Privacy Policy

Last updated: November 6, 2026
Effective date: November 6, 2026

This Privacy Policy explains how Ladoo ("Ladoo", "we", "us") collects, uses and shares personal information, and the choices and rights you have.

Summary

If you called a business and spoke with a Ladoo AI assistant, that business controls your information. Ladoo processes it on the business's behalf. Contact the business to exercise your privacy rights, or see Section 3.
If you use Ladoo for your business, or visit our website, Ladoo controls your account and website information as described in this policy.
We do not sell or share personal information for cross-context behavioral advertising.
We do not use call audio, transcripts or customers' workspace content to train AI models, and we configure our AI providers not to either.

Who this policy covers
Our two roles
Callers to businesses that use Ladoo
Information we collect
How we use information
Legal bases (EEA, UK and Switzerland)
AI and model training
How we share information
Cookies and analytics
How long we keep information
Security
International transfers
Your rights and choices
U.S. state privacy disclosures and Notice at Collection
Google and other sign-in providers
Connected CRMs (GoHighLevel)
Children
Changes to this policy
Contact us

1. Who this policy covers

This policy applies to:

Visitors to tryladoo.com and our other websites;
Customers and Users: people who sign up for, are invited to, or use the Ladoo dashboard (app.tryladoo.com), APIs and related services (the "Services"), including representatives of agencies and their clients;
Prospects who contact us or sign up for updates;
Callers who call a phone number answered by a Ladoo assistant, to the limited extent described in Section 3.

It does not cover the privacy practices of our customers, or of third-party services such as CRMs you connect to Ladoo.

2. Our two roles

Information	Ladoo's role	Whose policy governs
Account, billing, support, website and marketing information	Controller (GDPR) / business (U.S. state laws)	This policy
Customer Content: caller information, call audio, transcripts, summaries, extracted details, recordings (if enabled), CRM data, knowledge-base content, prompts and workflows	Processor / service provider, acting on our customer's instructions	The customer's privacy notice, and our Data Processing Addendum with the customer

Where an agency uses Ladoo to serve its own clients, the agency or its client controls Customer Content, and we act as a processor or subprocessor.

3. Callers to businesses that use Ladoo

When you call a business that uses Ladoo, the business decides how its AI assistant works and what happens to information from your call. The business is responsible for your information. We process it only to provide our service to that business, under a contract that limits how we may use it.

What is processed on a call. Your phone number and caller ID name; your voice, which is converted to text in real time; the assistant's replies; a transcript and summary; details you give (such as your name, reason for calling, callback number, and appointment details); call times and duration; and, if the business enables it, an audio recording. The assistant may look up and update your record in the business's CRM or calendar.

What we do not do. We don't sell your call information, use it for advertising, use it for our own purposes, combine it with other businesses' data, or use it to train AI models. We don't create voiceprints or identify you by your voice.

Your rights. To access, correct or delete information from a call, or for any other privacy question, contact the business you called. If you contact us at privacy@tryladoo.com instead, include the number you called and the phone number you called from. We will forward your request to the business if we can identify it, and tell you that we have done so.

Emergencies. Ladoo assistants cannot reach 911 or other emergency services. If you have an emergency, hang up and dial 911.

More about how Ladoo assistants work: How Ladoo Uses AI.

4. Information we collect (as controller)

Information you give us

Account information: name, email address, password-free sign-in links sent to your email, profile photo, workspace and business name, role, and the people you invite.
Business and verification information: legal business name, address, phone number, website, industry and, where carriers or law require it, information needed to verify your identity and business.
Billing information: billing contact, billing address and tax details. Payment card details are collected and stored by our payment processor, Stripe. We receive only limited details such as the card brand, last four digits and expiry date.
Communications: support requests, feedback, survey responses, and messages you send us, including attachments.
Marketing preferences, and information you give at events or in demo requests.

