Legal

Privacy Policy

How B2B Auto Loop Collects, Uses, and Protects Personal Information

Version

v06

Effective

Effective on launch

Last updated

October 29, 2026

1. Who This Policy Covers

This Privacy Policy explains how B2B Auto Loop, LLC ("BAL," "we," "us") collects, uses, and shares personal information. It applies to three groups of people:

• Visitors to our website who browse www.b2bautoloop.com but have not signed up for anything.
• Our Customers, the businesses and agencies that sign up for and use the platform, and their authorized users.
• Recipients, the people a Customer researches or contacts using our tools. If you received an email or a short AI-generated video, visited a personalized page, or spoke with an AI assistant on a business's page, you are most likely in this group. You did not sign up with us and may have no direct relationship with us. Sections 9 and 10 explain how to stop messages and how to ask about your information.

2. Our Two Roles

Who is responsible for personal information depends on whose data it is and who decides how it is used.

3. Information We Collect and Where It Comes From

3.1 Recipient data

For recipients, the Service processes these categories:

• Prospect details: name, job role or title, company, and business email address.
• Signals: public business facts used to personalize a message, such as hiring, funding, or technology changes at the recipient's company.
• Outreach content: the emails, scripts and AI-generated clips created for the recipient, including a rendered video that greets the recipient by first name and may mention the recipient's company.
• View analytics: whether the recipient opened the personalized page, played the video, how long it played, what was clicked, a pseudonymous session identifier, and coarse location derived from the network address.
• Responses: replies, opt-outs, bookings, and, if the recipient starts an on-page conversation, the text of that conversation.

These come from the Customer, from public websites and directories, and from vetted data partners. We do not source or knowingly process sensitive categories (health, financial account numbers, government IDs and similar) for outreach.

3.2 Customer and website data

If you create an account, contact support, or use our site, we collect what you give us (name, email, company, billing details, the content of your inquiry) and standard usage and device information.

3.3 On-page conversations

If you start a conversation with the AI assistant on a Customer's page, we collect what you type or say after you accept the consent notice shown first. Spoken audio is converted to text and the audio is then discarded. It is not kept as a recording and is not used to create a voiceprint.

4. How We Use Information

We use information to provide, operate and improve the Service; generate AI outreach content (presenter video, voice, and email) on a Customer's behalf; send text messages only to people who supplied their number and asked to receive them; process payments; provide support; comply with legal obligations; and detect and prevent fraud or abuse.

4.1 AI model training and data pooling

We may use information in de-identified or aggregated form to train, tune and improve our models and our cross-Customer knowledge base, using the de-identification process in our Master Subscription Agreement. A statistic from pooled data is used only when it covers at least 30 people across at least 3 Customers. We keep pooled data de-identified and do not try to re-identify it, except to test our de-identification process. You may opt out by emailing privacy@b2bautoloop.com or through our Privacy Center at www.b2bautoloop.com/legal/privacy. We never use Digital Twin face or voice data for this purpose (Section 6).

4.2 Connecticut AI training disclosure

If you are located in Connecticut: we collect and use personal data to train our artificial intelligence models and to improve the Loop Score and related scoring systems. You may opt out at www.b2bautoloop.com/legal/privacy or by emailing privacy@b2bautoloop.com with the subject line "Opt Out of AI Training." We will process your request within 30 days. The opt-out does not apply to uses needed for ordinary Service operation or to properly de-identified data.

4.3 Loop Score

The Loop Score is an automated tool that looks at engagement signals, such as page visits, video views, clicks and replies, to estimate how likely a recipient is to respond. It is used to prioritize outreach and may be shown to Customers as a priority metric. It does not use face or voice data. Whether or not it falls within California's automated decisionmaking regulations (Cal. Code Regs., tit. 11, § 7200 et seq.), we give everyone these choices:

1. Opt out. Ask us to exclude your data from the Loop Score engine at www.b2bautoloop.com/legal/privacy or at privacy@b2bautoloop.com. We will stop generating a score about you.
2. Explanation. Ask how the score works and what contributed to it. We will explain the categories of data, the general method and the factors, and keep model weights as trade secrets.
3. Correction. Ask us to correct behavioral data about you that is wrong or incomplete.
4. No discrimination. We will not treat you differently for using these choices.

