Privacy Policy | Route It AI

PRIVACY POLICY Effective Date: October 18, 2026 Last Updated: November 9, 2026 This Privacy Policy explains how Constant Strategy Group LLC, a Florida limited liability company ("CSG," "we," "us," or "our"), collects, uses, discloses, and retains personal information when you use Route It AI (the "Services"). Route It AI is the software product. CSG is the company that operates it. The Services include the website at routeit.ai, subscriber workspaces, embeddable intake widgets, phone and text intake, scheduling tools, document upload, the employee assistant and knowledge bank, court reporting and practice operations tools, billing, and related APIs and webhooks. This Policy is a notice. Subscribers agree to it through the Terms of Service. People who use a subscriber's website, phone number, or widget should also read that subscriber's own privacy notice. The subscriber decides why that information is collected. If you do not agree with this Policy, do not create an account, and remove Route It AI widgets and scripts from your sites. 1. THE ROLES WE PLAY 1.1 Subscriber intake, leads, matters, and jobs When a subscriber organization uses Route It AI to collect information from its own leads, clients, patients, guests, witnesses, or other end users ("End-User Data"), the subscriber is the business and the controller. The subscriber chooses the questions, the channels, the recipients, and how long it needs the record. CSG is the service provider and processor for that End-User Data. We process it to provide the Services the subscriber configured, under the subscriber's instructions, and to keep the Services secure. We do not sell that information, and we do not use it for our own advertising. 1.2 Accounts, billing, and our website CSG is the business and the controller for information we collect directly from subscribers, their staff, contractors we pay, and visitors to routeit.ai. That includes account records, billing, support messages, and security logs for our own site and platform. 1.3 One policy, every vertical Route It AI is one platform used by more than one kind of business, including law firms, court reporting and legal support agencies, healthcare practices, hospitality and restaurants, real estate brokerages, and other commercial subscribers. This Policy covers all of them. A vertical does not get a separate privacy policy. Section 3 lists the extra categories those workspaces can capture. Professional duties that apply only to one vertical, such as attorney confidentiality or a HIPAA business associate relationship, are called out where they change what we will and will not do. 2. INFORMATION WE COLLECT 2.1 Subscriber accounts and staff We collect the name, business email, phone number, role, organization name, business vertical, and login credentials of people who administer or use a workspace. Passwords are handled by our authentication provider. We do not store plaintext passwords. We collect billing contacts, billing address, subscription tier, invoices, and payment status. Card numbers and card security codes are entered with Stripe. We do not store full card numbers or CVV codes on our servers. If we pay a contractor or vendor, our internal bookkeeping records may include tax forms (such as a Form W-9 or W-8), taxpayer identification numbers, and payout records. Those records are CSG's, not a feature we offer as a tax product to subscribers. Support messages sent to legal@routeit.ai, security@routeit.ai, billing@routeit.ai, or through the product may be kept with the ticket. 2.2 End-User Data, by channel Depending on how the subscriber configures the Services, we process: Contact and intake details: name, email, phone, location, preferred language, and the content of the inquiry. Law firm intake: facts of a dispute or incident, practice area, injury or damages descriptions, opposing party names, urgency, documents the person uploads, and the transcript of the chat, text, or call. Court reporting and practice operations: job and scheduling details, witness and attorney names, locations, exhibit files, notices, and files a subscriber places in a connected Microsoft 365 or OneDrive folder. Healthcare intake: appointment and administrative requests the subscriber chooses to collect. See Section 7.2 before any health information is submitted. Hospitality and restaurants: party size, dates, reservation preferences, and service requests. Real estate: property criteria, budget ranges, areas of interest, and household preferences the subscriber asks for. Documents: files an end user or subscriber uploads, including PDFs and images, through intake or a secure upload link. Consent records: the time, IP address, and the consent language shown when a person agrees to receive texts, emails, or calls, where the product records that consent. 2.3 Employee assistant and knowledge bank A subscriber may store internal documents, policies, and answers in a knowledge bank, and may let its staff ask questions through an employee assistant. We process the document content, the question, the answer, and the staff member's name, department, and position so the subscriber's access rules can be applied. The subscriber decides which people and departments may see each document. We process that material on the subscriber's instructions. 