Privacy Policy

1. Introduction

This Privacy Policy explains how KPI DRIVER, LLC ("KPI DRIVER," "we," "us," "our") collects, uses, discloses and protects information in connection with our websites and the KPI DRIVER platform (together, the "Platform").

The Platform is a customer relationship management and business automation system for real estate investing businesses, combined with a suite of artificial intelligence applications:

Who this policy addresses. The Platform is sold to businesses, for business use. Three groups are covered:

• Visitors to our websites — anyone browsing kpidriver.com or kpidriver.ai.
• Our customers and their users — the businesses that subscribe and the individuals who log in. As to these people we are a controller (a "business" under California law).
• Individuals inside a customer's account — sales leads, property owners, contacts, and anyone the AI Agent speaks with. As to these people we are a processor (a "service provider"). The business using the Platform controls that information and is responsible for it. Direct your requests to them. Section 16.6 explains how we help.

2. Who We Are

3. Our Two Roles

3.1 Where We Are a Controller

We decide the purposes and means of processing for: account and identity information for people who log in; company records; billing, payment and wallet transaction records; usage, token consumption and cost records; authentication, session and security logs; support correspondence; and website analytics and cookie data.

3.2 Where We Are a Processor

We process the following only on our customer's instructions, to deliver the Platform. This is "Customer Data."

• Contact, lead and pipeline records, and all custom fields
• Call recordings, transcripts and call metadata
• Text message and email content sent or received through the Platform
• AI Agent conversation content
• Appointment and calendar records
• Consent, opt-out and Do-Not-Call records
• Property addresses, comparable sales data and underwriting inputs and outputs
• Enriched contact field data
• Contact data lookup results, including names, telephone numbers and email addresses
• Do-Not-Call registry status, litigator flags and phone type classifications
• AI-generated scores, evaluations, summaries, reports and recommendations

We do not control what our customers put into the Platform, and we do not independently verify that they have a lawful basis, notice or consent for it. That responsibility is theirs.

4. Information We Collect

4.1 Account and Identity Information

Email address; full name; telephone number; profile picture; access role; agent type; and active status. Passwords are stored only as cryptographic hashes and are never visible to us.

4.2 Company Information

Company name, company logo, and the account identifier used to route incoming data to the correct organization.

4.3 Billing and Payment Information

Payment processor customer identifier; card brand, last four digits and expiry (held by our payment processor, not by us); payment identifiers; wallet balance; and transaction history. We never receive, see or store full payment card numbers, security codes, or bank account credentials.

4.4 Usage and Consumption Logs

Feature name, record identifier and type, input and output token counts, computed cost, model used, call and message volume, and timestamps.

4.5 CRM Data

Contact and lead records, custom fields, pipeline and opportunity data, tags, communication history across calls, texts and email, appointment records, form submissions, and consent and opt-out records.

4.6 Communications Content

Call recordings and transcripts. Audio recordings of calls made or received through the Platform, and transcripts of those calls.

Text messages. The full content of SMS and MMS messages sent and received, including messages composed by the AI Agent.

Email. The content of email sent and received through the Platform.

4.7 AI Dashboard Data

The AI Dashboard has read access across a customer's account. We collect the question, the records retrieved to answer it, the generated response, and associated token usage.

4.8 AI Agent Data

For each conversation: the telephone number involved; conversation direction; the full content of every call and message; recordings and transcripts; duration and turn count; qualification questions asked and answers given; the qualification outcome; any appointment booked; and opt-out requests and how they were handled.

4.9 Feature-Specific Data

Sales Coach and Training Coach. Contact name and telephone number; agent telephone number; call direction, duration and result; full call transcript; a score from 0 to 100; and a structured evaluation containing category scores, penalties, bonuses and coaching actions. Training Coach additionally stores the identifier of the voice agent practiced against, and telephone numbers representatives register themselves.

Deal Underwriter. Property address; bedrooms, bathrooms, square footage and year built; AI-generated condition assessment; comparable property records; calculated ARV ranges, maximum offer ranges, repair cost estimates and projected profit; AI assessment; pursue/negotiate/pass recommendation; and risk flags.

