Privacy Notice

MicroGem Labs LLC · Phoenix, Arizona, USA Version 1.2 · Effective Date: September 26, 2026

1. Introduction

This notice explains how MicroGem Labs LLC ("MicroGem Labs," "we," "us") collects, uses, and shares information across our two product lines:

• Developer Services (microgemlabs.ai) — self-serve monitoring, error tracking, logging, webhook, cron, status-page, on-call, AI assistant, GemScrape, and GemVoice tools, sold worldwide.
• GemSmart (gemsmart.ai) — a managed AI business partner we operate on behalf of small businesses ("Clients"), which interacts with their customers ("End Users").

Two plain-English commitments up front: we do not sell your personal information, and we do not train our own AI models on your content.

Our Terms of Service (and, for GemSmart Clients who sign one, our Data Processing Agreement) also apply. If a signed DPA conflicts with this Notice on processor obligations, the DPA controls.

2. Our Two Roles: Controller vs. Processor

This is the most important section if you are a GemSmart Client — or if you are an End User who called or messaged a business that uses GemSmart.

Where we are the controller (our own responsibility):

• Account data for customers of both product lines — name, email, login, billing records, support conversations.
• Data about visitors to microgemlabs.ai and gemsmart.ai.
• Publicly available reputation and competitor data we collect for Clients (reviews, listings, public mentions).

Where we are a service provider / processor (acting on a Client's behalf):

• End User data processed through GemSmart on a Client's behalf: End User names, phone numbers, emails, call recordings and transcripts, SMS messages, chat conversations, appointment and booking details, lead-form and intake-form submissions (including optional photos and free text).
• On Developer Services, certain data you submit about other people (for example, on-call recipients' phone numbers or Slack identifiers, or labels on public status pages) is processed under your instructions; you are responsible for your authority to provide that data.

For processor data, the Client (or Developer Services Customer) is responsible for the relationship with those individuals — including privacy disclosures, legal bases, and required consents. We process this data only to provide the Services per instructions, do not sell it, do not use it for our own marketing, and do not train our models on it.

If you are an End User (you called, texted, chatted with, or booked with a business that uses GemSmart): please direct privacy questions and rights requests to that business. We will assist the business in responding. If you contact us directly, we will forward your request to the business and help it respond where appropriate.

A signature-ready Data Processing Agreement is available to Clients on request at legal@microgemlabs.ai.

3. What We Collect

3.1 Account data (both product lines)

Name, email, password (handled by our authentication provider — we store a hash, not the password itself), MFA settings, and billing information. Stripe holds your card details; we store only customer and subscription IDs plus billing metadata like plan and status.

3.2 Service data — Developer Services

• Monitoring configuration and results: monitor targets (URLs, IPs, hostnames), check intervals, alert destinations, on-call schedules, and check results (timestamps, up/down status, response times, HTTP status codes). For content-change checks we store a cryptographic hash of page content rather than full response bodies. If you publish a public status page, the monitor names and uptime history you choose to publish are, by your configuration, publicly visible.
• Logs and error payloads you send us — the contents are whatever your systems emit, so keep secrets and personal data out of them where you can.
• Webhook payloads relayed or inspected through the service.
• Scraped content returned by GemScrape from URLs you supply.
• On-call contact details: phone numbers, messaging identifiers, and notification preferences (including quiet hours) of people you designate to receive alerts.
• GemVoice call recordings and transcripts, where you enable them.
• AI assistant / agent skills prompts, tool inputs, and action-approval logs needed to operate those features.

3.3 Service data — GemSmart

Processed on the Client's behalf (see Section 2): End User names and contact details; call recordings and transcripts (a consent line is announced before recording; we do not use voice audio to biometrically identify anyone); SMS logs and consent/opt-out records; website lead-form, chat, booking, and intake submissions; uploaded documents and chat attachments; AI conversation history and Client-approved "learned insights"; and appointment records.

Collected as controller-side data for the Client relationship: publicly available reviews, ratings, competitor listings, and public forum mentions about the Client's market.

3.4 Technical data

IP address, browser type, request timestamps, and application error logs — collected automatically to operate and secure the Services. We do not use third-party advertising trackers or cross-site profiling.

4. How We Use Information

• Provide and operate the Services: run checks, deliver alerts, answer calls, send Client-directed messages, host websites, process bookings.
• Bill subscriptions and enforce plan limits.
• Run AI features you or your Client enable (see Section 5).
• Secure the Services: detect and prevent fraud, abuse, and attacks.
• Communicate with you: service notices, security alerts, support. Optional product-update emails always include unsubscribe; transactional and security emails cannot be opted out of while your account is active.
• Maintain security, debug issues, and improve reliability and performance of the Services.
• Meet legal obligations (tax, accounting, lawful requests).

We do not use Customer Content for advertising, and we do not sell personal information.

