Privacy Policy

This Privacy Policy explains how [Little Engine, Inc.] (“Little Engine,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with our software, websites, mobile and desktop applications, AI agent, and related services (collectively, the “Service”). It applies to (a) independent service providers who sign up for an account (“Providers”), (b) clients of those Providers who interact with the Service by SMS, web link, or otherwise (“Clients”), and (c) visitors to our marketing websites.

This Policy should be read together with our Terms and Conditions. Capitalized terms not defined here have the meaning given in the Terms and Conditions.

1. A note about how Little Engine works

Little Engine helps Providers run their independent businesses. The Service includes an AI agent that can send and receive messages on behalf of a Provider, schedule and reschedule appointments, request payments, and take other actions the Provider has authorized. Most Clients of Providers will primarily interact with the Service through SMS messages sent from the Provider's business phone number, and may also interact through secure personalized web links.

Because of this design, two important relationships shape how data is handled:

• The Provider is the party that decides which Clients to add, what business information to share, and which AI behaviors to enable. With respect to Client data, the Provider acts as the controller of that data, and Little Engine acts as a processor or service provider on the Provider's behalf.
• Little Engine is the controller of Provider account data, of website-visitor data, and of Service-wide operational data we collect to run, secure, and improve the Service.

2. Information we collect

We collect the categories of information described below.

Information we do not collect

We do not collect raw payment card numbers or bank account credentials. Those are handled directly by our payment processor. We do not knowingly collect personal information from children under 13 (see Section 11). We do not request government identification numbers (such as Social Security or passport numbers) from Providers or Clients through the Service.

3. How we use information

We use information to:

• Provide, maintain, and operate the Service, including provisioning Provider phone numbers, sending and receiving messages, scheduling and managing appointments, processing payments, and synchronizing connected accounts.
• Power the AI agent, including generating responses, executing tools, presenting decisions for Provider approval, and maintaining agent memory so the agent improves over time within a Provider's account.
• Authenticate users, prevent fraud and abuse, enforce our Terms, and protect the security and integrity of the Service.
• Send transactional and account communications (e.g., verification codes, appointment confirmations, payment receipts, and security alerts).
• Measure and analyze how the Service is used so we can debug, improve performance, fix bugs, and develop new features.
• Comply with legal obligations, respond to lawful requests, and exercise or defend legal claims.
• Communicate with Providers about product updates, onboarding, support, and (with consent or as permitted by law) marketing.

AI training

We do not use the contents of Provider or Client communications to train foundational AI models for third parties or for general-purpose model development. We may use de-identified or aggregated data to evaluate, debug, and improve the Service's AI features (for example, by reviewing failure cases or scoring agent performance). Our AI sub-processors operate under contractual commitments that restrict their use of our data; see the sub-processor list in Section 6.

4. Legal bases for processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases:

• Performance of a contract — to provide the Service to Providers and to fulfill bookings and payments requested by Clients.
• Legitimate interests — to operate, secure, and improve the Service; to prevent fraud; and to communicate with Providers about their accounts.
• Consent — for certain marketing communications, optional integrations (such as connecting a Google Calendar), and analytics where required by law. You may withdraw consent at any time without affecting prior processing.
• Compliance with legal obligations — for tax, accounting, anti-money-laundering, and lawful-request purposes.

5. SMS, voice, and messaging disclosures

Little Engine provisions a dedicated business phone number for each Provider through Twilio and registers messaging campaigns under U.S. A2P 10DLC requirements. By signing up, Providers represent that they have a lawful basis and the necessary consent to message each Client they add. The first message a Client receives identifies the Provider and includes opt-out instructions.

Clients can opt out of SMS at any time by replying STOP. Replying HELP returns help text and a contact reference. Standard message and data rates may apply. Opting out of SMS does not delete the underlying contact record held by the Provider; to request deletion, see Section 9.

AI-generated messages sent through the Service are sent in the voice of, and on behalf of, the Provider. The Provider is responsible for the content of all messages sent from their business phone number.

6. How we share information

We share information in the following circumstances:

With sub-processors and service providers

We use the sub-processors below to deliver the Service. Each is bound by a written agreement that limits their use of personal information to providing services on our behalf and requires them to apply appropriate safeguards. This list reflects our current production stack and may change; the most current version will be maintained in this Privacy Policy and we will provide notice of material changes.