2.4 Phone, text, and email delivery When the Services send or receive SMS, MMS, or voice calls, we process the phone numbers, message content, delivery status, call duration, and, where the subscriber uses call recording, the recording and any transcript. Email we send on a subscriber's behalf, including receipts and summaries, is processed by our email delivery provider and logged with the delivery result. 2.5 Lead forwarding If a subscriber forwards a lead or matter to another firm, desk, or recipient, we send the package the subscriber selects. That recipient then handles the information under its own practices. The subscriber is responsible for having the right to send it. 2.6 Technical data We collect IP address, browser and device type, operating system, dates and times, referring URL, and security events such as failed sign-in attempts and rate limits. We use this to run, secure, and debug the Services. We do not build advertising profiles, and we do not use device fingerprinting for ads. To reduce fake intakes, scripted floods, scraping, and other abuse, we may also: Store a one-way hash of the visitor IP address (not the raw IP in the firm lead record) together with a truncated User-Agent, so the same network can be correlated across sessions for velocity limits and firm block lists. Count new web intakes by that hashed network inside a rolling window and hold or quarantine excess inquiries before automatic attorney alerts, CRM push, or nurture messages, until the subscriber reviews them. Apply firm-configured block lists for a hashed network, an email domain, or a phone number. Present an optional security challenge (such as Cloudflare Turnstile) when the subscriber turns that control on and the platform is configured for it. The challenge token is verified with the challenge provider and is not used for advertising. These signals are used for security and abuse prevention for the subscriber and for CSG. They are not used to build advertising profiles. 2.7 Cookies and local storage We use essential cookies and local storage to keep an administrative session, protect the session, remember widget state, and store the fact that you dismissed the site notice. We do not use third-party advertising cookies, and we do not sell browsing history. Because these cookies are required to operate the Services, the notice on the website is informational. It is not a request to turn on advertising. 2.8 Custom domains When a subscriber connects its own domain, we store the domain name and the DNS records needed to connect it, and we ask our hosting provider to attach that domain. The subscriber creates those records at its own registrar. 3. HOW WE USE INFORMATION We use personal information to: Provide the intake, routing, scheduling, assistant, document, and reporting features the subscriber turned on, and connect a custom domain the subscriber asks us to attach. Authenticate users, enforce roles, and prevent abuse, scraping, and fraud, including the hashed-network correlation, velocity holds, block lists, and optional security challenges described in Section 2.6. Send messages the subscriber or the end user asked to be sent, including texts, emails, and call flows. Bill for the subscription, apply the plan the subscriber purchased, and keep tax and payment records. Support the account and answer legal, security, and billing questions. Comply with law, respond to valid legal process, and defend CSG, Route It AI, and our subscribers against claims arising from use of the Services. We may use aggregated or de-identified statistics that do not identify a person, a subscriber, or a matter to understand product performance. We do not attempt to re-identify that information. 4. ARTIFICIAL INTELLIGENCE 4.1 What is sent to a model To classify an inquiry, draft a summary, score a lead, or answer a staff question, the Services send the relevant prompt and content to an AI inference provider. A subscriber may use the platform's configured providers or connect its own provider key, including OpenAI, Anthropic, Google, OpenRouter, or another endpoint the subscriber selects. 4.2 No training of foundation models on customer content We do not sell End-User Data or subscriber prompts. We configure our own API accounts so that customer content submitted through those APIs is not used to train the provider's public foundation models. When a subscriber connects its own model key, that subscriber's settings and contract with the provider control training. We do not control a key we do not hold. AI output can be wrong, incomplete, or out of date. The subscriber is responsible for reviewing anything before it is relied on, sent to a client, or filed. 