Manito Marketing LLC — Privacy Policy
Effective Date: October 23, 2026 · Last Updated: October 23, 2026
Manito Marketing LLC ("Manito Marketing," "we," "us," or "our") provides AI voice agents, chatbots, and marketing automation for local businesses. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have.
We do not sell personal information, and we do not use our clients' customer data to train AI models.
Who this policy covers. This policy applies to three groups:
| Group | Who they are | Our role |
|---|---|---|
| Clients | Businesses that buy our services, and their owners and staff | We decide how this data is used (a "controller" or "business") |
| Website visitors | People who visit www.manitomarketing.com or contact us | We decide how this data is used (a "controller" or "business") |
| End Users | Our clients' customers and leads, such as people who call a client's AI voice agent, chat with a client's chatbot, or receive a client's texts or emails | We process this data on our client's behalf (a "processor" or "service provider") |
If you are an End User. When you call, text, or chat with one of our clients, that business controls your information, and its own privacy policy applies. We handle your information only to provide services to that business and as described in this policy. To make a privacy request, contact the business you interacted with. If you contact us instead, we will forward your request to them and help them respond.
This policy does not cover third-party websites or services that our services link to or integrate with. Those have their own privacy policies.
1. Information We Collect
We collect only what we need to provide and improve our services. The tables below show what we collect from each group and where it comes from.
1.1 From clients
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, email address, phone number, job title | You, when you sign up or contact us |
| Business information | Business name, address, website, services, pricing, hours, service areas, EIN (for text message registration) | You |
| AI training information | FAQs, scripts, policies, and other details you give us to set up your AI agents | You |
| Account and login data | Usernames, account settings, user permissions | You and our platforms |
| Payment information | Billing name, billing address, last 4 digits of card, payment history | Our payment processor. We do not store full card numbers. |
| Communications | Emails, support requests, meeting notes, feedback | You |
1.2 From website visitors
| Category | Examples | Source |
|---|---|---|
| Form submissions | Name, email, phone number, business name, message | You, when you fill out a form or book a call |
| Device and usage data | IP address, browser type, device type, pages viewed, time on site, referring website | Cookies and analytics tools (see Section 6) |
| Approximate location | City or region, based on IP address | Analytics tools |
1.3 From End Users (our clients' customers)
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, phone number, email address | The End User, or our client's records |
| Call recordings and transcripts | Audio of calls with AI voice agents, written transcripts, call summaries | Calls to or from our clients' AI voice agents |
| Chat and text transcripts | Messages exchanged with chatbots and text responders | Chats and texts with our clients' AI agents |
| Request details | The service requested, appointment times, project details, anything the End User chooses to share | The End User |
| Call and message data | Phone numbers, call times and lengths, delivery status, opt-in and opt-out status | Our phone and messaging providers |
| Marketing activity | Email opens, link clicks, campaign responses | Our marketing automation tools |
1.4 Sensitive information. We do not intentionally collect sensitive information, such as health conditions, Social Security numbers, financial account numbers, or precise geolocation. Our clients agree not to configure our services to collect it unless we agree in writing. End Users may still choose to share sensitive details during a call or chat. If that happens, we handle it under this policy and our client's instructions, and we do not use it for any other purpose.
2. How We Use Information
We use personal information only for the purposes below. Where the EU or UK General Data Protection Regulation (GDPR) applies, the right column shows the legal basis we rely on.
2.1 Client and website visitor information
| Purpose | Legal basis (GDPR) |
|---|---|
| Set up, run, and support your services and AI agents | Performance of a contract |
| Bill you and process payments | Performance of a contract |
| Answer questions and support requests | Performance of a contract; legitimate interests |
| Register your business for text messaging with carriers | Performance of a contract; legal obligation |
| Send service updates, invoices, and policy changes | Performance of a contract |
| Send marketing about our own services | Consent, or legitimate interests where the law allows |
| Understand how our website is used and improve it | Consent (for non-essential cookies) |
| Prevent fraud, abuse, and security incidents | Legitimate interests |
| Comply with laws, respond to legal requests, and enforce our terms | Legal obligation; legitimate interests |
2.2 End User information
We use End User information only to provide services to the client that the End User interacted with, following that client's instructions. This includes:
Answering calls and chats, capturing lead details, and booking appointments
Sending follow-up texts, emails, and reminders on the client's behalf
Creating call summaries and transcripts for the client to review
Tracking opt-ins and opt-outs so messages comply with the law
Troubleshooting, quality checks, and security
Our clients are responsible for having a legal basis to collect End User information and for telling End Users how it will be used.
