Privacy Policy

Effective Date: April 27, 2026
Last Updated: April 27, 2026

Plain-English summary: We are Laguna Foundry LLC, a digital agency and software company based in Laguna Beach, California. We collect the data we need to run our websites, apps, and services (account info, usage data, voice recordings if you use our phone products, payment info processed by Stripe). We share data only with the vendors we list below and with law enforcement when legally required. We do not sell your personal information. You can request access, correction, or deletion of your data at any time, and you can delete your account through the in-app settings or through our account deletion page. Questions: [email protected].

1. Who We Are

Laguna Foundry LLC (“Laguna Foundry,” “we,” “us,” “our”) is the data controller for the personal information described in this Privacy Policy. This policy applies to all of our websites, mobile applications, and services, including our brands and product lines (the “Services”):

Laguna Foundry (lagunafoundry.com) — digital agency services
LF Toolkit — branded SaaS subscription platform
Mermaid Phone (mermaidphone.com) — AI phone agent and scheduling for the beauty industry, including the Mermaid Phone iOS app
ScubaDev (scubadev.com) — software portfolio holding company
Gnarly Agency (gnarlyagency.com) — services subsidiary
Quiet Kitty media brands
Yo-Ho (yo-ho.co) — API marketplace

Mailing address: Laguna Foundry LLC, 350 Forest Ave #16, Laguna Beach, CA 92652, USA
Privacy contact: [email protected]
General contact: [email protected]

2. Information We Collect

2.1 Information you give us directly

Account information: name, email address, password (stored as a one-way hash), business name, role.
Contact information: phone number, mailing address, time zone.
Billing information: billing name and address. Card numbers and bank account details are collected and stored by our payment processors (Stripe, Apple) and are not stored on our servers.
Profile information: business industry, photo or avatar, social media handles you choose to add.
Communications: messages you send to support, content you post in forms or surveys, files you upload.
Customer data you import: if you use LF Toolkit or Mermaid Phone, contact records, lead information, calendars, emails, and other CRM content you choose to import.

2.2 Information collected automatically when you use the Services

Device data: device model, operating system, browser, screen size, language, mobile network, app version, crash logs.
Usage data: pages and screens viewed, buttons clicked, features used, session duration, referral source.
Approximate location: derived from IP address. We do not request precise GPS location unless you grant explicit permission for a feature that requires it.
Cookies and similar technologies: see Section 6.
Log data: IP address, timestamps, request URLs, response codes, referrers.

2.3 Information specific to Mermaid Phone

Voice recordings: when an AI phone agent answers a call, the conversation audio is recorded so we can transcribe it, generate the assistant response, and store the call for your review. Both parties are notified that the call is being recorded.
Call transcripts: machine transcriptions of inbound and outbound calls, including caller phone number, duration, and recording URL.
SMS message content: text messages sent and received through the platform, including phone numbers and timestamps.
Calendar data: appointment times, customer names, and service types booked through the scheduler.
Calendar permissions on iOS: if you grant calendar permission, we read existing events to detect conflicts and write new events when appointments are booked. We do not read events outside the calendars you authorize.
Microphone permission on iOS: required only for the in-app voice demo feature. We do not record audio in the background.
Contacts permission on iOS: optional. If granted, we use contacts only to populate the recipient picker for SMS. We do not upload your full address book to our servers.
Push notification token: stored to deliver booking alerts, missed call alerts, and message notifications.

2.4 Information from third parties

Payment confirmation from Stripe and Apple In-App Purchase.
Identity verification signals from Apple Sign In or Google Sign In if you use those options.
Business enrichment data from public sources (Google, Lusha) used to pre-fill your profile.
Aggregated analytics and attribution data from advertising and measurement partners.

3. How We Use Your Information

We use the categories above for the following purposes:

Provide the Services: create accounts, authenticate logins, deliver features, sync calendars, route phone calls, send SMS, generate AI responses, store and back up your data.
Process payments: charge subscription fees, issue receipts, handle refunds, prevent fraud.
Improve the Services: analyze usage to fix bugs, improve performance, and design new features. We do not train third-party AI models on your customer data.
Personalize content: remember your preferences, recommend features, surface relevant integrations.
Communicate with you: send service notifications, security alerts, billing emails, and (with your consent) marketing emails.
Security and fraud prevention: detect and block abusive behavior, comply with anti-spam rules, audit access.
Legal and compliance: respond to lawful requests, enforce our Terms, satisfy tax and accounting obligations.