4.4 No sale, no sharing

We do not collect personal information to sell it, and we do not sell or share recipient personal information with third parties for their own commercial purposes. We share recipient data with sub-processors only to perform the Service (Section 7).

4.5 Conversation memory and script improvement

When you talk with the AI assistant on a Customer's page, we keep a written summary so the assistant can pick up where you left off. It stays within that Customer's account and is never shown to other Customers. We also use de-identified patterns from conversations to improve our AI scripts, through the process in Section 4.1. The consent notice shown before any conversation describes both uses. You can decline, or later ask us to delete your conversation history, at www.b2bautoloop.com/legal/privacy or privacy@b2bautoloop.com.

5. AI-Generated Presenter Videos

Some outreach includes a short video with an AI-generated presenter. Here is how that works.

• What you see. The presenter is generated by AI. It is not a real person. Every such video carries a label on screen, "AI-generated presenter. No human performer is depicted.", and the email that links to it says "Includes a short AI-generated video." A Digital Twin video of a real person who has consented carries a different label that names that person and says the video is used with permission, and the same email line. The file also carries machine-readable markings that identify it as AI-generated.
• What goes into it. The script is written from the signals in Section 3.1. The voice is synthetic. The clip may speak your first name and mention your company.
• Who renders it. Stock-presenter videos may be rendered by BAL or by third-party rendering providers that act as our service providers. BAL may change rendering providers, and a new provider follows the 30-day notice in Section 7. We send a rendering provider only the script audio and the stock presenter image. We do not send recipient email addresses, and we give a provider no right to use what we send beyond rendering the clip for us. Provider categories are listed in Section 7. Digital Twin videos are not rendered by these providers (Section 6).
• What we do not do. We do not capture a recipient's face. We do not build a voiceprint of a recipient. We do not authorize any provider to use a recipient's personal information for purposes of its own.
• Where it is kept. The rendered clip is stored on our delivery network and served through a link on the Customer's personalized page. Section 8 says how long we keep it.

6. Voice, Avatar, and Likeness Data (Digital Twin)

If a Customer records a real person's face or voice to create a Digital Twin avatar or voice clone, we treat that data as its own protected category. It may be biometric data under laws such as the Illinois Biometric Information Privacy Act, and we handle it that way.

6.1 Consent first

Before any recording, the person completes an identity and liveness check, reads a standalone consent screen, and records a spoken consent statement on camera. The consent screen says what is collected, why, how long we keep it, and how to ask for deletion. An employer's permission does not replace the person's own consent. We keep the consent record for as long as we hold the data plus two years.

6.2 Where it is processed

Digital Twin face and voice data is processed only on infrastructure that BAL controls, in specific United States data centers in North Carolina, Texas and Washington that we will pin for this work before any Digital Twin processing begins. These data centers hold SOC 2 Type II and ISO 27001 certifications. It is never sent to the third-party providers that render stock-presenter videos. The only exceptions are the identity and liveness check in Section 6.1, which an identity verification provider listed in Section 7 performs (this is the one exception to BAL-controlled infrastructure, and we set the check to be processed in the United States), and the optional image tool in Section 6.6, which needs the person's separate, express agreement. A Digital Twin is available on Growth and Scale only; Launch accounts choose from our stock presenters. A Digital Twin is never built for, or used by, anyone other than the Customer the person agreed to, without fresh consent. Our confidential Data Processing Addendum lists the providers involved.

6.3 No training

We do not use Digital Twin face or voice data to train shared or cross-Customer models, and no third party may use it to train a model. We do not sell, license or resell a Digital Twin or voice model. We do not use it in the Loop Score.

