond without undue delay and no later than 45 days after receiving an authenticated request. We may extend that period once by up to 45 additional days when reasonably necessary, after notifying you within the first period and explaining the reason. We may retain limited information when required for legal, payment, security, accounting, dispute, or platform-compliance reasons.

If we decline a request, we will explain the decision and how to appeal. To appeal, reply to the decision or email support@noiselesshq.com with the subject line “Privacy appeal”. If an appeal is denied, eligible Texas consumers may submit a privacy complaint to the Texas Attorney General.

If a data security incident affects information that requires notice, we will work to provide notices required by applicable law.

Texas law may require notice to affected people and, in some cases, reporting to the Texas Attorney General.

This website and the connected business tools are intended for business users and are not directed to children under 13.

We do not knowingly collect personal information from children under 13.

The website may include links, embedded tools, social messaging channels, payment pages, signature pages, or interactive project previews.

External websites and third-party services are governed by their own privacy practices.

When we handle personal information in the course of doing business in New Zealand, New Zealand's Privacy Act 2020 applies to us, even though we're based in the United States. This section adds what that law requires, and where it differs from the rest of this policy, this section applies.

We're responsible for the information we collect for ourselves: what you give us when you contact us or ask about ARC, and what we need to run your business's account, such as the details of its account owner and team, its contact and billing details, its GST number, the record of its acceptance of our terms, and its messages to our support team. VILLALOBOS ALLIANCE LLC, doing business as Noiseless, based in Houston, Texas, USA, collects and holds it. You can reach us at support@noiselesshq.com.

Some of that information may not come from you directly, but from the account owner who adds you to the team or names you as an alert contact, the person who set up the account for your business, or a service your business connects, such as Stripe, Meta, or Google. We use it only for the purposes described in this policy, and you can ask to see it and correct it, as explained below.

If your business is based in New Zealand, we ask for its GST number before we charge anything, so we can prove that we only sell ARC there to GST-registered businesses. Stripe, our payment provider, stores it and shows it on your invoices. We don't use it for anything else. Without it, we can't sell ARC to your business. We keep a record of what your business declared when buying, as described in “Data retention.”

When you message a business that uses ARC, or book with it, we hold your information on that business's behalf. New Zealand law treats it as held by that business (Privacy Act 2020, section 11), so the business is responsible for it and handles your requests. Contact the business directly. If you write to us instead, we'll pass your request on to that business within 10 working days and let you know. If we use any of that information for our own purposes, New Zealand law treats it as held by us as well, and we're responsible for it too.

You can ask us whether we hold personal information about you, and ask to see it or correct it, by emailing support@noiselesshq.com with the subject line “Privacy request.” We'll respond as soon as reasonably practicable, and no later than 20 working days after we receive your request. If we need more time for one of the reasons the Privacy Act allows, we'll tell you within those 20 working days how much more time we need, why, and that you can complain to the Privacy Commissioner about it. If we don't make a correction you asked for, you can ask us to attach a statement of that correction to the information. If we refuse a request, we'll tell you why and that you can complain to the Privacy Commissioner.

If you're not satisfied with how we handle your request or your information, you can complain to New Zealand's Privacy Commissioner (privacy.org.nz). Our privacy officer, Alejandro Villalobos, handles requests under that law and can be reached at support@noiselesshq.com.

If a privacy breach affecting information we hold for ourselves has caused or is likely to cause serious harm, we'll notify the Privacy Commissioner and the people affected as soon as practicable. If it affects information we hold for a business, we'll tell that business immediately, and no later than 24 hours after discovering it, so it can notify the Commissioner and the people affected.

We store information in the United States, and our service providers process it there and in other countries. When they hold it on our behalf, New Zealand law treats it as held by us, or by the business we hold it for, and we remain responsible for our part.

We may update this policy as the website, services, tools, integrations, or legal requirements change.

The updated version will be posted on this page with a revised date.

For privacy questions, data access requests, or data deletion requests, email Noiseless HQ at support@noiselesshq.com.