Privacy notice

Operator: SevenTrain Ventures [legal entity, state or country of formation, registered address to confirm], doing business as twelvebell ("we", "our", "us"). Contact: [privacy email, to confirm] and [postal address, to confirm]. While this page is a draft, questions go to luis.r@seventrainventures.com.

This notice covers twelvebell.com, the registration flow (including voice registration), the owner console, and the emails we send account owners. It also explains, in section 11, what happens when you talk to an automated assistant on a website we built for one of our business customers, because in that case the business is responsible for your data and we act on its instructions.

1. The short version

• We collect what you give us at registration (including what you say to the voice assistant, which we keep as text, not audio), the public content of the website you ask us to read, the content of the site we build for you, your console activity, cookieless analytics, and billing records through Stripe.
• We use it to build and run your site and its five assistants, to bill you, to support you, and to keep the service secure.
• We do not sell personal information and we do not share it for cross context behavioural advertising. We do not run third party advertising cookies.
• We honour Global Privacy Control and Do Not Track signals: if your browser sends either, we do not record analytics events for your visit.
• Our vendors (section 8) process data for us under contracts that stop them using it for their own purposes. Anthropic does not train models on the content we send it.
• You can ask for access, correction, deletion, a copy of your data, and to opt out of anything a state law lets you opt out of. We apply the same rights to everyone, whatever state or country you are in. Email [privacy email].

2. Who this notice is for

Two audiences:

1. Prospects and account owners: the business owner (or their team) who registers, reads the console, and pays. For this data we decide why and how it is processed, so we are the "controller" (or the "business" under California law).
2. Visitors of generated sites: people who chat or speak with an assistant on a customer's website. The customer decides why that data is collected; we process it on the customer's instructions under our data processing addendum. We are the "processor" (or "service provider" under California law). Section 11 explains your options.

3. What we collect, where it comes from, and why

We do not ask for and do not want sensitive personal information (as defined in state laws, for example health, precise geolocation, racial or ethnic origin, religion, sexual orientation, citizenship or immigration status, government identifiers, biometric identifiers, or data about a known child). Please do not put it into registration answers or your site content. If a visitor volunteers sensitive information to an assistant on a customer's site, that data belongs to the customer's records and is handled under section 11.

Sources of personal information, in California's terms: directly from you; automatically from your device; from Stripe (payment status); from the website you asked us to read. We do not buy personal information from data brokers.

4. Purposes

We use the data above to:

1. Provide the service: generate the site, run the five assistants (Greeter, Qualifier, Recorder, Booker, Escalation), host the site, run the console.
2. Communicate with you: account, billing, security, and service emails through Resend; replies to your support requests.
3. Bill you through Stripe and keep the records tax law requires.
4. Keep the service secure and prevent abuse: rate limits, spend caps, proof of control checks before publishing, fraud signals from Stripe.
5. Improve your own assistants using your own corrections and conversation history. We do not pool one customer's data to train another customer's assistants, and we do not train our vendors' foundation models with it.
6. Measure how twelvebell.com and generated sites are used, with cookieless analytics.
7. Meet legal obligations and defend legal claims.
8. Send marketing email to prospects who did not finish registration, only where the law allows it and always with an unsubscribe link. [Ours to confirm whether we do this at all. Default in this draft: one reminder email within 30 days, then nothing.]

We do not use personal information for targeted advertising, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects. The assistants make no decisions about visitors; they answer questions, record what the visitor says, and pass the conversation to the owner.

5. Voice registration

• The assistant is automated. It uses Anthropic Claude for reasoning and ElevenLabs for the voice and for speech to text. We tell you this before the microphone is switched on, and you can type instead at any point. The exact lines are on our AI and voice page.
• We ask for your permission before we access the microphone, and the browser asks too.
• Audio is streamed to ElevenLabs for transcription and is not stored by us. ElevenLabs processes it under its data processing addendum; we switch off any vendor setting that would use our audio to train their models [ours to confirm in the ElevenLabs account settings; see section 8].
• We keep the transcript as part of your registration answers, for as long as we keep the account (section 9).
• If you do not finish registration, we delete the transcript with the rest of your prospect data after 30 days [ours to confirm].