Note Taker. Call direction; AI-generated summary; transcript summary; lead source; contact telephone number; and agent name.

Skip Tracing. For every lookup: contact identifier; flow type; whether a match was found; credits and cost; and the complete provider response. Parcel lookups store parcel identifier, county, address, city, state and ZIP. Do-Not-Call lookups store the telephone number, registry flags, litigator flag, and phone type. Contact data lookups store address, and person records containing names, telephone numbers and email addresses of identified individuals.

4.10 Prospect and Website Visitor Information

When you visit our websites, submit a form, or contact us about our services, we collect what you provide — typically name, business name, email address, telephone number — together with how you found us and which pages you viewed.

4.11 Most Sensitive Categories

• Call recordings and transcripts — verbatim records of conversations that may contain financial hardship, family circumstances, or health information.
• AI Agent conversations — full transcripts of automated conversations, including anything a person volunteers to a system.
• Contact data lookup results — names, telephone numbers and email addresses of property owners obtained without their knowledge.
• Do-Not-Call and litigator flags — regulatory status of individual telephone numbers.
• Representative telephone numbers — personal mobile numbers of our customers' employees.

5. Where the Information Comes From

6. How We Use Information

6.1 As a Controller

We use account, billing and usage information to create and administer accounts; authenticate users; process payments and wallet transactions; maintain a billing audit trail; send transactional messages; provide support; monitor security; comply with legal obligations; and analyze aggregate usage to improve the Platform.

6.2 As a Processor

We use Customer Data only to deliver the features our customer has enabled — routing records, transmitting content for AI processing, placing and receiving calls and messages, performing lookups, storing and displaying results, generating reports, and calculating usage cost.

6.3 We Do Not Use Customer Data for Our Own Purposes

We do not use Customer Data for our own purposes. We do not use it to build or improve our own products, to market to the individuals it describes, or to create datasets independent of the customer relationship. We may generate aggregated and de-identified usage statistics that cannot reasonably identify any individual.

6.4 Marketing Our Own Services

We market our own services to businesses. We send marketing email only where you gave us your address for that purpose or have an existing business relationship with us. We send marketing text messages only where you have given prior express written consent. We do not market to individuals inside a customer's account.

6.5 Text Messaging From Us — SMS Terms and Opt-In Policy

This subsection describes the text messaging programs we operate — not messages sent by our customers through the Platform.

We obtain consent when you submit a form on our website and tick an unticked box agreeing to receive text messages; book a call; text us first; give consent verbally on a recorded call; or create an account (for transactional messages).

We collect marketing and non-marketing consent separately, using two unticked checkboxes. Consenting to one does not consent to the other.

Opting out. Reply STOP to any message. We also honour END, QUIT, CANCEL, UNSUBSCRIBE and OPTOUT. You will receive one confirmation message, after which we send no further messages for that program.

Help. Reply HELP to any message, or text HELP to (786) 822-8188, or email info@kpidriver.com.

Frequency. Account, security and appointment messages are sent as needed. Marketing messages are sent no more than four times per month. Message and data rates may apply.

No mobile information is sold or shared with third parties or affiliates for marketing or promotional purposes.

7. Artificial Intelligence

7.1 How AI Is Used

Generative AI processing is performed by third-party large language model providers under commercial agreements. We do not build or train our own models. Content transmitted for AI processing includes: call transcripts, AI Agent conversation content, records retrieved by the AI Dashboard, property addresses and characteristics, and contact field data. Skip Tracing does not use AI — it performs a direct database lookup.

7.2 Your Data Is Not Used to Train AI Models

We do not use Customer Data to train, fine-tune or develop artificial intelligence models. Our large language model providers are contractually prohibited from doing so.

One exception applies to the AI Agent. The provider delivering that feature reserves broader rights over conversation content under its own terms. This applies only to AI Agent conversation content — not to any other data on the Platform.

7.3 Human Review

By us. We do not routinely read recordings, transcripts, AI Agent conversations, AI outputs or lookup results. Authorized personnel access Customer Data only to diagnose a fault, investigate a security incident or suspected abuse, or comply with a legal obligation. Such access is restricted by role and logged.

