This policy explains how Logistical Innovations (dba AI Exelion / Exelo), based in San Diego, California, handles personal information on exelo.ai and the Exelo partner platform (the "Service"). It covers three groups of people:
Partners — people with Exelo accounts;
Callers — people who call phone lines answered by AI receptionists that Partners deploy through the Service; and
Report visitors — people who open a business report shared by a Partner and choose to leave their contact details.
2. Information we collect
From Partners:
Account details: email address, name, and profile information you provide (such as an alert phone number).
Onboarding service-contact notice and preference: the notice shown when you sign up, when it was acknowledged, any later withdrawal of human onboarding calls, and the wording you were shown.
Business data you add: businesses, saved leads, notes, and configuration (greetings, transfer numbers).
Connected infrastructure credentials: API keys and account identifiers for the third-party voice and telephony accounts you connect. These are encrypted at rest (AES-256-GCM) and used only to operate your AI lines.
Google Calendar connection (optional): if you connect a calendar so your AI receptionist can book appointments, the information described in Section 13.
Billing: subscriptions and purchases are processed by one of two payment processors, Stripe or Whop, depending on when you subscribed (your receipt identifies the seller and your card statement shows the processor). We receive your plan and payment status; we never see or store your full card number.
Usage and log data: basic technical logs needed to run and secure the Service.
From Callers (on Partners' behalf):
When an AI line answers a call, the Service processes and stores: the caller's phone number, call recordings, transcripts, names and callback numbers callers provide, and AI-generated summaries and urgency assessments of the call.
From XRAY scans: publicly available information about businesses (websites, public listings and reviews) used to generate automated reports.
From Report visitors: if you open a business report a Partner shared with you and choose to unlock the full breakdown, we collect the name and phone number you enter and deliver them to the Partner who shared that report, as their sales lead. That is the only collection on report pages — no account is created, and report pages carry no advertising trackers.
3. Callers' information — the honest specifics
Call data exists so the business a caller reached can serve them: it appears in the owning Partner's portal and powers urgent alerts. The Partner who deployed the line is responsible for any recording notices or consents the law requires on their calls. If you called a business whose line is powered by Exelo and want your information deleted, contact that business — or email us at support@exelo.ai and we will handle it (Section 7).
4. How we use information
To run the Service: provision and manage AI lines, store and display calls and transcripts, generate summaries and urgency flags with AI processing, and send urgent-call alerts (email, and an automated phone call if the Partner enables it).
To bill subscriptions, provide support, secure the Service, and fix problems.
To send service communications (like login links and account notices).
To support new accounts: when this feature is enabled and disclosed at signup, Exelo sends your name, email, phone number, plan and signup date to its customer relationship management (CRM) system so the Exelo team can help you get started. An Exelo team member may call you once or email you about account onboarding and support. You can withdraw the onboarding-call preference in Settings or contact support, and we respect do-not-contact requests. This is not marketing consent; creating an account never opts you into marketing calls or texts. We do not place automated or prerecorded sales calls or texts because you signed up.
We do not sell personal information, and we don't use it for third-party advertising.
5. How information is shared
Only as needed to run the Service:
Service providers working for us: cloud hosting and database, email delivery, payment processing (Stripe or Whop), a customer relationship management (CRM) service that holds new-account details for the Exelo team once that feature is enabled, and AI providers that generate transcripts, summaries, and scan analysis on our behalf.
Your own connected providers: your AI lines run on voice and telephony accounts you own; call traffic necessarily flows through those providers under your direct agreements with them.
Within your account: call data is visible to the Partner account that owns the business.
Report visitors: The contact details you provide are shared with the Partner who created the report so they can follow up regarding their services. Exelo stores this information as part of providing the platform.
Legal reasons: if required by law, or to protect rights, safety, or the integrity of the Service.
No selling, no data brokers, no ad networks.
6. Retention
Account and business data: kept while your account is active, and deleted when you delete your account — except for the limited financial and audit records described below.
Call content — recordings, transcripts, summaries, caller names and numbers — is automatically removed 90 days after the call. What remains is non-identifying: call counts, durations, timestamps, and outcomes, so Partners' statistics stay accurate.
Partners can delete call data earlier at any time, and deletion on request is honored promptly (Section 7).
Report-visitor contact details: kept as the receiving Partner's lead until that Partner deletes it or the visitor requests deletion (Section 7).
The Partner's own connected voice provider may retain its copies under that provider's agreement (Section 5).
Encrypted infrastructure credentials are deleted immediately when you disconnect your accounts.
Your CRM record: if Exelo has created or updated a CRM record for you, it is kept while your account is active. After an executed account deletion, Exelo removes what it added to its CRM: the Exelo tags and fields, and the onboarding opportunity and call task Exelo created. If Exelo created the CRM contact and it holds no other sales records, the contact is deleted too. A record the Exelo team already had before you joined Exelo, or one that holds other sales records, is kept without the Exelo details. This runs automatically after the deletion; if the CRM can't be reached it is retried, and checked by the Exelo team if it still cannot finish.
