Privacy Policy

Impero Agency, LLC (“we”, “us”, “our”), a Delaware limited liability company, operates Olivia AI (“Platform”) at lunarolivia.com.

This policy applies to three categories of individuals:

• Agency Users — individuals who create accounts and use the Platform
• Leads and Contacts — individuals whose information is stored by agencies using the Platform
• Call Recipients — individuals who receive voice calls from AI agents configured on the Platform

Effective date: April 6, 2026.

By using the Platform, you agree to this Privacy Policy. See also our Terms of Use.

Account Data (Agency Users)

• Email address (required for Google OAuth, magic link, or app email-code authentication)
• First name, last name (optional profile fields)
• Avatar/profile image URL (optional)

iPhone and iPad app data

• The app sends your email address and sign-in code to Olivia to authenticate your existing account or invitation. Session cookies keep you signed in to the hosted mobile interface.
• When you enable push notifications, we store the Apple push token, a random app installation identifier, the signed-in account and session identifiers, the active workspace, and registration timestamps. We also store a protected value that lets the app remove its registration after sign-out.
• We store your push preference and selected notification types for each workspace. These preferences control delivery to your devices; your iOS notification permission controls display on that device.
• Apple receives the device push token and notification payload to deliver an alert. The payload contains a general message and account, workspace, and notification identifiers used to open the permitted screen. It does not contain lead names, message bodies, or client details.
• The app requests registration removal when you sign out. If the device is offline, the app retries removal when it can connect. Server checks also restrict delivery to an active session and permitted workspace. An alert already sent to Apple may still arrive.
• The app stores its optional device-authentication preference locally. Device authentication uses iOS; Olivia does not receive Face ID or Touch ID biometric data.

Lead and Contact Data (Managed by Agencies)

• First name, last name, email address, phone number
• Status, source, tags, and custom fields
• External identifiers from CRM integrations (e.g., GoHighLevel contact ID)

Voice and Call Data

• Call recordings and full transcripts
• Sentiment analysis scores
• Call duration, status, disposition, and metadata
• Timestamps and associated cost information

Integration Data

• Encrypted OAuth tokens for GoHighLevel and Google Calendar
• External account identifiers and synchronization timestamps
• Integration credentials are encrypted using AES-256-GCM and never exposed to end users

Payment Data

• Payment processing is handled entirely by Stripe
• We store billing references and records needed to manage your service, including Stripe customer, subscription, payment-method and invoice identifiers, payment status, billed amounts, and card brand and last four digits when Stripe provides them.
• Olivia does not store full card numbers or card security codes.

Automatically Collected Data

• Session cookies for authentication (Supabase Auth — essential, functional)
• On the website, DataFast uses visitor and session cookies to measure page visits, referrals, IP addresses, approximate location, browser and device information, and traffic sources. These identifiers can connect visits over time.
• Website performance measurements through Vercel Speed Insights, including page URLs, browser and device information, country, and loading and interaction timing

The iPhone and iPad app does not load the website's DataFast or Vercel Speed Insights analytics scripts. Account, workspace, and notification data described above still support the app's features.

• Account management and authentication
• Optional app notifications, device registration, and notification preferences for authorized workspace activity
• Service delivery including voice calls, lead management, and calendar booking
• Billing and subscription management via Stripe
• Customer support and issue resolution
• Platform improvement and usage analytics
• Aggregate statistics that do not identify people, used to promote Olivia
• Security monitoring and fraud prevention

We do not sell, rent, or trade your personal information. Data is shared only with the following processors as necessary to provide the Platform services.

The Platform uses artificial intelligence technologies from multiple providers to deliver its core services, including but not limited to:

• Retell AI — powers voice agent calls, processes audio, and generates transcripts
• Anthropic (Claude) — powers conversational intelligence and agent behavior
• OpenAI (ChatGPT) — may be used for text generation and prompt processing
• Google (Gemini) — may be used for text generation and prompt processing

Additional AI providers may be incorporated as the Platform evolves.

Agency prompt content and lead data may be processed by these providers during the course of service delivery.

Each provider's data handling is governed by their respective privacy policies and data processing agreements.

We do not use agency data to train AI models. All data processing by AI providers is strictly for real-time service delivery.

Under applicable data protection laws, agencies using the Platform are data controllers for the lead and contact data they collect, store, and manage.

Olivia AI acts as a data processor, processing data on behalf of agencies as instructed.

Agencies are responsible for:

• Obtaining lawful consent from their contacts before storing or processing their data
• Configuring appropriate call disclosure and recording consent language per applicable local laws
• Complying with telemarketing regulations and recording consent laws in their operating jurisdictions
• Setting appropriate data retention policies for their workspace

A Data Processing Agreement (DPA) is available upon request by contacting support@operations.lunarolivia.com.

• Agencies control retention periods for their leads, call recordings, and transcripts
• The Platform provides data deletion and CSV export tools for agencies to manage their data
• Billing and financial records are retained for 7 years as required by applicable tax and legal obligations, and are anonymized upon account deletion
• Upon agency account closure, account data is deleted after a 30-day grace period to allow for data export
• GDPR deletion requests are processed via soft-delete with anonymization of personally identifiable information

The Platform and its data are hosted and processed in the United States using Supabase and Vercel infrastructure.

EU/EEA Users: For personal data transferred from the European Union or European Economic Area, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to provide appropriate safeguards.

California Residents: Please refer to the “Your Rights” section below for information specific to your rights under the California Consumer Privacy Act (CCPA).

Other Jurisdictions: We are committed to providing adequate protections for personal data consistent with applicable law in your jurisdiction.

All Users

• Right to access your personal data
• Right to correction of inaccurate data
• Right to deletion of your data
• Right to data portability (CSV export)

GDPR Rights (EU/EEA Residents)

• Right to restrict processing of your data
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority
• A Data Processing Agreement (DPA) is available upon request

CCPA Rights (California Residents)

• Right to know what personal information is collected about you
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, contact us at support@operations.lunarolivia.com. We will respond within 30 days.

• Supabase Session Cookies — essential for authentication; cannot be disabled without losing access to the Platform
• DataFast uses website visitor and session cookies to connect visits and measure usage and traffic sources. The iPhone and iPad app does not load this script.
• Workspace Cookie (olivia_active_agency_id) — functional cookie remembering which workspace you last opened

We use only aggregate statistics that do not identify people to promote Olivia. We do not sell your personal information.

Agencies manage access for their teams and clients through workspace memberships and permissions.

• AES-256-GCM encryption for all integration credentials and sensitive tokens
• Row-Level Security (RLS) for strict tenant-level data isolation between agencies
• Supabase Auth with secure session management
• HTTPS encryption for all data in transit

While we implement reasonable security measures to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

• We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements
• Updates will be posted on this page with a revised effective date
• For material changes, we will notify affected users via email
• Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy

Impero Agency, LLC
Registered in Delaware, United States
Email: support@operations.lunarolivia.com
Website: lunarolivia.com