7.4 Accuracy and Limitations

AI outputs are statistical estimates generated by a language model. They can be incomplete, inaccurate, or confidently wrong.

• Dashboard answers may be wrong. Verify any number before relying on it.
• AI Agent conversations may contain errors. The Agent may misunderstand someone, state something inaccurate, or book an inappropriate appointment.
• Call scores reflect a rubric applied to a text transcript. They cannot capture tone, context or relationship history.
• Underwriting output is not an appraisal. After-repair values and offer figures are automated estimates. They must not be represented to anyone as an appraisal, broker price opinion or professional valuation.
• Nothing produced by the Platform is legal, financial, tax, investment, real estate, employment or professional advice.

7.5 Automated Evaluation of Individuals

Scoring of representatives. The Sales Coach and Training Coach features assign numerical scores to identifiable employees. If a customer uses these scores to make or support employment decisions, that may trigger obligations under the Colorado AI Act, California's automated decision-making technology regulations, NYC Local Law 144 and comparable statutes.

We have not performed a bias audit of our scoring rubrics, and we do not represent that scores are free from bias or suitable as the basis for any employment decision.

8. Automated Calling and Messaging

8.1 What the AI Agent Does

The AI Agent converses with people by telephone using an artificial voice, and by text message. Outside a customer's configured business hours, it answers inbound calls only and does not place outbound calls. It replies to inbound text messages and may follow up with a lead during business hours where no human has responded.

8.2 If You Received a Call or Text from an AI Agent

The business that contacted you decided to contact you and supplied your telephone number. KPI DRIVER provides the software. That business is responsible for having the legal right to contact you.

To stop being contacted: reply STOP to any text message, or tell the AI Agent during a call that you do not want to be contacted. Either is recorded as an opt-out and honored.

If contact continues after you opted out, or if you believe you were contacted unlawfully, email info@kpidriver.com. We will forward your request to the business and assist in resolving it.

You are entitled to know you are speaking with an AI. Our terms require customers to configure the Agent to disclose that it is an artificial intelligence system, and prohibit configuring it to claim to be human or to deny being an AI if asked.

8.3 Consent

Under a February 2024 FCC declaratory ruling, an AI-generated voice is an "artificial voice" under the Telephone Consumer Protection Act. Where the AI Agent initiates outbound contact, our customer is solely responsible for having and documenting the required consent. We do not obtain consent and cannot verify that our customer has it.

9. Call Recording

Calls made and received through the Platform are recorded and transcribed, including calls answered by the AI Agent. Recording law applies regardless of who placed the call. Florida is an all-party consent state under Fla. Stat. § 934.03.

Our customer is solely responsible for obtaining all legally required consents, for delivering any required notice at the start of a call, and for configuring the Platform's recording settings consistently with its obligations. KPI DRIVER does not obtain consent and does not verify that it was obtained.

If you were on a recorded call and were not told, that is a matter between you and the business that recorded it. Contact them directly; we will assist them in responding to you as described in Section 16.6.

10. Skip Tracing and Contact Data Lookups

This feature returns personal information about individuals — including property owners — who have not interacted with our customer and are generally unaware a lookup has occurred. It is the most sensitive processing on the Platform.

What we do. On our customer's instruction, we query a third-party contact data provider using an address, parcel identifier or telephone number, and return and store the results.

What our customer must do. Have a legitimate business purpose for each lookup; ensure it is permitted under applicable law; not use results for any FCRA-covered purpose; comply with all telemarketing law before contacting any number returned; and not use results for stalking, harassment or any unlawful purpose.

Do-Not-Call and litigator flags are informational signals from a third-party database. We do not warrant their accuracy, currency or completeness, and they are not a substitute for a customer's own scrubbing.

Accuracy. This data is compiled from public and commercial sources and is frequently outdated or wrong. It may associate a telephone number or address with the wrong person.

11. Who We Share Information With

11.1 Service Providers and Sub-Processors

We use third-party vendors to operate the Platform. Each is engaged under a written agreement requiring it to process information only to provide its service to us.

Business customers may request our current sub-processor list by emailing info@kpidriver.com.

11.2 AI Agent — Different Terms Apply

The AI Agent is delivered through a third-party conversational AI provider. Unlike our other service providers, that provider's terms reserve broader rights to use content processed through its service, including for its own research, analytics and product development.