6.4 Retention and destruction

We permanently delete a person's face and voice data, including voice-clone training data, at the earliest of: (a) the purpose being satisfied, which means the Digital Twin is permanently removed or replaced and the old model destroyed (pausing a campaign does not count); (b) three years after the person's last interaction with the Service; or (c) 30 days after the person withdraws consent, leaves the Customer's organization, or the Customer's relationship with us ends. This covers source footage, voice and face models and rendered clips. Deletion is secure erasure, not just hiding the file. Encrypted backup copies are not restored and expire on a rolling schedule within 30 more days, so nothing remains in any backup more than 60 days after the trigger. Our published retention and destruction policy is at www.b2bautoloop.com/legal/biometric.

6.5 Withdrawal and departure

A person can withdraw consent at any time at privacy@b2bautoloop.com. A Customer must tell us at once if the person leaves its organization. When we receive either notice, we stop using the Digital Twin and disable live links to videos that use it right away, and we delete the source footage, voice model and rendered clips within 30 days.

6.6 Optional image tool

Optional outfit changes to a person's image run on our own models by default. Only if the person separately and expressly agrees during setup do we send a still image to a third-party cloud AI provider, which processes it only to perform the Service for us and may not use it to train its models without our permission. That provider never receives voice data. The person can withdraw this agreement at any time at privacy@b2bautoloop.com.

6.7 Under 18

We do not knowingly create a voice clone or Digital Twin of anyone under 18, whoever asks.

7. Who Processes Your Information

We use third-party providers to run the Service. We require each one by contract to process personal information only to perform the Service for us and to protect it with appropriate security. We do not name them in this public policy. Our Customers receive the full list, with data categories, purposes and locations, in our confidential Data Processing Addendum. Recipients can ask us which categories handle their data at privacy@b2bautoloop.com.

8. Data Retention

We keep information only as long as we reasonably need it for the purposes in this policy. This table is the single retention schedule for BAL. The Master Subscription Agreement v04, the Data Processing Addendum v04 and Schedule A: Tenant Responsibilities v01 point to it.

We may keep some information longer where the law requires it or to resolve a dispute.

9. Opt-Out, Suppression, and Deletion

If you do not want to hear from a Customer using our platform, here is what happens.

1. You opt out. Click the unsubscribe link in any email, reply STOP or "unsubscribe", use our Privacy Center at www.b2bautoloop.com/legal/privacy, or email privacy@b2bautoloop.com. You do not need an account.
2. Suppression takes effect at once. We add you to our platform-wide suppression list, which applies to every Customer. No further messages go to you from the platform, your personalized page and video link stop working, and your Loop Score is cleared.
3. Purge within 30 days. We delete the rendered clips, cached copies, page assets, logs, view analytics and conversation records we hold about you. We keep only the minimum suppression record and any consent records the law requires.
4. Full deletion on request. If you ask us to delete your information, we also delete your contact record and tell the Customer, so it can delete the copies it holds. A Customer is responsible for any copies it exported from the platform.
5. Customers can delete too. A Customer can delete a lead, a campaign or a clip from its dashboard, and the clip is removed from our delivery network.

We respond to requests within 45 days. We may verify your identity first, for example with a code sent to your email.

10. Recipient Rights and Requests

You have rights over information we hold about you even though you never signed up with us. Because the Customer that contacted you decides why and how your information is used, it is often the best first contact, and you can ask it directly. You can also ask us. When we hold your information as the Customer's processor, we suppress and delete it as Section 9 describes, and we pass requests to know or correct to the Customer where the law treats the Customer as responsible, and tell you we did. Where we hold your information as the business, we answer the request ourselves.