2.3 De-identified and aggregated data. We may combine information in a way that does not identify any person or client, such as average call length across all clients. We use this to measure and improve our services. We will not try to re-identify it.
2.4 No automated decisions with legal effects. Our AI agents answer questions, collect details, and book appointments. They do not make decisions that produce legal or similarly significant effects on people, such as approving credit, employment, or housing.
3. AI Processing and Model Training
3.1 How our AI agents use information. When someone talks or chats with an AI agent, their words are converted to text, sent to an AI model to generate a reply, and the reply is spoken or shown back to them. The AI agent uses the client's setup information (such as FAQs, hours, and pricing) and the conversation itself to respond. This happens in real time through our AI and communication providers, including OpenAI, GoHighLevel, and Twilio.
3.2 We do not train AI models on your data. We do not use client data, End User data, call recordings, or transcripts to train or improve any AI model that serves other clients or the public.
3.3 Our AI providers. We use AI providers through their business services, not their consumer apps. Under OpenAI's current business terms, data sent through its API is not used to train its models by default and is kept only for a limited period, mainly to monitor for abuse. Each provider's own terms control how it handles data, and we choose providers whose terms meet these standards.
3.4 Client-specific configuration. We use each client's setup information and approved scripts only to configure that client's own AI agents. Reviewing past conversations to fix errors or improve a client's AI agent is done only for that client.
3.5 AI disclosure. Our AI agents are set up to tell people they are talking with an automated or AI system, as required by law and as a standard practice.
3.6 Accuracy. AI can make mistakes, including mishearing or misstating information. Clients review summaries and important details, and anyone can ask to speak with a person at the business they contacted.
4. Call Recordings and Chat Transcripts
4.1 Notice before recording. Our AI voice agents announce at the start of each call that the call may be recorded and that the caller is speaking with an AI system. Washington and several other states require everyone on a call to consent before it is recorded. Staying on the line after the announcement is treated as consent where the law allows. If you do not want to be recorded, you can hang up and contact the business another way, such as by email or in person.
4.2 Why we record and transcribe. Recordings and transcripts let the AI agent work, let our clients review what was said and follow up, and help us fix errors and investigate problems. Chat and text transcripts are saved for the same reasons.
4.3 Who can access them. Recordings and transcripts are available to the client whose AI agent handled the conversation. A small number of our team members can access them only when needed to support that client, troubleshoot, or meet a legal obligation. They are stored within our platform providers' systems (see Section 5).
4.4 How long we keep them. We keep recordings and transcripts for the period shown in Section 7, unless the client asks us to delete them sooner or the law requires us to keep them longer.
4.5 What we don't do. We do not use recordings or transcripts to train AI models, sell them, or use voices to create voice clones.
4.6 Requests about a recording. To access or delete a recording of your call, contact the business you called. If you contact us, we will pass your request to that business and help it respond.
5. How We Share Information
We do not sell personal information or share it for cross-context behavioral advertising. We share it only as described below.
5.1 Service providers. We use these providers to run our services. Each receives only what it needs for its function and is bound by its own privacy and security commitments.
| Provider | What it does | Information it may receive |
|---|---|---|
| GoHighLevel | CRM, automation, AI agents, marketing emails, websites, and data storage | Contact details, business information, conversations, recordings, transcripts, marketing activity |
| Twilio | Phone calls, phone numbers, and text messages | Phone numbers, call audio, message content, delivery data |
| OpenAI | AI models that generate AI agent responses | Conversation text and client setup information needed to respond |
| Google Workspace | Business email, calendar, and file storage | Emails, meeting details, and files exchanged with clients and prospects |
| Google Analytics | Website usage measurement | Device and usage data, approximate location |
| Stripe | Payment processing | Billing details and payment card data, which go directly to Stripe |
We may add or change providers over time. A current list is available by emailing us.