Information collected automatically

Device and usage information on our websites and in the dashboard: IP address, browser and device type, operating system, pages and features used, referring URLs, campaign (UTM) parameters, approximate location derived from IP, dates and times, and clicks and interactions. See Section 9.
Service and log information: sign-in events, API requests, errors, security events, and usage metrics such as call counts, minutes, phone number counts and AI message counts (used for billing and limits).

Information from third parties

Sign-in providers: if you sign in with Google or GitHub, we receive your name, email address, profile photo and account ID (see Section 15).
GoHighLevel: if you install Ladoo from the GoHighLevel Marketplace, we receive your agency or sub-account identifiers, business details and the name and email of the installing user.
Stripe: payment status, subscription status, and fraud-risk signals.
Business partners and public sources: information about businesses (for example from their websites) to verify accounts or prevent fraud.

Sensitive personal information. The only sensitive personal information we collect as a controller is account sign-in credentials, used only to authenticate you. We don't use sensitive personal information to infer characteristics about you.

5. How we use information

We use information we control to:

provide the Services: create and manage accounts and workspaces, authenticate users, provision phone numbers, and deliver features you request;
bill you: process payments, meter usage, calculate taxes and send invoices and receipts;
communicate: send sign-in links, invitations, service and security notices, billing and renewal notices, and support replies;
verify, secure and protect: verify identity and businesses as carriers require, detect and prevent fraud, spam, abuse and security incidents, enforce our Terms and Acceptable Use Policy, and respond to carrier traceback requests;
improve: understand how our websites and Services are used, fix bugs, and develop new features, using usage information (not call content);
market: send product updates and marketing emails (you can unsubscribe at any time), and measure the performance of our website and campaigns;
comply with law: meet tax, accounting and legal obligations, and respond to lawful requests;
for any other purpose we tell you about when we collect the information, or with your consent.

We do not use automated decision-making that produces legal or similarly significant effects about you. We may automatically flag accounts or traffic for fraud review, but a person reviews before we close an account for that reason.

6. Legal bases (EEA, UK and Switzerland)

Purpose (Section 5)	Legal basis
1. Provide the Services	Performance of a contract
2. Billing	Performance of a contract; legal obligation (tax and accounting)
3. Service, security and billing communications	Performance of a contract; legitimate interests (keeping you informed)
4. Verification, security, fraud prevention and enforcement	Legitimate interests (protecting our Services, customers, carriers and the public); legal obligation
5. Improving the Services (usage analytics)	Legitimate interests (improving our products); consent where required for cookies
6. Marketing	Legitimate interests (B2B marketing), or consent where required; you can object at any time
7. Legal compliance	Legal obligation; legitimate interests (establishing and defending legal claims)

Providing account and billing information is necessary to enter into our contract; without it we can't provide the Services.

7. AI and model training

Ladoo uses AI providers (listed on our Subprocessors page) to convert speech to text, generate assistant replies and summaries, and produce synthetic voices.
We do not use Customer Content (including call audio, transcripts, caller details, knowledge bases, prompts and workflows) to train or fine-tune AI models, ours or anyone else's.
We configure our AI providers to not train on this data and, where they offer it, to retain nothing beyond what is needed to process each request. Language model requests are routed only to providers that commit to zero data retention.
The "Build with AI" assistant in the dashboard sends your instructions and workflow to a language model, under the same terms.
If we ever want to use Customer Content to improve our models, we will ask for opt-in consent first. We will not apply a less protective practice to data collected before the change.

We share personal information only as follows:

Service providers that process it on our behalf under contract, including hosting, telephony, speech, AI, email, payments, analytics and customer support providers. Our current subprocessors are listed on our Subprocessors page.
Services you connect, such as your CRM, calendar, or webhook endpoints, when you or your workspace direct us to.
Within your organization: information in a workspace is visible to its members according to their roles. Agencies can see their client workspaces.
Telephone carriers and industry bodies, to provision numbers, verify identity, and respond to traceback and fraud investigations.
Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or needed to protect the rights, property or safety of Ladoo, our customers, callers or others, including reporting suspected child sexual abuse material to the National Center for Missing & Exploited Children.
Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this policy's protections.
With your consent or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing personal information of consumers under 16.

9. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your choices, secure the Services, and understand how our websites and dashboard are used. Details, including each cookie and how long it lasts, are in our Cookie Policy.

Analytics. We use, or may use, product and website analytics providers, including PostHog and Google Analytics. They collect page views, clicks and interactions, device and browser information, referrer and campaign information, and approximate location derived from IP address. PostHog may record on-page sessions to help us find usability problems, with inputs and text masked. We never record dashboard screens that show call content or caller information.
How Google uses data: see "How Google uses information from sites or apps that use our services". You can install the Google Analytics opt-out browser add-on.
No advertising sharing. We configure Google Analytics with Google Signals, ads personalization and data sharing with Google products turned off, and we don't use advertising pixels or retargeting.
Your choices. Use the "Cookie settings" link in our website footer to accept or reject analytics cookies. In the EEA, UK and Switzerland, we don't set analytics cookies unless you accept them. You can also block or delete cookies in your browser.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out for that browser: we don't load Google Analytics, and PostHog runs without cookies. Our cookie settings panel shows when a GPC signal has been honored. If you're signed in, we also apply it to your account.
Do Not Track. We honor Do Not Track browser signals in the same way as GPC.

10. How long we keep information

We keep personal information only as long as needed for the purposes in this policy, then delete or de-identify it.

Information	How long
Account and workspace information	While your account is active, then up to 90 days after it closes
Billing, tax and transaction records	7 years, to meet tax and accounting laws
Support communications	3 years after the request is resolved
Security, sign-in and service logs	Up to 90 days, longer if needed for an investigation
Website and product analytics	Up to 14 months (Google Analytics); up to 12 months (PostHog events) and 30 days (session recordings)
Marketing contacts	Until you unsubscribe or we haven't interacted for 3 years; we keep a suppression list so we don't email you again
Verification and fraud-prevention records, including records of banned accounts	Up to 5 years after the account closes
Records of acceptance of our Terms and renewal consents	For the life of the account plus at least 3 years

Customer Content is kept according to the customer's settings and our agreement with the customer. By default: call transcripts, summaries and extracted details are kept until the customer deletes them or the account ends; recordings, if enabled, are kept for the period the customer sets. After a customer's account ends, we delete Customer Content within 60 days, and from backups within a further 35 days, except where the law requires us to keep it.

11. Security

We use administrative, technical and physical safeguards designed to protect personal information. These include encryption in transit and at rest, workspace-level access controls, least-privilege access for our staff, and signed, verified webhooks. No system is perfectly secure. If we learn of a security incident affecting your personal information, we'll notify you and regulators as the law requires. Report security issues to security@tryladoo.com.

12. International transfers

Ladoo is based in the United States, and we and our service providers process information in the United States and other countries. Their data protection laws may differ from those where you live. When we transfer personal information from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments) or another lawful transfer mechanism. Contact us for a copy of the relevant safeguards.

13. Your rights and choices

Depending on where you live, you may have the right to:

know and access the personal information we hold about you, and get a portable copy;
correct inaccurate information;
delete your information;
opt out of the sale or sharing of personal information, targeted advertising, or profiling (we don't do any of these, but you may still submit a request);
restrict or object to processing, including objecting to direct marketing at any time;
withdraw consent where we rely on it;
appeal our decision on your request;
not be discriminated or retaliated against for exercising your rights.

How to make a request. Email privacy@tryladoo.com. Account holders can also edit their profile in the dashboard. We'll respond within the time the law requires (generally 45 days in the U.S., one month in the EEA and UK) and may extend that where allowed.