5. WHO RECEIVES INFORMATION We disclose personal information only as follows. Service providers. The companies below process information for us, under instructions, so the Services can run. We do not authorize them to sell it or to use it for their own advertising. Supabase: database, authentication, and file storage. Vercel: application hosting, and attaching a custom domain when the subscriber connects one. OpenAI, Anthropic, and any model provider the subscriber connects (including Google or OpenRouter): AI inference for the features that are turned on. Stripe: subscription payments. Twilio: SMS, MMS, and voice. Resend: email delivery. Microsoft: only if the subscriber connects Microsoft 365 or OneDrive. Files in that tenant are also governed by the subscriber's agreement with Microsoft. We may add or replace a provider. A current list is available on request at legal@routeit.ai. Destinations the subscriber chooses. CRMs, webhooks, calendars, payment links, and other tools the subscriber connects receive the fields the subscriber maps. After delivery, that recipient's own terms apply. We are not the controller of the recipient's system. Forwarded recipients. A firm or person the subscriber chooses to receive a forwarded lead. Corporate transactions. A buyer or investor in a merger, financing, or sale of CSG or the Route It AI business, under a duty to protect the information and honor this Policy. Legal and safety. A court, regulator, or other party when we believe disclosure is required by law or necessary to protect the rights, safety, or security of CSG, our users, or the public. Where the law allows, we will direct legal process about End-User Data to the subscriber, or tell the subscriber before producing it. Subscriber instructions. Anyone the subscriber tells us to share with, including its own staff and vendors. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Service provider processing and a subscriber's own destinations are not a sale or a share. 6. TEXTS, EMAIL, AND RECORDED CALLS Texts and calls placed through the Services depend on consent collected at the point of collection, and on the subscriber keeping that consent language accurate. The subscriber is responsible for the Telephone Consumer Protection Act, state telemarketing rules, CAN-SPAM, and carrier rules on its sites and scripts. When Route It AI starts a product recording on the main inbound intake answer path, the caller is told that the call is recorded for quality and intake evaluation before the gather. Failsafe, unmatched, and hangup paths that do not start a product recording may not include that sentence. Recording consent rules differ by state. The subscriber is responsible for recording only where it has any consent the law requires, and for any notice its own professional rules require. The subscriber must not treat the product greeting as a complete recording disclosure for any number or carrier setup outside Route It AI's main recorded intake answer path. Message and data rates may apply to texts. Opt-out methods presented in the message, such as STOP, must be honored by the subscriber's program. 7. SENSITIVE INFORMATION, HEALTH INFORMATION, AND CONFIDENTIAL LEGAL MATERIAL 7.1 Sensitive identifiers Public widgets are built for preliminary intake. Subscribers must not ask end users to submit Social Security numbers, driver's license numbers, payment card numbers, or bank account numbers through a public chat or form. If someone volunteers that information, the subscriber should delete it. We will delete it on the subscriber's written instruction, unless the law requires us to keep it. 7.2 Health information and HIPAA Route It AI is not a HIPAA business associate offering, and we do not sign a business associate agreement as part of a standard subscription. Subscribers must not use the Services to collect, store, or transmit protected health information unless CSG has signed a separate business associate agreement. Injury descriptions and similar facts collected in a law firm intake are processed as End-User Data for that firm. They are not a standing authorization to operate a healthcare record system. 7.3 Legal confidentiality and court materials Facts a person tells a law firm, and files in a court reporting job, can be confidential and may be privileged once an attorney-client relationship exists. CSG is the firm's vendor, not its lawyer. Privilege and professional confidentiality duties stay with the subscriber. We process that material to provide the Services, restrict it to the subscriber's permissions, and do not use it for advertising or to train foundation models. 7.4 Sensitive personal information under state law Some intake answers, including health or injury details, can be "sensitive" personal information under the California Privacy Rights Act and similar laws. We use that information only to provide the Services the subscriber requested, to keep the Services secure, and to meet legal duties. We do not use it to infer characteristics for advertising. 8. SECURITY We use administrative, technical, and physical safeguards designed to protect personal information. They include encryption in transit (TLS) as provided by our hosting and browser connections, encryption at rest as provided by our infrastructure vendors, access controls, and monitoring for abuse. No online service is perfectly secure. We cannot guarantee that information will never be accessed, disclosed, or lost. Subscribers must protect their own passwords, API keys, and connected accounts, and must tell us at security@routeit.ai if they believe an account or key is compromised. 