Google Calendar connection and appointment records: see Section 13.
Financial and audit records: a limited set survives account deletion, because we're required to keep records of money we received and money we returned. These are payment and usage records — amounts, dates, and payment references — together with append-only logs of the deletion itself, email delivery, and alerts. Business names and call identifiers are stripped from the payment records at deletion. None of them contain recordings, transcripts, or report content. The full list is shown to you before you confirm a deletion.
7. Your rights and choices
Email support@exelo.ai to access, correct, export, or delete personal information — whether you're a Partner, a Caller, or a Report visitor. We verify requests and respond within the timelines required by applicable law (for California residents, generally within 45 days). California residents have the rights to know, delete, correct, and to non-discrimination for exercising those rights. We don't sell or share personal information as those terms are defined in California law, so there is nothing to opt out of.
8. Security
Credentials encrypted at rest, transport encryption (TLS), row-level access controls so accounts can only reach their own data, and least-privilege service access. No system is perfectly secure, but security decisions in this product are made conservatively and documented.
9. Cookies
We use only what's needed to sign you in and keep your session working. No advertising trackers.
10. Children
The Service is for business use by adults 18+. We don't knowingly collect information from children.
11. International users
We operate from the United States and process data in the United States. If you use the Service from elsewhere, you understand your information is processed in the U.S.
12. Changes
We'll post updates here and give notice of material changes (email or in-app). The effective date above always reflects the current version.
13. Google Calendar data
This section applies only if you connect a Google Calendar so your AI receptionist can book appointments. It describes what Exelo does with the information it receives from Google through that connection ("Google user data").
What we access, and why:
Your list of calendars (permission: see the list of Google Calendars you're subscribed to). We read the calendars you can edit — each one's ID, name, time zone, and whether it's your primary calendar — so you can choose which calendar appointments go into. The list is shown only to you, in your portal, and is not stored. We keep only the ID, name, and time zone of the calendar you choose.
Your availability (permission: view your availability in your calendars). We read only when the calendar you chose is busy — start and end times — to work out which times are open. We never receive the titles, guests, locations, or other details of your existing events through this permission. Busy times are used for that one request and are not stored.
Events (permission: view and edit events on all your calendars). We create an appointment on the calendar you chose when a caller books through your AI receptionist, and we move or cancel that same appointment when the same caller asks to reschedule or cancel. We do not list, search, or browse your calendar's events. We read an event only by its ID, and only events Exelo created (they carry a private Exelo marker), to confirm a booking or before changing it. We create, move, and cancel appointments without sending invitations or emails from your calendar.
Appointments we create contain what the caller gave during the call — their name, phone number, what they need, and any service address — so you can see who is coming and why.
How we store and protect it:
When you connect, Google issues a long-lived access credential (a refresh token). We store it encrypted at rest (AES-256-GCM) and use it only to perform the actions above. Short-lived access tokens are never stored.
We also store: the permissions you granted; when the calendar was connected and by which account; the chosen calendar's ID, name, and time zone; your booking settings; and, for each appointment we create, the event's ID, start and end times, status, and a one-way hash of the caller's phone number (not the number itself). If Google returns an error, we may store a short excerpt of it so we can show you why the connection stopped working.
These records are readable only by Exelo's servers. They are never sent to your browser except for your calendar choice and the settings shown in your Booking tab.
How it is shared:
We do not sell Google user data and we do not use it for advertising.
To let your AI receptionist offer times on a call, the open times we calculate from your availability (a few at a time) and the time of a confirmed, moved, or cancelled appointment are passed to the AI and voice service providers that run your AI line (Section 5), solely to provide that feature. The same happens when you rehearse booking in your portal's test chat, which reads availability but never writes to your calendar.
Nothing else from your Google Calendar is shared, except where required by law (Section 5).
Disconnecting, retention, and deletion:
Disconnect your calendar at any time from the business's Booking tab. We immediately delete the stored refresh token, turn booking off, and ask Google to revoke Exelo's access. Your calendar choice and booking settings are kept so you can reconnect in one step.
You can also remove Exelo's access from your Google Account at any time at myaccount.google.com/permissions. If Google tells us access was removed or has expired, the connection is marked disconnected and your AI line goes back to taking booking requests as messages until you reconnect.
Appointment records (event ID, times, status, hashed caller number) are kept while the business exists in your account. Appointments already created stay in your Google Calendar — they are yours to keep or delete.
Deleting a business, or your account, deletes that business's calendar connection (including the encrypted refresh token) and its appointment records from Exelo.
Limited Use: Exelo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the booking features described above; we transfer it only as described in this section, to provide those features, for security, or to comply with law; we do not use or transfer it for advertising; we do not use or transfer it to develop, improve, or train generalized artificial-intelligence or machine-learning models; and no one at Exelo reads it unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.
14. Contact
Logistical Innovations (dba AI Exelion / Exelo) — San Diego, CA