4. Legal Basis for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

Contract: processing necessary to provide the Services you signed up for (account, billing, core feature delivery).
Legitimate interests: running and securing our business, fraud prevention, product improvement, direct service communications. We balance these against your rights.
Consent: marketing emails, optional iOS permissions (microphone, contacts, calendar), App Tracking Transparency. You may withdraw consent at any time.
Legal obligation: tax records, lawful requests from regulators or courts.

5. Third Parties We Share Data With

We share personal information only with vendors and partners who help us run the Services. They are bound by data processing agreements that limit their use of your data to providing services to us. The full current list:

Vendor	Purpose	Data shared
Stripe	Payment processing for web and direct subscriptions	Name, email, billing address, card details (collected directly by Stripe), purchase amount
Apple (App Store / In-App Purchase)	Payment processing for iOS subscriptions	Apple ID, purchase amount, subscription status
Twilio	SMS delivery and phone number provisioning	Recipient phone number, message body, sender ID
Retell AI	AI voice agent runtime for phone calls	Call audio, transcripts, prompt context
OpenAI	Large language model inference for assistant responses, content drafting, and proposal generation	Prompt content, transcripts, business context (no PII used to train OpenAI base models per their Enterprise data policy)
HighLevel (LeadConnector)	CRM, calendar, and SaaS infrastructure for LF Toolkit	Contact records, calendars, pipelines, conversations
Supabase	Application database and authentication	Account records, app data
Amazon Web Services	Cloud hosting and storage	All Service data at rest, encrypted
DigitalOcean	Cloud hosting for some services	All Service data at rest, encrypted
Cloudflare	CDN, WAF, DNS, DDoS protection	IP address, request metadata
Google (Workspace, Analytics, Maps)	Email delivery, web analytics, mapping	Email addresses, anonymized usage data, location queries
Apple (Sign In with Apple, Push Notifications)	Authentication and notifications on iOS	Apple ID-derived email relay, device push token
Meta (Facebook, Instagram)	Advertising and conversion measurement (only when you visit our marketing pages with cookies enabled)	Cookie ID, page event, hashed email for matching
Sentry	Error and crash reporting	Stack traces, device model, OS version, anonymized user ID

We may also share information when required by law (subpoenas, court orders, valid government requests), to protect rights and safety, or in connection with a corporate transaction such as a merger, acquisition, or asset sale. We will give you reasonable notice before transferring your data in a corporate transaction unless legally prohibited.

We do not sell your personal information as the term is defined under California law, and we have not sold personal information in the prior twelve months. We do share limited cookie data with advertising partners as described above, which under California law is treated as “sharing” for cross-context behavioral advertising. You can opt out using the controls in Section 9.

6. Cookies and Similar Technologies

On our websites we use:

Strictly necessary cookies: session, login, CSRF protection. These cannot be disabled.
Analytics cookies: Google Analytics, Plausible, or similar. They tell us which pages are visited and how features perform.
Advertising cookies: Meta pixel, Google Ads pixel, used only on marketing pages. You can decline these in our cookie banner.

You can clear or block cookies through your browser settings. Some features of the website may not work if strictly necessary cookies are blocked. Our iOS app does not use browser cookies; it uses a secure on-device session token instead.

7. App Tracking Transparency (Apple iOS)

Apple’s App Tracking Transparency framework requires your explicit permission before an app can track you across other apps and websites owned by other companies. When you launch our iOS apps for the first time you may see a system prompt asking for tracking permission.

If you tap “Allow”: we may share a hashed identifier with our advertising partners (Meta, Google) so we can measure the performance of ads that brought you to the app. We do not share contact data, calendar data, voice recordings, or any business data for advertising.
If you tap “Ask App Not to Track”: our app will not access the IDFA and will not share any tracking identifier with third-party advertisers. The app continues to work normally. Some features may be slightly less personalized.
You can change this at any time: Settings > Privacy & Security > Tracking on your iOS device.

Inside the app we use only first-party analytics (events tied to your account) for feature improvement, regardless of your ATT choice.

8. Account Deletion

You can delete your account and request deletion of your personal information at any time. Three options:

In the iOS app: Settings > Account > Delete Account. Confirmation is required.
On the web: visit our Account Deletion page and submit the form, or sign in to your dashboard and choose Delete Account from the profile menu.
By email: send a request to [email protected] with the subject line “Account Deletion Request” from the email address associated with your account.