9. HOW LONG WE KEEP INFORMATION Account and billing records are kept for the subscription and then for up to seven years, or longer if tax law, a dispute, or a legal duty requires it. Those records are not part of a preservation download. Lead document uploads are deleted about 90 days after upload, whether or not the subscriber has downloaded them, unless Section 9.1 applies. About seven days before that deletion, we email a warning when the product is set to do so. That warning is not sent while Section 9.1 applies. If we cannot confirm whether Section 9.1 applies, we do not delete the files and we do not send the warning. Lead document collection is optional and subscriber-controlled. The portal and MMS document storage stay off until a workspace administrator chooses Collect documents and accepts the product acknowledgment. If the subscriber chooses Do not collect documents, or has not decided, we do not offer upload links and we do not store inbound MMS media as lead documents. The product may show a per-file retention countdown and an append-only activity log of uploads, previews, downloads, and retention events for that workspace. That log is part of the Services record for the subscriber. A standard subscription does not include a subscriber-set retention schedule. The subscriber is responsible for keeping its own official file. Route It AI is not the subscriber's archive of record. Court reporting files a subscriber purges from the exhibit vault through the product, and files the subscriber deletes in a connected OneDrive folder, are deleted permanently. We cannot restore them. A preservation request blocks a purge that Route It AI itself runs. It does not stop the subscriber from deleting files directly in Microsoft. Security logs are kept only as long as needed for security, fraud prevention, and debugging. Employee assistant documents and knowledge bank files stay until the subscriber deletes them or the account is closed, except while Section 9.1 pauses deletion Route It AI runs. When a subscriber closes an account, we delete or de-identify End-User Data associated with that workspace on the timetable in the product, except for records we must keep for tax, security, disputes, or legal process, and except while Section 9.1 applies. Closing an account starts with a confirmation link that expires in 72 hours. After that link is used, the workspace is scheduled for deletion in 30 days. We will not start a new account-deletion schedule while Section 9.1 applies. A deletion that was already scheduled is not cancelled by a preservation request, and we will not finish that purge while Section 9.1 applies. 9.1 Preservation requests A workspace admin may send a preservation request from workspace settings, with an optional note to CSG. Sending the request pauses deletion for that organization immediately. While the request is pending or has been accepted, we do not run the lead-document deletion, the warning email, a new account-deletion schedule, an exhibit vault purge through the product, or the vault expiry job. The workspace is shown only this sentence: "Your preservation request is pending." We do not email the organization that a request was accepted, rejected, or ended, unless a CSG owner chooses to send the download link in Section 9.2. A CSG owner may accept the request, reject it, or end an accepted hold. Accept keeps deletion paused. Reject, or ending the hold, lets the ordinary schedule resume. Files already past their retention period may be deleted on the next run. The organization does not control that decision by downloading or by staying silent. A preservation request is not a court order. If a court, a regulator, or other legal process requires us to keep records, we follow that process even if the subscriber has downloaded a copy or asked us to delete. 9.2 A copy of records, when a CSG owner prepares one While a request is accepted, or after a hold has ended if a copy was already prepared, a CSG owner may prepare a download of records Route It AI holds for that organization. The download includes the organization profile, team, leads, and chat transcripts, plus files Route It AI can still read, up to the size the product can package. The file list inside the download names what was left out and why. Files that live only in the subscriber's OneDrive, and call recordings that remain with the phone provider, are listed and are not inside the file. The CSG owner may download that copy. If the owner sends a link to the organization, the link expires 30 days after the copy was prepared. Sending again turns off the earlier link. The product records whether the link was sent and whether it was downloaded. That record is visible to the CSG owner on the preservation page and in the legal audit log. It is not a promise that every file in every system outside Route It AI is included. The owner may end the hold without waiting for a download. 