5. AI Processing

Content sent through AI features (assistant conversations, call transcripts, chat, analysis inputs) is processed by third-party LLM providers — currently Anthropic, OpenRouter (as a routing layer), and xAI — or, if you configure bring-your-own-key (BYOK), by your own provider using your key, which we store encrypted and use only on your behalf.

• We do not train our own models on customer content.
• Whether a provider may use API inputs for its own training is governed by that provider's API terms (or your agreement with your BYOK provider). We select providers whose API terms do not train on customer data by default; check the provider's current terms for specifics.
• GemSmart voice calls also pass through Deepgram (speech-to-text) and Cartesia (text-to-speech) as part of the call pipeline.
• AI "learned insights" in GemSmart become active only after the Client approves them; every AI-made change is logged and undoable.
• You (or your Client) are responsible for not sending data through AI features that your internal policies or contracts forbid.

6. Who We Share With

We share personal information only with: (a) the subprocessors in the Appendix, each receiving only what its function requires; (b) a Client's own connected services at the Client's direction (e.g., the Client's Stripe account, their Facebook/Instagram/Google Business Profile via our posting provider); (c) professional advisers, and authorities where the law requires; and (d) a successor in a merger, acquisition, or asset sale, with notice to you where required.

For GemSmart payments, End User card data goes directly to Stripe under the Client's own Stripe Connect account — the Client is the merchant of record; we never hold End User card data.

We will update the Appendix when subprocessors change. Clients with a DPA receive advance notice of material subprocessor changes per that DPA. Other customers can review the current Appendix on this page.

6.1 Mobile messaging and opt-in data

We do not sell, rent, or share mobile phone numbers, SMS opt-in consent, or text-messaging consent records with third parties or affiliates for their own marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from every other sharing category described in this Notice, including any sharing for marketing or advertising.

Mobile numbers and message content are disclosed only to the telephony subprocessor that delivers the message on our or a Client's behalf (see the Appendix — currently Twilio), and only to the extent required to deliver it. We do not use mobile numbers collected for messaging to build advertising audiences, and we do not disclose them to data brokers.

Two distinct cases, because we handle both:

• Developer Services (on-call notifications). The Team that configures an alert is responsible for having consent from each recipient. We maintain the consent and opt-out records, enforce quiet hours, and honor opt-outs automatically.
• GemSmart (messages to a Client's End Users). We act as the Client's processor. The Client is the sender of record and is responsible for obtaining End User consent; we operate the consent, quiet-hours, and opt-out machinery on the Client's behalf.

In both cases: reply STOP to any message to opt out, or HELP for assistance. Opt-outs are honored automatically and suppress further messaging to that number. Message frequency varies by how the sending Team or Client has configured alerts and campaigns. Message and data rates may apply.

7. Your Rights and Choices

7.1 Everyone

• Access and update account and configuration data from your dashboard.
• Export: your content is stored as structured, exportable data — you can take your content (and, for GemSmart, your domain) with you as described in product documentation.
• Delete: request account deletion at legal@microgemlabs.ai; see Section 8 for timing.
• AI features: disable optional AI features and delete stored BYOK keys in settings where available.
• SMS recipients: reply STOP to any message to opt out; we automatically honor opt-outs and enforce quiet hours.
• On-call recipients: adjust channels/quiet hours in settings or ask your team owner to remove you from rotations.

To submit a privacy request, email legal@microgemlabs.ai from your account email (or include enough detail for us to verify your identity). We may ask for additional information to verify the request.

7.2 US state privacy rights

We currently believe we fall below the applicability thresholds of the CCPA/CPRA and similar state laws (revenue and volume tests). The disclosures below are included so this Notice remains accurate if thresholds are crossed; we will re-check applicability at least annually.

We do not sell personal information and do not share it for cross-context behavioral advertising.

If an applicable US state privacy law applies to you, you may have the right to: know/access the personal information we hold about you; correct it; delete it; receive a portable copy; opt out of sale, sharing for cross-context behavioral advertising, and certain profiling (we do none of these today); limit use of sensitive personal information where that right applies (we do not use sensitive personal information to infer characteristics); and not be discriminated against for exercising rights. Submit requests to legal@microgemlabs.ai; we will verify your identity and respond within the statutory window. You may use an authorized agent or appeal a denial where the law provides.

If we process your data as a Client's service provider (End User data), we will direct your request to the Client and assist them, as these laws require.

7.3 EEA / UK

Our Developer Services are available worldwide and we do not geo-block, but we do not actively target the EU/UK market with localized marketing. Because EU/UK residents can still create accounts, we provide the following baseline information.

Where GDPR or UK GDPR applies to our role as controller, we typically rely on: performance of a contract (to provide the Services you request); legitimate interests (to secure and maintain the Services, prevent abuse, and improve reliability, balanced against your rights); consent (for optional features such as certain AI analysis or marketing emails, where consent is required); and legal obligation (tax and compliance).