We complete account deletions within 30 days. Deletion removes your profile, login credentials, customer records, voice recordings, transcripts, SMS history, and uploaded content. We retain a limited set of information for legal and accounting reasons (transaction records, tax invoices, fraud and abuse logs) for as long as the law requires, typically up to seven years for financial records.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you and receive a copy.
Correct inaccurate or incomplete information.
Delete your personal information (see Section 8).
Port a copy of your data to another provider in a structured, machine-readable format.
Object to certain processing or restrict it.
Withdraw consent for processing based on consent (e.g., marketing emails, iOS permissions, ATT).
Lodge a complaint with your local data protection authority. EU residents may complain to their national supervisory authority. UK residents may contact the Information Commissioner’s Office.

Submit any of these requests to [email protected]. We will verify your identity (typically by confirming you control the account email) and respond within 30 days, or 45 days for complex requests as permitted by law. We do not charge a fee for reasonable requests.

9.1 California residents (CCPA / CPRA)

If you are a California resident you have additional rights:

Right to Know what categories of personal information we collected, the sources, the purposes, and the categories of third parties we shared with in the last 12 months.
Right to Delete personal information we collected from you, subject to legal exceptions.
Right to Correct inaccurate personal information.
Right to Opt Out of “sale” or “sharing” of personal information for cross-context behavioral advertising. Use the “Do Not Sell or Share My Personal Information” link in our website footer or send a Global Privacy Control signal from a supported browser.
Right to Limit Use of sensitive personal information. We do not use sensitive personal information for purposes beyond what is necessary to provide the Services.
Right to Non-Discrimination: we will not deny you Services, charge a different price, or provide a different level of quality because you exercised your privacy rights.
Authorized Agent: you may designate an authorized agent to make a request on your behalf with written authorization.

9.2 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of targeted advertising and profiling. Use the same contact email above to exercise these rights.

10. Do Not Track

Our websites do not respond to legacy Do Not Track browser signals because there is no industry consensus on how to interpret them. We do honor the Global Privacy Control signal as an opt-out of sale/sharing for California residents.

11. Children’s Privacy

The Services are intended for business use by adults. We do not direct the Services to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent (COPPA). If you believe we have collected information from a child, contact [email protected] and we will delete it promptly. The Services are also not intended for children aged 13 to 17 in jurisdictions where the age of majority is 18.

12. International Data Transfers

We are based in the United States and our infrastructure is hosted primarily in the United States (AWS US-East, DigitalOcean US data centers). When you access the Services from outside the United States, your information will be transferred to and processed in the United States. The data protection laws in the United States may differ from those in your country.

For transfers from the European Economic Area, the United Kingdom, or Switzerland we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) with our sub-processors. You may request a copy of these clauses by emailing [email protected].

13. Data Retention

We keep personal information only as long as necessary for the purposes described in this policy:

Account records: for as long as your account is active, plus 90 days after deletion to allow account recovery.
Voice recordings and call transcripts: 90 days by default, then automatically purged. You can shorten this in settings or request immediate deletion.
SMS message logs: 18 months, then archived in anonymized form.
Backups: rotating encrypted backups retained up to 35 days.
Billing and tax records: 7 years after the relevant transaction, as required by US tax law.
Security and fraud logs: up to 24 months.
Marketing preferences and unsubscribe records: indefinitely, so we can honor your opt-out.

14. Security

We protect your data with administrative, technical, and physical safeguards that include:

TLS 1.2 or higher in transit, with HSTS on all marketing and product domains.
Encryption at rest for database storage and object storage (AES-256).
Hashed passwords using bcrypt or scrypt; we never store passwords in plain text.
Role-based access controls and least-privilege provisioning for staff.
Mandatory two-factor authentication for production system access.
Audit logs for sensitive operations (data exports, account deletions, access to recordings).
Periodic backups, vulnerability scanning, and dependency monitoring.

No system is perfectly secure. If we discover a breach affecting your personal information we will notify you and the appropriate authorities as required by law.

15. Automated Decisions and AI

Some features use machine learning or generative AI to draft messages, transcribe calls, score leads, or recommend services. These outputs are intended as drafts to be reviewed by you. We do not use AI to make decisions that produce legal or similarly significant effects without human review. You can disable AI features in product settings.

16. Changes to This Policy

We may update this Privacy Policy as the Services evolve. The “Last Updated” date at the top reflects the most recent change. If we make material changes we will notify you by email and post a notice in the app or on the website at least 14 days before the changes take effect, unless an immediate change is required by law.

17. Contact

Questions, comments, or requests:
Laguna Foundry LLC
350 Forest Ave #16, Laguna Beach, CA 92652, USA
Privacy: [email protected]
General: [email protected]
Account deletion: lagunafoundry.com/account-deletion