10. PRIVACY REQUESTS 10.1 End users of a subscriber If you used a firm's, agency's, or other subscriber's Route It AI widget, phone line, or form, that subscriber decides the purpose of your information. Please send access, correction, and deletion requests to that organization first. If you contact us, we will ask which subscriber you mean, and we will either direct you to them or help them complete the request. We will not delete a subscriber's client file against the subscriber's instructions when the law or a professional duty requires the subscriber to keep it. 10.2 People whose information we control If we collected your information directly (for example, you created a Route It AI account or emailed us), you may email legal@routeit.ai. Depending on your state, you may have the right to know, access, correct, delete, and obtain a copy of personal information, and to appeal a denial. You will not be charged a different price, and you will not be denied the Services, for making a request. We will verify the request. We may ask for information that matches our records. An authorized agent may submit a request for a California resident if the agent provides proof of authority and, where the law allows us to ask, the resident verifies their identity. We respond within 45 days, and we may extend that period once when the law allows, after we tell you why. We may decline a request when the law says we may, including when we must keep a record for security, a transaction you asked for, a legal claim, or tax records. 10.3 Appeals If we deny a request and your state provides an appeal, reply to our decision and write "Appeal" in the subject line. If you are not satisfied, you may contact your state attorney general. 10.4 We do not sell or share for advertising We do not sell personal information for money. We do not share it for cross-context behavioral advertising. You do not need to opt out of a sale or a share, because we do not do either. If that changes, we will update this Policy and provide the opt-out the law requires before the change. 11. CHILDREN The Services are built for businesses and their adult staff. We do not knowingly collect personal information directly from children under 13, and we do not market the Services to children. A subscriber may still receive information about a minor because a parent, guardian, or the subscriber includes it in an intake or a legal matter. That information is End-User Data handled under the subscriber's instructions and professional duties. If you believe a child under 13 submitted personal information to us directly, email legal@routeit.ai and we will delete it. 12. INTERNATIONAL PROCESSING CSG is in the United States. Our providers may process information in the United States and in other countries where they operate. Those countries may not provide the same privacy rights as your home country. If you are in the European Economic Area, the United Kingdom, or Switzerland, and you have an account with us directly, you may request access, correction, deletion, restriction, or a copy by emailing legal@routeit.ai, subject to the limits in the law. End users of a subscriber should contact that subscriber, which is the controller. 13. CALIFORNIA NOTICE This section is the notice at collection for California residents. In the last 12 months we have collected, for the purposes in Section 3, these categories: identifiers (name, email, phone, IP address, account ID); customer records (billing contact, organization, role); commercial information (plan, invoices, payment status); internet activity (session and security logs, widget interactions); audio and electronic messages (call recordings, texts, and chats where those features are used); professional information (staff role, department, and position); and inferences drawn only to classify and route an inquiry for the subscriber. We do not collect precise geolocation from a device GPS. A person may type a city, venue, or address. Sources are the person, the subscriber, the subscriber's staff, and automatic logs. We disclose the categories in Section 5 to the service providers and destinations listed there. We do not sell or share personal information as those terms are defined in the California Privacy Rights Act. We do not use or disclose sensitive personal information for purposes other than providing the Services, security, and legal compliance. We do not offer financial incentives for personal information. California rights, including to know, delete, correct, and not to be discriminated against, are in Section 10. Contact legal@routeit.ai. You may also use an authorized agent as described there. 14. OTHER U.S. STATE LAWS Residents of states with consumer privacy laws, including Colorado, Connecticut, Virginia, Texas, Oregon, and others that apply to our activities, may use Section 10. Some of those laws exempt data we process only as a service provider. Florida's Digital Bill of Rights is aimed at very large platforms and at controllers that meet its thresholds. Even where a statute does not force us to honor a request, Section 10 is how we will handle a verified request about information we control. 15. CHANGES We may update this Policy. The Last Updated date will change when we do. If a change materially affects subscribers, we will give notice by email or in the workspace before it takes effect, and we may require the workspace to accept the updated Policy before intake and AI features continue. The prior version stays available to the subscriber through the acceptance record in the workspace. 16. CONTACT Constant Strategy Group LLC Product: Route It AI Florida, United States Privacy and legal requests: legal@routeit.ai Security reports: security@routeit.ai Billing: billing@routeit.ai A postal address for formal notices is available on request at legal@routeit.ai.

California Privacy Rights (CCPA)