Voice, for us, is a way of typing. We do not create a voiceprint and we do not use your voice to identify you. Under the amended federal children's privacy rule, audio recordings and voiceprints are personal information of children; we do not offer voice registration to anyone under 18 (section 12).

Source: COPPA rule amendments, Federal Register, 22 April 2025, checked 2026-09-19.

6. Cookies, analytics, and signals

Cookies: twelvebell.com uses a session cookie to keep you logged in to the console and a cookie set by Stripe on the checkout and billing pages for fraud prevention. Nothing else. Generated sites set no cookies of ours. Customers may add their own tools to their site; those are the customer's responsibility.

Cookieless analytics: instead of a cookie, we compute a visitor key from the site you are on, a coarse description of your browser, and a secret salt. The salt is a random value, not something we derive and could recompute later: we generate a fresh one at the start of each day and delete it within 48 hours. Because the site you are on is part of the key, the same person gets a different key on twelvebell.com than on any customer's site, and a different key again on the next one - we cannot follow you across sites or, once a day's salt is deleted, across days either. The key cannot be turned back into you. To be honest about the limit: for up to 48 hours, until that day's salt is deleted, someone holding it could in principle test one already-suspected browser and site against that day's events - a confirmation of a suspicion, not a way to produce a list of who visited. Once the salt is deleted, that day's events can never be linked to each other again, by us or anyone else. We treat the events as pseudonymous personal information, we never use them to identify anyone, and we delete raw events after 90 days, keeping only totals.

Do Not Track and Global Privacy Control: if your browser sends the DNT header or the GPC signal - including from a GPC browser extension, which does not set the same in-page signal a browser with native GPC support does - we record no analytics events for that visit, on twelvebell.com and on generated sites. Our page script checks first and simply never sends the beacon; our collection endpoint checks the same headers again independently, so a modified or stripped-down page still cannot cause an event to be recorded. GPC also counts as an opt out of sale and sharing, though we do none. California's online privacy law requires us to say how we respond to DNT, and twelve states require GPC to be honoured as an opt out signal.

Sources: CalOPPA, Business and Professions Code 22575 and state privacy law tracker 2026 (Consenteo), both checked 2026-09-19.

Third parties collecting across sites: none on our pages.

7. Who we share data with

• Subprocessors: the vendors that run parts of the service for us. Today: Anthropic (text generation), ElevenLabs (voice and speech to text), Vercel (hosting), Supabase (database), Stripe (billing), n8n cloud (automation), Resend (email), Higgsfield and fal.ai (image generation). Section 8 lists each vendor's purpose, data, region and contract links. Each vendor is bound by a contract that limits it to our instructions, except Stripe, which is an independent controller for fraud prevention and financial compliance under its own privacy policy.
• Our business customers: visitor data goes to the customer whose site the visitor used. That is the point of the service.
• Professional advisers, auditors, insurers, and authorities when the law requires it or to protect rights, safety, or property.
• A buyer or successor if we sell or reorganise the business, under this notice.

Source: Stripe data processing agreement, checked 2026-09-19.

We do not sell personal information. We do not share it for cross context behavioural advertising. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

8. Subprocessors

This is the list of third parties that process personal data for us to run twelvebell. It covers both our own account data (under this notice) and the visitor data we process for business customers (under our data processing addendum). We give account owners at least 30 days notice by email and on this page before a new subprocessor processes customer data; customers may object as described in the DPA.

Every link below was opened on 2026-09-19. "Region" is where the vendor says it processes by default; several vendors use their own subprocessors in other countries, which their own lists disclose.

Not on the list, and why

• Cloudflare: the current stack hosts on Vercel. If Cloudflare is used for DNS, CDN or Cloudflare for SaaS, we add it before launch (DPA [unverified]).
• Domain registrar: only if a customer buys a domain through us; added when chosen.
• SMS provider: no vendor chosen. SMS follow ups will not ship until one is on this list with a DPA and until the consent flow is built.
• WhatsApp or other messaging channels: not launched.
• Analytics vendor: none; analytics are our own cookieless events stored in Supabase.
• Error monitoring, uptime or support desk tools: none chosen; added when chosen.
• OpenAI, Google and other model providers: not used by us directly. They appear in n8n's own subprocessor list for n8n's AI assistant features, which we do not use on customer data.