With Providers and Clients

Information you provide is shared with the parties intended by the Service. Information a Client sends to a Provider's number is delivered to that Provider; information a Provider records about a Client (such as appointments and notes) may be referenced in messages and confirmations sent to that Client.

With connected accounts

When a Provider connects a third-party account such as Google Calendar, we exchange information with that account as needed to provide the integration. The third party's own privacy policy governs its handling of the data.

Google API Services User Data

Google API Data Use Disclosure: The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

For business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor commitments in this Policy or notify you of material changes.

For legal reasons and safety

We may disclose information when we believe in good faith that disclosure is required by law, legal process, or governmental request, or to protect the rights, property, or safety of Little Engine, our users, or others. Where permitted, we will notify the affected user before disclosure.

With your direction or consent

We share information with other parties at your direction or with your consent (for example, when you choose to share a vCard or invoice).

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising.

7. Data retention

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention behaviors include:

• Provider account data is retained for the life of the account and then deleted or anonymized within a reasonable period after closure, subject to legal and tax retention requirements.
• Client records are retained while the associated Provider account is active. Providers may delete individual Client records at any time; deleted records are soft-deleted for a recovery period and then purged from active systems.
• Message content is retained to provide message history within the Service. Carriers and Twilio may retain message metadata under their own policies.
• Payment and tax records are retained for the period required by applicable law (typically up to seven years).
• Backups are rotated on a regular schedule; deleted data may persist in backups for a limited period before being overwritten.
• Aggregated or de-identified data may be retained indefinitely.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit using TLS, encryption at rest for sensitive fields and stored device tokens, role-based access controls, audit logging, and least-privilege practices for production systems. Authentication is phone-based with one-time verification codes; session tokens have limited lifetimes. No system is perfectly secure; we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach of any of our safeguards.

9. Your rights and choices

Depending on where you live, you may have the following rights with respect to personal information about you:

• Access and portability — request a copy of personal information we hold about you in a portable format.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete personal information about you, subject to legal retention exceptions.
• Objection or restriction — object to or restrict certain processing.
• Withdraw consent — withdraw any consent you previously gave, without affecting prior processing.
• Non-discrimination — exercise your rights without receiving discriminatory treatment.
• Lodge a complaint — file a complaint with your local data-protection authority.

Providers can exercise most of these rights directly in the app (for example, by editing or deleting Client records, exporting data, or closing their account). Clients should generally direct requests to the Provider whose Service they are interacting with, since the Provider is the controller of that data. We will support Providers in fulfilling Client requests.

To submit a request directly to Little Engine, contact us at [privacy@littleengine.com]. We may need to verify your identity before fulfilling certain requests. We will respond within the timeframes required by applicable law.

California-specific disclosures

California residents have additional rights under the California Consumer Privacy Act, as amended by the CPRA. The categories of personal information we collect, the purposes for which we collect them, and the categories of third parties with whom we share them are described in Sections 2, 3, and 6. We do not “sell” or “share” personal information as those terms are defined under California law. To exercise your California rights, contact us at the address in Section 14. Authorized agents may submit requests on your behalf with appropriate proof of authorization.

10. International data transfers

Little Engine is operated from the United States and most of our sub-processors store and process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States or other countries that may have data-protection rules different from those of your jurisdiction. Where required, we rely on appropriate transfer mechanisms (such as the European Commission's Standard Contractual Clauses) to provide protection for international transfers.

11. Children

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. Providers are responsible for ensuring that Clients added to the Service are old enough to consent to receive messages and to engage the Provider's services under applicable law. If you believe a child has provided us with personal information, please contact us at the address in Section 14 and we will take appropriate action.

12. Third-party services and links

The Service may link to or interoperate with third-party services (for example, Google Calendar, Stripe, or web links shared with Clients). The privacy practices of those services are governed by their own policies, which we encourage you to review.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Effective date” at the top and provide reasonable notice (for example, by email to Providers, an in-app notice, or a notice on our website) before the change takes effect. Your continued use of the Service after the effective date of an updated Policy constitutes your acceptance of the updated Policy.

14. Contact us

If you have questions about this Policy or about our handling of personal information, contact us at:

Effective: April 20, 2026