• Know. What we hold about you, its categories and sources, why we collected it, and the categories of third parties we share it with.
• Delete. We will delete what we hold about you, keeping only the minimum needed to honor a future do-not-contact request.
• Opt out of pooling and model training. Email privacy@b2bautoloop.com with the subject line "Opt Out of Data Pooling." We offer this to everyone.
• Opt out of sale or sharing. We do not sell or share personal information, and we honor the Global Privacy Control browser signal.
• No retaliation. We will not deny service, charge different prices, or lower service quality because you used these rights.
• Appeals. If we decline your request, you may appeal by emailing privacy@b2bautoloop.com with the subject line "Appeal." We will answer in writing within 45 days and, where your state's law provides, tell you how to contact your state attorney general.

11. Cookies and Tracking

We use cookies and similar technologies on our website and on pages delivered through the Service. See our Cookie Policy at www.b2bautoloop.com/legal/cookies for categories, purposes and how to manage them. Our emails do not use open-tracking pixels or link-tracking redirects. Engagement is measured on the personalized page.

12. International Transfers and the EU and UK

• Where we process. BAL is a United States company. We store Customer Data in the United States and use best-effort controls to keep processing primarily in the United States. Encrypted backups are stored in a bucket created with the provider's United States jurisdictional restriction; providers may process account and network metadata elsewhere. Some providers, such as global edge delivery, real-time media, live avatars, text messaging and payments, may process data elsewhere, as the categories in Section 7 and our confidential Data Processing Addendum v04 show. Before any Digital Twin processing begins, we will confine Digital Twin biometric data and its backups to the pinned United States infrastructure described in Section 6.2. Some lookup providers are established or host data in the EU or UK. We send only the name, company and domain of U.S. business contacts, to find a business email address. Customers are responsible for having a lawful basis to contact their recipients and for not targeting EEA, UK or Swiss recipients.
• Who the Service is built for. The Service is offered to recipients in the United States only. We exclude recipients in the European Union, the European Economic Area, the United Kingdom and Switzerland when we source contacts, we require Customers not to upload or target them, and we may geo-gate or block them. We have not yet adopted the transfer mechanisms those regions require, so we offer no processing of their data until we do. For recipients elsewhere, such as Canada, the Customer is responsible for complying with local law or must not send.
• If your data reaches us anyway. If you are in the EU, the UK or Switzerland and your information reaches us, you have the right to access, delete, move, restrict or object to our use of it, and not to be subject to a decision based solely on automated processing. Contact privacy@b2bautoloop.com. Where those laws require a transfer mechanism, we put one in place before we process that data, and until then we do not offer the Service for recipients in those regions.
• AI transparency. Our AI-generated presenter videos carry machine-readable markings, in line with AI transparency rules in the EU and elsewhere.

13. Children's Privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under that age. We never knowingly create a voice clone or Digital Twin of anyone under 18. If you are under 18 and believe we hold your information, email privacy@b2bautoloop.com and we will delete it.

14. Your Rights by Location

Depending on where you live, you may have the right to know what we hold about you, get a copy, correct it, delete it, opt out of sale, sharing or targeted advertising, opt out of certain automated decisions, and not be treated differently for using these rights. Everyone can use the choices in Sections 4.3, 9 and 10, wherever they live.

15. Changes to This Policy

We may update this policy from time to time. We post the updated version here with a new effective date. For material changes, such as new categories of data or uses, new sub-processors, changes to retention, or new rights or opt-outs, we give additional notice, such as an email to Customers, as our Master Subscription Agreement provides. New sub-processors follow the 30-day notice in Section 7.

16. Contact Us

B2B Auto Loop, LLC — Delaware limited liability company — Principal place of business: Cleveland, Ohio

Privacy inquiries: privacy@b2bautoloop.com | Privacy Center: www.b2bautoloop.com/legal/privacy | Terms: www.b2bautoloop.com/legal/terms | Acceptable Use Policy: www.b2bautoloop.com/legal/aup | Biometric policy: www.b2bautoloop.com/legal/biometric | Cookie Policy: www.b2bautoloop.com/legal/cookies | Provider categories: www.b2bautoloop.com/legal/subprocessors