5.2 Our clients. Information collected through a client's AI agents, chatbots, or campaigns is shared with that client.
5.3 Advertising and listing platforms. When we manage a client's ads or listings, we may share limited information with platforms such as Google and Meta at the client's direction, for example to measure ad results.
5.4 Legal reasons. We may share information if we believe in good faith it is required by law, a subpoena, or a court order, or needed to protect the rights, safety, or property of anyone.
5.5 Business transfers. If Manito Marketing is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that deal. It will remain protected by this policy or one at least as protective.
5.6 With your permission. We may share information for other purposes if you ask us to or agree to it.
6. Cookie Policy
6.1 What cookies are. Cookies are small text files a website stores in your browser. Similar technologies include pixels, local storage, and scripts. We call all of these "cookies" in this policy.
6.2 Cookies we use.
| Type | Purpose | Examples | Can you turn them off? |
|---|---|---|---|
| Essential | Keep the site secure, remember logins, and make forms and chat widgets work | Session and security cookies, chat widget cookies | No, the site won't work properly without them |
| Preferences | Remember your settings, such as cookie choices | Consent cookie | Yes |
| Analytics | Show us how visitors use our site so we can improve it | Google Analytics cookies such as _ga, which typically last up to 2 years | Yes |
We do not use advertising cookies to track you across other websites.
6.3 Google Analytics. Google Analytics collects device and usage data and sends it to Google. We use it only to understand site traffic. You can learn how Google uses this data at policies.google.com/technologies/partner-sites, and opt out of Google Analytics on all websites with Google's browser add-on at tools.google.com/dlpage/gaoptout.
6.4 Your cookie choices.
Cookie banner. Where the law requires consent, such as in the EU and UK, we ask before setting non-essential cookies. You can change your choice at any time through the cookie settings link on our website.
Browser settings. Most browsers let you block or delete cookies. Blocking essential cookies may break parts of the site.
Global Privacy Control. We treat a Global Privacy Control (GPC) browser signal as a request to opt out of non-essential cookies where the law requires it.
Do Not Track. There is no common standard for "Do Not Track" signals, so we do not respond to them separately from GPC.
6.5 Chatbots on client websites. When our chatbots run on a client's website, they may use essential cookies to keep the conversation going. That client's own cookie policy covers any other cookies on its website.
7. Data Retention
We keep personal information only as long as needed for the purposes in this policy, then delete or de-identify it.
| Type of information | How long we keep it |
|---|---|
| Client account and business information | While services are active, plus 90 days after they end (30 days for you to request an export, then up to 60 days to delete) |
| End User contact details and lead records | While the client's services are active, plus 90 days after they end, unless the client deletes them sooner |
| Call recordings, call transcripts, and chat transcripts | While the client's services are active, unless the client sets a shorter period or deletes them; deleted within 90 days after services end |
| Consent and opt-in records | 5 years, so we and our clients can prove consent |
| Opt-out and do-not-contact records | As long as needed to keep honoring the opt-out |
| Billing and payment records | 7 years, for tax and accounting |
| Support emails and communications | 3 years after our relationship ends |
| Website form submissions (prospective clients) | Up to 3 years after last contact, or until you ask us to delete them |
| Website analytics data | Up to 14 months in Google Analytics |
7.1 Exceptions. We may keep information longer if the law requires it, to resolve a dispute, or to enforce our agreements. Information in backups is deleted on our providers' normal backup cycle and stays protected until then.
7.2 Client controls. Clients can delete contacts, recordings, and transcripts from their accounts at any time, and can ask us to set shorter retention periods.
8. Data Security
We use reasonable administrative, technical, and physical safeguards to protect personal information. These include:
Encryption. Data is encrypted in transit using TLS and encrypted at rest by our hosting and platform providers.
Access controls. Only people who need access to do their job can see personal information, and access is removed when it is no longer needed.
Multi-factor authentication. We require it on our accounts with access to client and End User data.
Trusted providers. We use established providers with their own security programs, and review their practices before using them.
Payment security. Card payments are handled by our payment processor. Full card numbers never touch our systems.