This applies only to AI Agent conversation content — the calls and messages the Agent handles. It does not apply to any other data on the Platform. Customers who require that all conversation content be processed solely on a service-provider basis should not enable the AI Agent.

11.3 At Your Direction

Where you configure an integration, export data, or instruct us to transmit information, we do so.

11.4 For Legal Reasons

We may disclose information where we reasonably believe it is required to comply with law, legal process or a governmental request; to enforce our agreements; to investigate suspected fraud or security incidents; or to protect the rights, property or safety of any person.

11.5 Business Transfers

If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to the acquirer's continued obligation to honor this policy.

12. We Do Not Sell Your Information

Our position:

• We do not sell or share personal information for monetary payment, or for targeted advertising across sites.
• We do not share personal information for cross-context behavioral advertising or targeted advertising.
• We do not disclose Customer Data to advertisers, marketing networks or data brokers.
• Our disclosures to service providers are made under contracts that restrict them from retaining or using information for any other purpose, which excludes those disclosures from the statutory definition of "sale."

Contact data lookups. We provide lookup results to our customers in a service-provider capacity, on their instruction. We do not compile, retain or monetize this data independently of the customer relationship.

13. How Long We Keep Information

13.1 How Long We Keep Customer Data

We do not apply automatic expiry to Customer Data. We retain it for as long as your account exists — including while it is paused or inactive — so you can stop using the Platform and resume later without losing your history.

13.2 Deletion on Request

You may request deletion at any time. On request we delete the company record and all associated Customer Data within 30 days. Consent, opt-out and Do-Not-Call records are excepted.

13.3 Paused and Inactive Accounts

If you pause your subscription, core records are preserved. Storage-intensive data in the AI Suite may be deleted unless you arrange paid retention. Deletion is permanent — export anything you may need before pausing. This matters most for call recordings, which may be your only evidence that a person consented to be recorded.

13.4 Termination

On termination you have 30 days to export. After that we retain your data in an inactive state until you request deletion.

13.5 Records We Keep Regardless

Consent, opt-out and Do-Not-Call records are retained indefinitely, including after everything else is deleted. Financial transaction records are retained for seven years.

13.6 Backups

Information may persist in encrypted backups after deletion from live systems, and is removed when those backups are overwritten. We do not restore deleted data except in a disaster recovery event.

14. Security

We maintain administrative, technical and physical safeguards designed to protect information, including:

• Encryption in transit using TLS for all connections, and encryption at rest for stored data and files
• Role-based access control with tiered permissions and logical isolation between customer organizations
• Managed authentication through a specialist provider, with passwords stored only as hashes and never accessible to us
• Payment isolation — card data is captured and stored by a PCI-DSS Level 1 compliant processor and never transits our systems
• Least-privilege internal access, granted only where operationally required
• Audit logging of authentication events, administrative access and feature usage

Certifications. KPI DRIVER does not currently hold SOC 2, ISO 27001 or comparable independent certification. No system is perfectly secure. You are responsible for maintaining the confidentiality of your credentials and deactivating departing users promptly.

15. If There Is a Breach

If we determine that a security incident has resulted in unauthorized access to personal information, we will:

• Notify affected customers without undue delay, and in any event within 72 hours, by email to the account's designated contact;
• Provide the nature of the incident, the categories of data involved, the steps we have taken, and our recommended response;
• Cooperate with the customer's own notification obligations; and
• Notify individuals and the Florida Department of Legal Affairs directly where required under Fla. Stat. § 501.171.

Where we act as a processor, the customer determines whether notification to individuals or regulators is required and makes it. We provide the information they reasonably need.

16. Your Privacy Rights

16.1 Rights

Depending on your state of residence, you may have the right to: know and access the categories and specific pieces of personal information we hold; correct inaccurate information; delete information; obtain a portable copy; opt out of sale, sharing, targeted advertising and certain profiling; limit use of sensitive personal information; appeal a refusal; and not be discriminated against for exercising these rights.

These rights apply to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states as their laws take effect.

16.2 How to Exercise Them

Email info@kpidriver.com with the subject line "Privacy Request," or write to us at the postal address in Section 2.