Verification. To protect you, we verify requests by matching information you give us with information we hold. For account holders, that usually means confirming the request from your account's email address. We may ask for more information if needed.

Authorized agents. You may use an authorized agent to submit a request. We may ask the agent for signed permission from you and ask you to verify your identity directly.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@tryladoo.com with "Appeal" in the subject. We'll respond within the time the law requires. If you're not satisfied with the outcome of the appeal, you may contact your state attorney general.

Complaints. If you're in the EEA, UK or Switzerland, you can complain to your local data protection authority. We'd appreciate the chance to address your concern first.

Callers: see Section 3.

Marketing emails. Use the unsubscribe link in any marketing email. We'll still send service and account messages.

14. U.S. state privacy disclosures and Notice at Collection

Notice at Collection. This section is our notice at collection for California and other U.S. state residents. In the past 12 months we have collected the following categories of personal information, for the purposes in Section 5, and disclosed them for business purposes to the categories of recipients listed. We do not sell or share any category of personal information. Retention periods are in Section 10.

Category	Examples	Sources	Disclosed for a business purpose to
Identifiers	Name, email, IP address, account ID, phone number	You; your devices; sign-in providers; GoHighLevel	Hosting, email, analytics, payment and support providers; carriers
Customer records (Cal. Civ. Code § 1798.80(e))	Name, address, phone, billing information	You; Stripe	Payment processor; hosting provider
Commercial information	Plans purchased, invoices, usage	You; our systems; Stripe	Payment processor; hosting provider
Internet or network activity	Pages viewed, clicks, features used, logs	Your devices	Hosting and analytics providers
Approximate geolocation	Location derived from IP address	Your devices	Analytics providers
Professional or employment information	Business name, role, title	You; GoHighLevel	Hosting provider; carriers (for verification)
Sensitive personal information	Account sign-in credentials (used only to authenticate you)	You	Hosting provider
Audio and electronic information	Voice and messages you send to our support team, test calls you make with your own agents	You	Hosting, speech and AI providers
Inferences	None. We do not create profiles about you.	—	—

California "Shine the Light". We don't disclose personal information to third parties for their own direct marketing purposes.

Non-discrimination. We won't deny service, charge different prices or provide a different quality of service because you exercised your privacy rights.

If you sign in with Google, we request only your basic profile: your name, email address, profile picture and Google account ID. We use this information only to create and secure your Ladoo account, sign you in, and contact you about your account. We don't use it for advertising, sell it, or let humans read it except for security, support or legal reasons or with your permission.

Ladoo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you sign in with GitHub, we receive your username, name, email address, avatar and GitHub ID and use them the same way. You can disconnect a sign-in provider in your provider's account settings at any time.

16. Connected CRMs (GoHighLevel)

When a customer connects GoHighLevel or another CRM, we access only the data needed for the features the customer uses, such as contacts, calendars, pipelines, custom fields and notes, and we keep a synchronized copy of contacts so assistants can recognize callers quickly. This is Customer Content that we process on the customer's behalf. When a customer disconnects the integration or uninstalls Ladoo, we stop syncing and delete the synchronized CRM copy within 30 days. Call records already created stay in the workspace until the customer deletes them or the account ends.

17. Children

Ladoo is for businesses and is not directed to children. Account holders must be at least 18. We don't knowingly collect personal information from children under 13 (or under 16 in the EEA and UK) as a controller. If we learn we have, we'll delete it. Contact privacy@tryladoo.com if you believe a child has given us personal information.

18. Changes to this policy

We'll post any changes here and update the "Last updated" date. If we make a material change, we'll tell account holders by email or in the dashboard at least 30 days before it takes effect. We won't apply a materially less protective practice to information collected before the change without your consent. Previous versions are available on request.

19. Contact us

Ladoo
7901 4th St N, #34188, St Petersburg, FL 33702, United States
privacy@tryladoo.com
(833) 913-2024