Training. Anyone on our team who handles personal information is trained on these practices.
Monitoring. We watch for unusual activity and keep logs to help investigate problems.
No method of storing or sending data is completely secure, so we cannot guarantee absolute security. If you have reason to believe your information is no longer secure, contact us right away at [email protected].
9. Your Privacy Rights
Depending on where you live, you may have the following rights. We honor these requests for everyone where we reasonably can, even if your local law does not require it.
| Right | What it means |
|---|---|
| Access | Know what personal information we have about you and get a copy |
| Correction | Fix information that is wrong or incomplete |
| Deletion | Ask us to delete your personal information |
| Portability | Get your information in a format you can move to another service |
| Opt out | Stop marketing messages, and opt out of any sale, sharing, targeted advertising, or profiling (we don't do these, see Section 5) |
| Restrict or object | Ask us to limit or stop certain uses, including uses based on legitimate interests |
| Withdraw consent | Take back consent you gave, without affecting earlier processing |
| Appeal | Ask us to reconsider if we deny your request |
9.1 How to make a request. Email [email protected] with the subject line "Privacy Request," or write to us at the address in Section 16. Tell us which right you want to use and how we can reach you.
9.2 End Users. If you interacted with one of our clients' AI agents, chatbots, or campaigns, please send your request to that business, since it controls your information. If you send it to us, we will forward it to the business and help it respond.
9.3 Verifying your identity. To protect your information, we will confirm your identity before acting, usually by matching details you give us with what we have. We will only use those details for verification.
9.4 Authorized agents. Someone you authorize may make a request for you. We may ask for written permission signed by you and may still need to verify your identity.
9.5 How fast we respond. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you why, and may extend by up to another 45 days where the law allows. For GDPR requests, we respond within 1 month, extendable by up to 2 more months for complex requests.
9.6 Appeals. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal." We will respond within 60 days, or sooner if your law requires. If you are still unhappy, you may contact your state attorney general or local data protection authority.
9.7 Exceptions. We may decline or limit a request where the law allows, such as when we must keep information for legal reasons or a request would reveal other people's information. We will explain why.
9.8 No discrimination. We will not treat you differently, charge you a different price, or give you a lower level of service for using your privacy rights.
10. Opt-Out Procedures
| To stop | How to opt out | When it takes effect |
|---|---|---|
| Text messages | Reply STOP to any message. Reply HELP for help. | Right away, with one final message confirming you've opted out |
| Marketing emails | Click "unsubscribe" at the bottom of any marketing email | Within 10 business days |
| Phone calls | Tell the AI agent or caller you don't want more calls, or ask the business to add you to its do-not-call list | Within 10 business days |
| Analytics cookies | Use the cookie settings link on our website, your browser settings, or a Global Privacy Control signal | Right away |
| Call recording | Hang up after the recording notice and contact the business another way | Right away |
| Anything else | Email [email protected] | Within 10 business days |
10.1 Opt-outs apply across channels. An opt-out sent through any reasonable method, such as replying "stop texting me" instead of STOP, will be honored.
10.2 Messages from our clients. Opting out of one business's messages stops messages from that business. It does not stop messages from other businesses that use our services.
10.3 Service messages. Clients who opt out of marketing will still get messages needed to run their account, such as invoices, security notices, and policy updates.
11. U.S. State Privacy Disclosures
11.1 California. This section gives California residents the information required by the California Consumer Privacy Act, as amended (CCPA), to the extent it applies to us. In the past 12 months, we collected these categories of personal information:
| CCPA category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, phone number, IP address | Service providers, our clients |
| Customer records | Billing name and address | Service providers |
| Commercial information | Services purchased, payment history | Service providers |
| Internet or network activity | Pages viewed, site interactions, email engagement | Service providers |
| Approximate geolocation | City or region from IP address | Service providers |
| Audio and electronic information | Call recordings, chat and text transcripts | Service providers, our clients |
| Professional information | Business name, job title | Service providers |
Sources, purposes, and retention periods are described in Sections 1, 2, and 7.
No sale or sharing. We have not sold or "shared" (for cross-context behavioral advertising) personal information in the past 12 months, including that of consumers under 16.