What we require of every subprocessor

1. A written DPA or equivalent terms that make the vendor our processor for the data we send, bar it from selling or sharing the data, and bar it from using the data for its own purposes, including model training, or a contractual training opt out we have switched on.
2. Breach notification to us fast enough for our 72 hour commitment to customers. Eight of the nine vendors commit to 48 hours or without undue delay. Higgsfield publishes no DPA, so it commits to nothing on breach notice, subprocessor notice or transfers. Until Higgsfield is on an enterprise or developer agreement that carries those terms, our 72 hour commitment is backed by the other eight vendors and by the rule that no person identifying material is sent to Higgsfield.
3. Advance notice of the vendor's own subprocessor changes (5 to 30 days across the eight vendors that publish a DPA; none from Higgsfield). The shortest of these, Vercel at 5 days, is shorter than the 30 days we promise, which is why our DPA distinguishes our own choice of a new subprocessor from a vendor's internal change, which we pass on as soon as we receive it.
4. Transfer terms (standard contractual clauses or Data Privacy Framework certification) in case a European visitor's data reaches the vendor. Unmet for Higgsfield today.
5. Accounts opened in the company's name, not personally, with multi factor authentication and a named owner on our side.

9. How long we keep it

Retention periods below are ours to confirm; our software reads them from one configuration file, so they can be changed without rewriting this notice's structure.

Where a law requires us to keep something longer (for example a legal hold), we keep it only for that purpose.

10. Your rights and how to use them

We give every person these rights, whatever state or country they live in, because it is simpler for us and fairer for you. State laws formally grant some of them only to residents of that state and only against businesses above certain thresholds; our state privacy law matrix records our honest view of which laws bind us today.

Rights:

1. Know and access: confirm whether we process your personal information and get a copy of it, including the categories and specific pieces, the sources, the purposes, and the categories of third parties we share it with.
2. Correct inaccurate information.
3. Delete: subject to exceptions the law allows (for example billing records we must keep).
4. Portability: a copy in a usable machine readable format. Account owners can export from the console at any time.
5. Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects. We do none of these, and we treat a GPC signal as this opt out anyway.
6. Limit use of sensitive personal information (California). We do not use sensitive personal information beyond what the law allows without limitation.
7. Know the specific third parties that received your personal data (Oregon, Delaware, Minnesota, Maryland style rights): we will give the list.
8. Question the result of profiling (Minnesota): we do not profile you in a way that produces legal or similarly significant effects, and we will say so in writing if you ask.
9. Not be discriminated against for exercising a right.
10. Appeal: if we refuse a request, you can appeal by replying to our decision. We answer appeals within 45 days and tell you how to complain to your state attorney general if you disagree.

How to exercise them: email [privacy email] from the address on your account, or use the console (account owners). We answer within 45 days and may extend once by 45 days for complex requests, telling you why. We verify requests by matching the email on the account or by asking two pieces of information only the account owner would know; we do not ask for government identifiers. An authorised agent may act for you with your written permission; we may still verify with you directly. We do not charge for a request unless it is manifestly unfounded or excessive, and then we will tell you first.

Nevada: our designated request address for opting out of the sale of covered information is [privacy email]. We do not sell covered information.

Source: NRS 603A.340, checked 2026-09-19.

California residents: see section 16 for the disclosures the California Consumer Privacy Act requires in a specific format.

Visitors of customer sites: your request should go to the business whose site you used, because the business controls your data. If you write to us instead, we will pass the request to the business within 5 business days and help it respond. If the business has cancelled its account and the retention window has passed, your data is already deleted.