You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Contact legal@microgemlabs.ai. Where we act as a processor for a Client, please contact that Client first.

For international transfers, see Section 10.

8. Retention

• Product telemetry (check results, logs, similar operational data) is pruned on rolling windows — some data within 7 days, most within 365 days, per your plan's documented retention tiers.
• Call recordings, transcripts, messages, and business records are retained while the account (or the Client relationship) is active, per plan settings.
• AI action-approval logs for Developer Services agent skills are retained for at least 90 days.
• Backups are encrypted and purged on a fixed rotation of 30 days.
• Account deletion removes customer content from production systems within 30 days, with backup copies expiring on the rotation above. We keep billing and tax records as long as the law requires, and may retain limited records needed for disputes, security, or legal compliance.

9. Security

We apply safeguards designed for the data we handle: encryption in transit (TLS); encrypted secrets at rest (including BYOK API keys); row-level security in our database; MFA; role-based team permissions; SSRF-guarded outbound fetches for monitoring and scraping; prompt-injection defenses on AI surfaces; encrypted off-site backups; and audit-logged, undoable AI changes on GemSmart. No system is perfectly secure, and we cannot guarantee absolute security.

Personal-data incidents. Where we act as a processor, we will notify the relevant Client without undue delay after becoming aware of a personal-data breach affecting data we process on their behalf, as described in the Terms of Service and any DPA. Where we act as a controller and notice is required by law, we will notify affected individuals and/or authorities as required.

10. Where Data Lives; International Transfers

Customer data is stored in the United States.

• Primary database and authentication — Supabase, hosted on Amazon Web Services in the US West Coast region. This is where customer content and account data rest.
• Application servers — Hostinger (virtual private servers). These process data in transit and hold operational logs; customer content is stored in the database above rather than on these servers.
• Encrypted off-site backups — Amazon Web Services, US West Coast region.

Other subprocessors (Appendix) operate in the United States and other countries.

Where required by applicable law (including GDPR/UK GDPR), we use appropriate transfer mechanisms such as Standard Contractual Clauses (or successor clauses) with subprocessors, and we require subprocessors to protect personal data consistently with this Notice and our contracts. Copies of relevant transfer mechanisms may be available on request to legal@microgemlabs.ai (commercially sensitive terms may be redacted).

11. Cookies

We use essential and session cookies only — sign-in state, security (CSRF), and preferences. We do not use third-party advertising or cross-site tracking cookies today, so no cookie-consent banner is presented for advertising/tracking purposes. If that changes, we will update this Notice and implement any required consent mechanism.

12. Children

The Services are not directed to children under 13 (or under 16 where a higher age applies), and we do not knowingly collect children's personal information. Account holders must be 18 or older. GemSmart Clients agree not to direct the tools at children. If you believe a child has provided personal information, contact legal@microgemlabs.ai and we will delete it.

13. Changes to This Notice

We may update this Notice from time to time. We will revise the effective date above and, for material changes, provide additional notice (email to the account owner and/or in-app notice) before the changes apply. Prior versions are available on request.

14. Contact

MicroGem Labs LLC 15144 West Windrose Drive, Surprise, AZ 85379, USA Privacy: legal@microgemlabs.ai · Support: support@microgemlabs.ai

Appendix — Subprocessors

Grouped by function. Each receives only the data needed for its role and is bound by its own data-protection terms.

Payments & tax

• Stripe — payment processing, subscription billing, tax calculation. Receives billing contact info, tokenized payment methods, transaction history. (GemSmart End User payments run on the Client's own Stripe Connect account.)

Identity & data platform

• Supabase — authentication and primary database. Receives account credentials (hashed) and customer content stored in the platform.

Communications

• Twilio — telephony and SMS. Receives phone numbers, call audio, and message content for calls/messages placed through the Services.
• Resend — transactional email. Receives email addresses and notification content.

Voice AI pipeline

• Deepgram — speech-to-text. Receives call audio for transcription.
• Cartesia — text-to-speech. Receives response text for voice synthesis.

LLM processing

• Anthropic, OpenRouter (routing), xAI — AI features. Receive the content submitted to AI features (conversations, transcripts, summaries). BYOK customers' content goes to their own configured provider instead.

Infrastructure

• Hostinger — application servers (virtual private servers, United States). Processes data in transit and holds operational logs.
• Amazon Web Services — encrypted off-site backups (region: US West Coast).
• Cloudflare — CDN, DNS, custom domains, object storage.
• Browserless — web-page rendering for browser monitoring and GemScrape.
• Inngest — background job processing (scheduled checks and tasks; receives the configuration and results needed to run jobs).

Publishing

• Ayrshare — social publishing to Client-connected accounts (Facebook, Instagram, Google Business Profile). Receives approved post content and account connections.