Follow Up Ace (Ace AI) Privacy Policy

Last updated: June 30, 2026

Version: 3.1

This Privacy Policy describes how Moon Sherpa Labs ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use Follow Up Ace (also referred to as "Ace AI"), our AI-powered real estate CRM assistant provided as an embedded application within the Follow Up Boss CRM platform (the "Service"). This policy applies to all users who access the Service, including embedded app users, administrators, and any individual whose data is processed through the Service.

By accessing or using the Service, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

1. Information We Collect

We collect the following categories of information in connection with the Service:

1.1 Account Information

When you access the Service through Follow Up Boss, we receive and process your account information, including:

• Your name, email address, and phone number as provided by Follow Up Boss
• Your Follow Up Boss user ID and account identifiers
• Your role and permissions within your Follow Up Boss organization
• Your subscription plan type and billing status

1.2 CRM Contact Data

Through the Follow Up Boss API integration, the Service accesses and processes CRM data to provide AI-powered assistance, including:

• Contact records (names, email addresses, phone numbers, addresses)
• Lead information, source data, and tags
• Communication history (notes, call logs, email interactions)
• Deal and transaction information
• Custom fields and pipeline data

1.3 Usage Data

We automatically collect information about how you interact with the Service, including:

• Messages sent to and received from the AI assistant
• Features and tools used within the Service
• Session duration and frequency of use
• Navigation patterns within the application
• Errors encountered and performance data

1.4 Device and Browser Information

When you access the Service, we collect technical information, including:

• IP address
• Browser type and version
• User agent string
• Operating system
• Screen resolution and device type
• Timestamp of access

1.5 Voice Assistant Data

If you use the in-app AI voice assistant, your microphone audio is streamed in real time to ElevenLabs Conversational AI (for voice activity detection, speech-to-text, and text-to-speech) and to our AI to generate a synthesized spoken response. In this process we handle:

• Voice audio, streamed in real time for speech-to-text conversion (not deliberately recorded or stored)
• Transcriptions of what you say, used to generate the AI response
• Voice Activity Detection (VAD) signals used for session management

This is an in-app assistant, not a telephony or outbound-calling service. We do not deliberately record or store voice audio — it is processed in real time and discarded. See Section 6 (Data Retention) for details.

1.6 Payment Information

When you subscribe to a paid plan, payment information is collected and processed by our payment processor, Stripe. We do not directly collect, store, or have access to your full credit card numbers, debit card numbers, or bank account details. We receive from Stripe:

• Last four digits of your payment method
• Payment method type (e.g., Visa, Mastercard)
• Billing address
• Transaction history and subscription status

1.7 Gmail Data

If you authorize Gmail integration via OAuth, we may access:

• The ability to send emails on your behalf through the Service
• Calendar data for scheduling-related features
• Email metadata necessary for Service functionality

Gmail data access is limited to the scopes you explicitly authorize. We do not read, scan, or store the contents of your personal emails beyond what is necessary to perform the specific action you request (such as sending an email to a contact).

1.8 Cookie and Local Storage Data

We use cookies and browser local storage to maintain:

• Session authentication tokens
• User preferences and settings
• Agreement and consent records
• Feature configuration data

See Section 9 (Cookies and Tracking) for more detail.

1.9 AI Conversation History

We store the content of your interactions with the AI assistant, including:

• Text messages you send to the AI
• AI-generated responses
• Tool calls and function results during conversations
• Conversation metadata (timestamps, session identifiers)

1.10 Zillow Lead Data

If your account has Zillow integration enabled, we may process:

• Zillow lead information synced through Follow Up Boss
• Lead source and inquiry details
• Speed-to-lead metrics and response data
• Engagement and lifecycle stage data

1.11 Ace Trove Analytics and Derived Data

Ace Trove (our account-wide AI intelligence add-on, formerly known internally as "AI Engine" / "Ace Intelligence") generates and stores derived data from your CRM and analytics signals, including:

• Contact engagement and intent scores (0–100, organized into tiers)
• Agent accountability and "slip" responsiveness scores
• Machine-learning predictions from models that score contacts and generate predictive insights, such as scoring and forecasting across contacts, deals, and pipeline
• Summarized engagement signals used by these models
• Workflow execution and automated-action history

1.12 Ace Chrome Bridge Extension Data

The Ace Chrome Bridge is an optional Chrome browser extension, available on paid (Pro) seats, that you choose to install. When installed and signed in, it captures the communication history you are already viewing in your own Follow Up Boss account — the summaries of calls, and the content of text messages and emails — along with associated timestamps, direction, and participant names, so that your Ace assistant can reference the full content of those conversations. Follow Up Boss's own API does not expose this message content to connected tools, so the extension reads only what you can already see on-screen in Follow Up Boss.