11. If you talked to an assistant on a business's website

When you chat or speak with an assistant on a site we built:

• The business is responsible for your data (the controller). We process it for the business under our data processing addendum, and we do nothing with it except what the business's configuration and the service require.
• Before the assistant's first reply you see a line saying it is automated and whose site it is. Before your first message is stored you see a short notice saying what is kept and how to ask for deletion. The exact wording is on our AI and voice page and is being settled with counsel.
• What is stored: your messages and the assistant's replies, an opaque visitor identifier assigned by the widget, and, if you give them, your name, company, need, deadline, budget and a preferred time to meet. Voice conversations on customer sites, where offered, are transcribed and the audio is not kept, the same as section 5.
• Follow ups: the business may email you or text you after the conversation. We send text messages only where the business has recorded your consent to receive them; automated texts to mobile numbers require prior express consent under the Telephone Consumer Protection Act. [The SMS vendor is not yet chosen and is not on the subprocessor list; no SMS ships until it is.]
• Learning: a business's assistants learn only from that business's own conversations and corrections. Your conversation is never used to improve another business's assistants or any vendor's foundation model.
• Retention: the business's setting, default 12 months, then deletion; see section 9.
• Your rights: ask the business, or write to us and we will forward it (section 10).

Source: 47 U.S.C. 227, checked 2026-09-19.

We ask every customer, in the acceptable use policy and the terms, not to deploy the assistants on sites directed to children, not to ask visitors for sensitive information the business does not need, and to give visitors this notice.

12. Children

twelvebell is for businesses. We do not knowingly collect personal information from anyone under 18 as an account owner, and we do not offer voice registration to minors. Generated sites are general audience business sites; customers may not use the service for sites directed to children under 13. If we learn that we hold personal information from a child under 13 without verifiable parental consent, we delete it. State laws restrict selling or advertising to known minors (under 16 in California and Oregon, 13 to 17 in Connecticut, Delaware, New Jersey and others, under 18 in Maryland, Colorado and Montana); we do not sell or advertise to anyone, minors included. If you believe a child has given us information, email [privacy email].

Sources, all checked 2026-09-19: California Civil Code 1798.120; MultiState on the 2026 laws (Oregon under 16); Manatt on Maryland (under 18). Our state matrix has the rest.

13. Automated assistants and AI

• Every assistant, on twelvebell.com and on generated sites, tells you it is automated before it replies. California's bot law makes it unlawful to use a bot to mislead a person about its artificial identity to drive a sale; disclosure removes liability, so we disclose first. The bill that would require disclosure before any interaction, AB 410, is not law: it passed the Assembly on 3 June 2025 and has been held in committee under submission since 29 August 2025. We disclose before the first interaction as our own practice, not because California requires it. From 1 January 2027 Colorado's Chatbot Safety Act, HB 26-1263, does require an AI disclosure, age estimation and minors safeguards from public conversational systems, on a reading that covers customer support chatbots. If a customer's site reaches people in the European Union, the EU AI Act's transparency duty for systems that interact with people has applied since 2 August 2026 and the same line satisfies it.

Sources, all checked 2026-09-19: California BPC 17941 (applicability of the 10 million visitor platform threshold to our customers' sites [unverified]); AB 410 status; Colorado HB 26-1263 (Davis Wright Tremaine) (scope as applied to us [unverified]); European Commission FAQ on Article 50.

• Text is generated through Anthropic's commercial API. Anthropic may not train models on customer content from the service, and retained API data is never used for training without express permission. Anthropic deletes API inputs and outputs within 30 days under its standard policy.

Sources, all checked 2026-09-19: Anthropic commercial terms; API data retention; privacy center on retention (via search summary, direct read [unverified]).

• Assistants can be wrong. Factual statements in generated text, including prices and availability, should be checked with the business; Anthropic's terms require us to tell users this, and we do.
• Visitor messages are treated by our system as data, never as instructions, which is a security control against attempts to redirect an assistant.

14. Security

We use encryption in transit and at rest through our vendors' defaults, database row level security so one customer's rows are never readable through another customer's session, least privilege access for our own staff, spend caps and rate limits, an automated review pass on assistant replies, and deletion endpoints for a single visitor and for a whole account. No system is perfectly secure. If a breach affects your personal information we will tell you and the authorities as the law requires; state laws set deadlines from 30 days (California from 1 January 2026, Colorado, Florida, Washington) to 60 days, and our data processing addendum commits us to tell business customers within 72 hours of confirming a breach.

Source for the state deadlines: PrivacyLawMap, breach notification laws by state 2026, checked 2026-09-19.