Sensitive personal information. We do not intentionally collect it, and do not use it to infer characteristics about anyone. If an End User volunteers it, we use it only to provide the requested service, so a "right to limit" request is not needed.
Shine the Light. We do not share personal information with third parties for their own direct marketing.
No financial incentives. We do not offer discounts or other incentives in exchange for personal information.
11.2 Washington consumer health data. We do not collect consumer health data for our own purposes. When a client's AI agent collects health-related details, such as a reason for a dental or therapy appointment, we process that information only on the client's behalf under a written contract. The client's own Consumer Health Data Privacy Policy, required by Washington's My Health My Data Act, applies to that data. Contact the client to use your rights.
11.3 Other states. Residents of other states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas, and Virginia, may use the rights in Section 9, including the right to appeal in Section 9.6.
11.4 Nevada. We do not sell covered information as defined by Nevada law.
12. EEA, UK, and Swiss Users and International Data Transfers
12.1 Our focus. We are based in the United States and our services are designed for U.S. businesses. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, this section explains how the GDPR and similar laws apply.
12.2 Controller. For client and website visitor data, the controller is Manito Marketing LLC, 443 W 28th Ave, Spokane, WA 99203, USA. For End User data, our client is the controller and we are its processor.
12.3 Legal bases. The legal bases we rely on are listed in Section 2.1.
12.4 Your rights. In addition to the rights in Section 9, you may object at any time to processing based on legitimate interests and to direct marketing. You also have the right to file a complaint with your local data protection authority, or in the UK with the Information Commissioner's Office. We'd appreciate the chance to address your concern first.
12.5 International transfers. Our servers and service providers are mainly located in the United States, so your information will be transferred to and processed in the U.S. U.S. privacy laws may differ from those where you live. When we transfer personal information from the EEA, UK, or Switzerland, we rely on one or more of these safeguards:
The European Commission's Standard Contractual Clauses, with the UK Addendum where needed
A provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions
Other lawful transfer mechanisms or exceptions allowed by law
You can request a copy of the relevant safeguards by emailing us.
12.6 Other countries. If you use our services from outside the United States, you understand that your information will be transferred to and processed in the United States.
13. Children's Privacy
Our services are for businesses and adults. We do not target or knowingly collect personal information from children under 13, or under 16 where local law sets a higher age. Our clients agree not to direct their AI agents or campaigns at children.
An AI agent cannot always tell a caller's age. If we learn that we have collected a child's personal information without required parental consent, we will delete it promptly. If you believe a child has given us information, email [email protected].
14. Data Breach Notification
If we learn that personal information in our control may have been accessed or disclosed without authorization, we will follow these steps:
Contain it. Act right away to stop the incident and secure affected systems, including resetting credentials and working with affected providers.
Investigate. Find out what happened, what information was involved, and whose information it was.
Notify clients. Tell affected clients without unreasonable delay, and no later than 72 hours after confirming a breach of their data, so they can meet their own notice duties.
Notify individuals. Where we are the controller, notify affected people as required by law. Under Washington law, this means within 30 days of discovering the breach. Other states and the GDPR may set shorter deadlines.
Notify regulators. Notify the Washington Attorney General when a breach affects more than 500 Washington residents, and other regulators as the law requires, including EU or UK authorities within 72 hours where the GDPR applies.
Prevent repeats. Review what happened and improve our safeguards.
Notices will explain what happened, what information was involved, what we are doing about it, and steps you can take to protect yourself. We will send them by email, mail, or another method allowed by law.
15. Changes to This Policy
We may update this policy as our services or the law change. We will post the new version on our website and update the "Last Updated" date at the top. If we make material changes, we will email clients at least 30 days before they take effect and post a notice on our website. Where the law requires consent for a change, we will ask for it.
16. Contact Us
For questions, privacy requests, or concerns about this policy, contact:
Manito Marketing LLC
443 W 28th Ave, Spokane, WA 99203
Email: [email protected]
Website: www.manitomarketing.com
For privacy requests, please use the subject line "Privacy Request."
© 2026 Manito Marketing LLC. Spokane, WA. All rights reserved.