• Your own account only. Captured records are sent solely to your own Follow Up Ace account. They are never sold, never shared with third parties for their own purposes, never used for advertising, and never used to determine creditworthiness or for lending.
• Not used to train models. Bridge-captured content is not used to train any third-party AI model, and is used only to power your own assistant — it is excluded from the cross-account, de-identified model training described in Section 2.
• You are in control. You can turn capture on or off per channel (calls, texts, emails), pause it at any time, or remove it entirely by uninstalling the extension. It runs only on followupboss.com pages and communicates only with followupace.com.
• Retention. Bridge-captured records follow your account's data-retention policy and are deleted on the same terms as your other Follow Up Ace account data.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Maintain the Service: To deliver the core functionality of Follow Up Ace, including AI-powered chat, voice features, CRM analysis, contact management, and workflow automation.
• Process AI Chat Requests: To send your messages and relevant CRM context to third-party AI providers (OpenAI, Anthropic, and/or Google) for generating AI responses. See Section 3 (AI Data Processing Disclosure) for important details.
• Improve Service Quality and Features: To analyze usage patterns, identify issues, and develop new features and improvements to the Service.
• Send Service Communications: To deliver important notices about the Service, including updates, security alerts, billing notifications, and support messages.
• Process Payments: To manage subscriptions, process billing, and handle payment-related inquiries through our payment processor, Stripe.
• Analytics and Usage Patterns: To understand how the Service is used, measure performance, and generate aggregate usage reports for improving the product.
• Fraud Prevention and Security: To detect, prevent, and address fraud, unauthorized access, technical issues, and other security threats.
• Comply with Legal Obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

We also process your CRM and analytics data for analytics, machine-learning scoring, and predictive profiling (including mirroring it into our cloud-based data warehouse and analytics environment described in Section 3A) to power Ace Trove. We disclose these purposes at or before the point of collection and will not retain personal information longer than reasonably necessary for the disclosed purpose.

3. AI Data Processing Disclosure

The Service uses artificial intelligence to provide its core functionality. It is important that you understand how your data is processed by AI systems:

3.1 Third-Party AI Providers

When you interact with the AI features of the Service, your messages and relevant contextual information (such as CRM contact data pertinent to your query) are sent to one or more of the following third-party AI providers for processing:

• OpenAI (OpenAI, L.L.C.) — Privacy Policy
• Anthropic (Anthropic, PBC) — Privacy Policy
• Google (Google LLC / Alphabet Inc.) — Privacy Policy

Each of these providers has its own privacy policies governing how they handle data received through their APIs. We encourage you to review their respective privacy policies.

3.2 API-Level Access

We access these AI providers exclusively through their API (Application Programming Interface) services, on data-processor terms — for Google, the paid Gemini API / Vertex AI. Under our agreements with these providers, your data is contractually excluded from use in training their foundation models. Data sent through these APIs is processed for generating responses and is subject to the providers' data retention and security practices for API usage.

3.3 What Data Is Sent to AI Providers

When you use the AI features, the following data may be sent to the AI provider:

• Your message or query text
• Relevant CRM contact information needed to answer your question
• Conversation history within the current session for context continuity
• System instructions that define how the AI should respond (these do not contain your personal information)

3.4 Conversation Data Retention

We retain conversation history on our servers to provide service functionality, including conversation continuity, reference to past interactions, and service improvement analytics. You may request deletion of your conversation history at any time by contacting us (see Section 13).

3A. Ace Trove: Data Warehouse, Machine Learning, and Automated Profiling

Ace Trove is our account-wide AI intelligence and operations layer (formerly known internally as "AI Engine" / "Ace Intelligence"). This section explains how Ace Trove processes your data, the machine-learning models it runs, and the rights you have over automated profiling.