15. Where your data goes

We are based in the United States and most processing happens there (Vercel, Supabase, Anthropic, ElevenLabs, Stripe, Resend, Higgsfield, fal.ai). Our automation vendor n8n hosts in Germany and Sweden, so some operational data crosses into the European Union.

Source: n8n subprocessors, checked 2026-09-19.

If you are in the Dominican Republic or elsewhere in Latin America, your data is transferred to and processed in the United States, where privacy law differs from your country's. Law 172-13 of the Dominican Republic governs personal data held in databases and gives you rights of access, correction and deletion (habeas data); we honour those rights through section 10. Its rules on consent and on international transfer are [unverified] in this draft and are a question for Dominican counsel.

Source: Law 172-13 (Cámara de Diputados), checked 2026-09-19.

If you are in the European Economic Area, the United Kingdom or Switzerland (we do not market there, but a customer's visitor may be), our legal bases are: performance of the contract with the account owner; our legitimate interests in security, analytics without cookies, and service emails; consent for the microphone and for any marketing email; and legal obligation for billing records. Transfers rely on the standard contractual clauses our vendors have signed and, where the vendor is certified, the EU-US Data Privacy Framework. Article 28 processor terms are in our data processing addendum. [Ours to confirm with counsel: whether we need an EU or UK representative; default: no, because we do not target those markets.]

Source: GDPR Article 28, checked 2026-09-19.

16. California disclosures

Categories of personal information collected in the preceding 12 months, as listed in Civil Code 1798.140:

Source: California Civil Code 1798.140, checked 2026-09-19.

Purposes: section 4. Retention: section 9. Sale or sharing: none, and none of minors under 16. Financial incentives: none. Sensitive personal information is used only to provide the service and for security, which does not trigger the right to limit. Rights and verification: section 10. Requests received, complied with and denied: we will publish the yearly figures if we ever reach the volume where the regulations require it. "Shine the Light" (Civil Code 1798.83): we do not disclose personal information to third parties for their direct marketing. We do not use automated decision making technology for significant decisions. [Format to be confirmed against the CCPA regulations updated with effect from 1 January 2026, including the risk assessment and cybersecurity audit rules; our size keeps us below the thresholds today.]

Source: Jackson Lewis, CCPA regulations effective 1 January 2026, checked 2026-09-19.

Honesty note: we do not currently meet any of the three CCPA thresholds (annual revenue over 26,625,000 dollars as adjusted, personal information of 100,000 or more consumers or households, or half of revenue from selling or sharing). We still write this section as if we did, so that customers and their visitors get the same treatment everywhere and so that nothing has to change the day we cross a line.

Source: Clym, CCPA applicability guide, checked 2026-09-19.

17. Other state disclosures

• Texas and Nebraska: their laws apply without a numeric threshold to any business that is not a small business under the federal Small Business Administration definition; we expect to be a small business for now [ours to confirm against our industry size standard]. Even small businesses may not sell sensitive data without consent; we do not sell any.
• Connecticut: since 1 July 2026 the law reaches any controller that processes sensitive data or sells personal data, at any volume, and controllers of 35,000 or more consumers. We design the service to avoid processing sensitive data as a controller; we apply the rights in section 10 regardless.
• Washington: we do not collect consumer health data as a controller. A customer whose visitors share health information with an assistant is the regulated entity under the My Health My Data Act, and must publish its own consumer health data privacy policy.
• Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas and California: we honour the Global Privacy Control signal as an opt out (section 6).
• Appeals: residents of states that grant an appeal right (most of the above) can appeal a refusal as described in section 10, and we will give the attorney general's contact route in our reply.

Sources, all checked 2026-09-19: TrueVault on the Texas small business test; National Law Review on the Connecticut amendments; RCW 19.373 (via search summary [unverified]).

18. Changes to this notice

We will post the new version with a new effective date, and for material changes we will email account owners at least 30 days before the change takes effect. Continued use after that date means the new notice applies; if you disagree, you can cancel and export your data.

19. Contact

[Privacy email]
[SevenTrain Ventures legal name, registered address]
[Named privacy contact or role]

While this page is a draft, questions go to luis.r@seventrainventures.com.