16.3 Verification

We take reasonable steps to verify your identity before acting. Information provided for verification is not used for any other purpose.

16.4 Timing

We respond within 45 days, extendable once by a further 45 days where reasonably necessary.

16.5 Authorized Agents

You may use an authorized agent. We may require proof of authorization and may require you to verify your identity directly.

16.6 If Your Information Is in a Customer's Account

This is the most likely situation if you are a sales lead, a property owner, or someone an AI Agent spoke with. In that case we hold your information as a service provider on behalf of a business, and that business — not KPI DRIVER — controls it.

If you contact us, we will forward your request to the relevant customer. If we cannot reach the customer within 30 days — including where their account is paused, dormant or abandoned — we will act on your request ourselves so far as we are able.

Opt-out requests are different. If you tell us you do not want to be contacted, we record and forward that immediately and suppress the contact ourselves without waiting for the customer to respond.

16.7 Notice at Collection

This policy serves as our notice at collection under California law. The categories of personal information we collect are in Section 4; the purposes are in Section 6; our position on sale and sharing is in Section 12; and retention periods are in Section 13. We do not sell or share personal information.

16.8 Automated Decision-Making and Profiling

Two features produce automated evaluations of individuals: call scoring (of our customers' representatives) and lead qualification by the AI Agent. If you are a customer's employee or lead, that customer controls the processing. Direct any request to them. We assist as described in Section 16.6.

16.9 Appeals

If we decline your request, reply to our response with the word "Appeal." We respond within 45 days with our decision and reasoning.

17. Florida Digital Bill of Rights

The Florida Digital Bill of Rights, Fla. Stat. § 501.701 et seq., imposes obligations on "controllers" exceeding $1 billion in global gross annual revenue.

KPI DRIVER does not meet that threshold, and the FDBR's controller obligations therefore do not apply to us.

We have nonetheless drafted this policy to meet the substantive standards of the stricter state privacy laws, and we honor the rights in Section 16 for all United States residents regardless of whether a statute compels it.

18. Cookies and Tracking

18.1 What Cookies Are

Cookies are small text files placed on your device by a website. This section uses "cookies" to refer to all similar technologies including local storage, session storage and pixels.

18.2 What We Use

Strictly necessary cookies. Required for the Platform to function. These maintain your authenticated session, keep you signed in, provide security, and handle load balancing. Cannot be switched off. Duration: session-only to 30 days.

Functional cookies. These remember your interface preferences and record your cookie consent choice. Duration: up to 12 months.

Marketing website cookies. Our public websites include an embedded appointment booking widget. These set cookies necessary for page delivery, form functionality and booking widget operation. Duration: session-only to 12 months.

18.3 What We Do Not Use

We do not use advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not participate in advertising networks.

18.4 Managing Preferences

Most browsers let you block or delete cookies through their privacy settings. Blocking strictly necessary cookies will prevent you from signing in.

18.5 Global Privacy Control

We honor the Global Privacy Control (GPC) signal. If your browser transmits GPC, we treat it as a valid request to opt out of any sale or sharing of personal information and of targeted advertising. Because we do not sell or share personal information or engage in targeted advertising, GPC does not change how we handle your data — but we recognize and record the signal.

19. Links to Other Websites

Our websites and the Platform contain links to third-party websites and services. We are not responsible for the privacy practices, content or security of any third-party website or service, and this policy does not apply to them. Review those policies before providing information.

20. Children

The Platform is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. If you believe a child's information has reached us, contact us at info@kpidriver.com.

21. United States Only

The Platform is offered only to customers located in the United States, and is intended only for processing information about individuals located in the United States. All data is stored and processed in the United States.

We do not offer the Platform in the European Union, European Economic Area, United Kingdom or Switzerland. Customers must not use the Platform to contact, record or process the personal data of individuals located outside the United States without first contacting us.

22. Changes

We may update this policy. If a change materially affects how we handle personal information, we notify account administrators by email and post a notice in the Platform at least 30 days before it takes effect, except where a shorter period is required by law or necessary to address a security risk.

Continued use after the effective date constitutes acceptance.

23. Contact Us