3A.1 Data Warehouse

To power Ace Trove analytics, scoring, and predictions, CRM and analytics data is mirrored from our primary database into a cloud-based data warehouse and analytics environment. The cloud infrastructure provider that hosts this environment is a sub-processor. Warehouse data is used solely to provide the Service to your Account; it is not sold, and, under our agreements with these providers, it is contractually excluded from use in training their foundation models.

3A.2 Predictive Models

Ace Trove uses machine-learning models that score contacts and generate predictive insights — such as scoring and forecasting across contacts, deals, and pipeline to help prioritize attention, estimate a contact's likelihood to transact, and surface early signals that a lead or deal may be at risk so team leads can act before revenue is lost.

These predictions are probabilistic and advisory. They can be wrong, may reflect incomplete data, and must not be treated as guarantees.

3A.3 Model Input Signals

Ace Trove summarizes the engagement signals (such as recency, frequency, and channel of interactions) used by the predictive models and scoring logic. These signals are derived from your CRM and analytics data and are retained while your Account is active.

3A.4 Automated Profiling and Scoring

Ace Trove performs automated profiling, including contact intent scores (0–100, organized into tiers) and agent accountability and slip scores. We disclose this automated decision-making for transparency. These outputs are advisory and are not solely-automated decisions that produce legal or similarly significant effects on individuals; they inform prioritization and do not make final determinations about any person.

3A.5 Your Right to Human Review and to Opt Out of Ace Trove Profiling

Even though Ace Trove profiling is advisory, you have the right to:

• Request human review of any automated score, prediction, or assessment by contacting us at [email protected].
• Opt out of Ace Trove profiling at the account level. Opting out stops future automated analysis. It does not retroactively remove scores already written to your Follow Up Boss custom fields, which you can manage in your CRM.

4. Information Sharing and Disclosure

We share your information with the following categories of third parties, and only as described below:

4.1 Third-Party AI Providers

As described in Section 3, user messages and relevant context are shared with OpenAI, Anthropic, and/or Google for AI processing. The specific provider used may depend on your account configuration or the nature of your request.

4.2 Follow Up Boss

The Service operates as an embedded application within Follow Up Boss. Data is exchanged with Follow Up Boss as necessary for CRM integration, including reading contact records, updating fields, creating notes, and other CRM operations you initiate through the Service.

4.3 Stripe

Payment processing is handled by Stripe, Inc. When you subscribe to a paid plan, your payment information is collected and processed directly by Stripe in accordance with Stripe's Privacy Policy.

4.4 ElevenLabs

The in-app AI voice assistant is powered by ElevenLabs, Inc. When you use the voice assistant, your microphone audio is streamed to ElevenLabs in real time for voice activity detection, speech-to-text, and text-to-speech, in accordance with ElevenLabs' Privacy Policy. Voice audio is processed in real time and is not deliberately recorded or stored, and, under our agreement with ElevenLabs, your data is contractually excluded from use in training its models.

4.4a Twilio

SMS notifications (such as appointment follow-up texts and workflow/admin alerts) may be powered by Twilio, Inc. Phone numbers and SMS metadata are processed by Twilio in accordance with Twilio's Privacy Policy. Twilio is used for SMS only, not voice.

4.5 Firebase / Google Cloud

Our infrastructure is hosted on Google Cloud Platform and Firebase (Google LLC). User data, conversation records, and application data are stored on Firebase/Google Cloud infrastructure in accordance with Firebase's Privacy and Security documentation. To power Ace Trove analytics, scoring, and predictions, CRM and analytics data is also mirrored into a cloud-based data warehouse and analytics environment hosted on this infrastructure. Data in the warehouse is used solely to provide the Service to your Account; it is not sold, and, under our agreements with these providers, it is contractually excluded from use in training their foundation models.

4.6 Gmail

If you have authorized Gmail integration, the Service may interact with Gmail APIs on your behalf to send emails or access calendar data. This access is limited to the scopes you explicitly authorize and follows Google API Services User Data Policy.

4.7 Analytics Providers

We may use third-party analytics services to help us understand usage patterns and improve the Service. These providers may collect de-identified or aggregated usage data.

4.8 Legal Requirements and Law Enforcement

We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we have a good faith belief that disclosure is reasonably necessary to:

• Comply with applicable law, regulation, or legal process
• Protect the rights, property, or safety of Moon Sherpa Labs, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues
• Respond to a lawful request by public authorities, including national security or law enforcement requirements

4.9 Business Transfers

If Moon Sherpa Labs is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice within the Service prior to your information being transferred and becoming subject to a different privacy policy.

5. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contractual Necessity: Processing is necessary for the performance of our contract with you to provide the Service.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving the Service, ensuring security, and preventing fraud, provided these interests do not override your fundamental rights and freedoms.
• Consent: Where you have given explicit consent to specific processing activities (such as Gmail integration or voice chat).
• Legal Obligation: Processing is necessary to comply with applicable legal requirements.

6. Data Retention

We retain your information for the following periods:

We will not retain personal information longer than reasonably necessary for the purpose for which it was collected. When data is no longer required for the purposes described in this policy, we will securely delete, de-identify, or aggregate it. In some cases, we may retain de-identified or aggregated data that can no longer identify you for analytical purposes.

Deletion and the data warehouse. On a verified deletion request, we erase, de-identify, or aggregate the affected data across our active systems — including our data-warehouse and analytics environment and its historical change data — and direct our sub-processors to do likewise. The active analytics environment is treated as a live, actively-queried system, not a "backup," and is included in deletion. Only genuine cold backups, which are not actively queried, follow a delete-on-cycle schedule and are overwritten in the ordinary course.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to Access: You have the right to request a copy of the personal information we hold about you, including conversation history, account data, and usage records.
• Right to Correction: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
• Right to Deletion: You have the right to request that we delete your personal information, subject to certain exceptions required by law (such as data we must retain for legal compliance or legitimate business purposes).
• Right to Data Portability: You have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Opt Out of Analytics: You may request that we cease collecting analytics data about your usage of the Service.
• Right to Restrict Processing: In certain circumstances, you have the right to request that we restrict the processing of your personal information.
• Right to Object: Where we process your data based on legitimate interests, you have the right to object to such processing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Opt Out of Ace Trove Profiling: You have the right to opt out of Ace Trove's automated profiling and scoring at the account level. Opting out stops future automated analysis but does not retroactively remove scores already written to your CRM custom fields.
• Right to Human Review: You have the right to request human review of any automated Ace Trove score, prediction, or assessment by contacting us.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request. In some cases, we may not be able to fully comply with your request, such as when it would affect the privacy rights of others or when we have a legal obligation to retain certain data. If we cannot fulfill your request, we will explain why.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

8.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, phone number, IP address, account identifiers
• Commercial Information: Subscription records, payment history, transaction details
• Internet or Electronic Network Activity: Browsing history within the Service, usage data, interaction records, device information
• Professional or Employment-Related Information: Real estate license information, brokerage affiliation (as provided through Follow Up Boss)
• Inferences: Usage patterns and preferences derived from the above categories, including Ace Trove contact intent scores, accountability/slip scores, and machine-learning predictions
• Audio Information: Voice recordings (temporary, for real-time processing only)

8.2 Your California Privacy Rights

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising purposes. Therefore, there is no need to opt out. However, if our practices change, we will update this policy and provide a mechanism to opt out.
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information, we use it only as necessary to provide the Service and for purposes permitted under the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or suggest any of these actions as a result of you exercising your rights.

8.3 Authorized Agent Requests

You may designate an authorized agent to make a request on your behalf. To do so, you must provide the authorized agent with written permission, and we may require you to verify your identity directly with us. An authorized agent may submit a request on your behalf by contacting us at [email protected].

8.4 "Do Not Sell or Share My Personal Information"

Moon Sherpa Labs does not sell your personal information as defined by the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising. We do not sell sensitive personal data or biometric personal data. Because we do not engage in these activities, we do not offer an opt-out mechanism for the sale or sharing of personal information. If our practices change in the future, we will update this Privacy Policy accordingly and provide appropriate opt-out mechanisms.

We honor Global Privacy Control (GPC) and other opt-out preference signals as a valid request to opt out of any sale or sharing of personal information, and we do not require you to verify your identity to honor an opt-out.

8.5 Texas and Other U.S. State Residents

Residents of Texas and other states with comprehensive privacy laws have rights including the right to access, delete, and correct personal information, data portability, the right to opt out of targeted advertising, sale, and certain profiling, the methods to submit a request (by email to [email protected]), and the right to appeal a denied request. Because we do not sell sensitive or biometric personal data, the Texas Data Privacy and Security Act (TDPSA) "NOTICE: We may sell your sensitive personal data" and biometric-sale notices do not apply and are intentionally omitted.

8.6 Financial Incentive Programs

We do not offer financial incentive programs that require the collection of personal information.

9. Cookies and Tracking Technologies

9.1 Essential Cookies and Storage

We use the following essential cookies and browser storage mechanisms that are necessary for the Service to function:

• Session Cookies: Used to maintain your authenticated session while using the Service.
• Authentication Tokens: Stored in local storage or cookies to verify your identity across requests.
• Agreement Status: Stored in local storage to record your acceptance of the Terms of Service and Privacy Policy.
• User Preferences: Stored in local storage to remember your settings and configuration choices within the Service.

9.2 Analytics Cookies

We may use analytics cookies to collect de-identified or aggregated information about how the Service is used. This information helps us understand usage patterns, identify issues, and improve the Service.

9.3 No Third-Party Advertising Cookies

We do not use third-party advertising cookies. We do not serve ads within the Service, and we do not allow third-party advertisers to place cookies or tracking technologies within the Service.

9.4 Managing Cookies

You can manage or delete cookies through your browser settings. Please note that disabling essential cookies may prevent the Service from functioning properly. Most browsers allow you to:

• View and delete existing cookies
• Block all cookies or only third-party cookies
• Set preferences for certain websites
• Clear cookies when you close the browser

For more information about managing cookies, visit your browser's help documentation.

10. Data Security

We take the security of your personal information seriously and implement appropriate technical, administrative, and organizational measures to protect it. These measures include:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security) / HTTPS protocols.
• Firebase Security Rules: Access to stored data is controlled through Firebase security rules that restrict data access based on authentication and authorization.
• Access Controls: Access to personal information is restricted to authorized personnel who need it to perform their job functions. We follow the principle of least privilege.
• Authentication Security: User authentication is handled through secure mechanisms including HMAC-signed context verification for embedded app users and Firebase Authentication for administrators.
• Regular Security Reviews: We periodically review and update our security practices to address emerging threats and vulnerabilities.
• Third-Party Security: We select service providers that maintain appropriate security measures and require them to protect your data through contractual obligations.

10.1 Incident Notification

If a breach affecting your personal information occurs, we will notify affected parties and applicable regulators without unreasonable delay and within the timeframes required by applicable law. Notification will include a description of the nature of the breach, the types of information involved, the steps we are taking to address the breach, and recommendations for steps you can take to protect yourself.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard protections.

11. International Data Transfers

Your information is primarily processed and stored in the United States on Google Cloud Platform / Firebase infrastructure. Moon Sherpa Labs operates in the United States and does not target or knowingly serve residents of the EU, EEA, or UK. By using the Service, you acknowledge and consent to the transfer and processing of your data in the United States. If we ever process EU/EEA/UK personal data, we would rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum where relevant).

Our third-party service providers may process data in various locations around the world. When your data is transferred internationally, we take steps to ensure that appropriate safeguards are in place, including:

• Using service providers that maintain adequate data protection standards
• Relying on contractual commitments from our providers regarding data protection
• Complying with applicable data transfer regulations

If you are located outside the United States, please be aware that the data protection laws in the United States may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

12. Children's Privacy

The Service is designed for use by real estate professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal information from a person under 18, we will take steps to delete such information from our systems promptly. If you believe that we may have collected information from a person under 18, please contact us at [email protected].

13. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications that are not owned or controlled by Moon Sherpa Labs. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices, content, or security of any third-party websites or services. We encourage you to review the privacy policies of any third-party sites or services before providing any personal information to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

• Minor Changes: Updated versions will be posted on this page with a new "Last Updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.
• Material Changes: For significant changes that affect how we collect, use, or share your personal information, we will provide at least 30 days' prior notice through the Service or via email before the changes take effect.
• Re-Consent: Where material changes significantly alter your rights or our obligations, we may require you to review and re-accept the updated Privacy Policy before continuing to use the Service.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. The version number and date at the top of this document indicate when it was last revised.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or our privacy practices, please contact us:

Moon Sherpa Labs
Privacy Inquiries
Email: [email protected]
Location: Texas, United States

We will make every effort to respond to your inquiry within 30 days of receipt.