FALA Privacy Policy

Last updated: October 16, 2026

How ELAV8 AI LLC collects, uses, discloses, and protects personal information through FALA: the websites, the dashboard, the embeddable widget, our APIs and MCP server, and the Shopify app. It also explains your choices and rights.

Who We Are and What This Policy Covers

FALA (“FALA by Elav8”) is provided by ELAV8 AI LLC, a Florida limited liability company (“Elav8,” “we,” “us,” or “our”). This Privacy Policy describes how we handle personal information when you visit fala.elav8.ai (or a domain that redirects to it), create or use a FALA account, use the dashboard and the Architect, connect an AI assistant to FALA, install the Shopify app, or receive communications from us.

It also explains, at a high level, how we process information about people who talk to a FALA-powered assistant on a business’s website (“Visitors”). Those businesses decide how FALA is used on their sites, and their own privacy notices govern that use. Our Visitor Privacy Notice gives Visitors a plain summary.

This policy does not cover the websites, apps, or practices of our customers or of Third-Party Services, even when you reach them through FALA.

Our Role: Controller and Service Provider

For information about our own customers, prospects, and website visitors (such as account, billing, support, security, website analytics, and marketing data), Elav8 is the controller or “business.”

For Visitor information that FALA processes for a customer, such as conversations, transcripts, contact details, and form entries, the customer is the controller or “business,” and Elav8 is its processor or “service provider.” We process that information only on the customer’s behalf, under our agreement with the customer and our Data Processing Addendum. If you are a Visitor and want to exercise privacy rights, please contact the business whose website you used; we will help it respond.

Information We Collect

Information you give us: your name, email address, phone number, company, role, and profile details; the websites, brand assets, knowledge base materials, instructions, and settings you add to your workspace; what you say to or type for the Architect; information you submit through forms on our website (including the reason you are interested and your contact preferences); support requests and correspondence; and survey or feedback responses.

Account and billing information: your ELAV8 Account identifier, sign-in method, workspace and role, plan, subscription status, entitlements, and billing history. Payment card details are collected and stored by our payment processors, not by FALA.

Information collected automatically: device, browser, and operating system type; IP address and approximate location derived from it; pages viewed, links clicked, referring URL, and campaign parameters; dates and times of access; time zone; and log, diagnostic, performance, and security data. In the dashboard we also collect the product-usage telemetry described below.

Information from third parties: identity and account details from our account platform and from sign-in providers such as Google when you choose them; subscription and store information from Shopify when you install our app; information from integrations you connect; and, for advertising measurement on our own websites, information from advertising partners as described below.

Visitor Information Processed for Our Customers

When a Visitor talks to a FALA-powered assistant on a customer’s website, FALA processes the messages the Visitor types; what the Visitor says by voice, which is converted to text; the assistant’s replies; contact details and other information the Visitor chooses to share, such as a name, email address, phone number, or request; form fields the Visitor asks the assistant to fill; the address and content of the page the Visitor is on, so the assistant can guide them; and technical data such as a random visitor identifier stored in the Visitor’s browser, conversation identifiers, timestamps, and device and browser type.

Voice conversations in the widget are streamed in real time between the Visitor’s browser and our AI voice provider. FALA stores the text transcript of the conversation; it does not store audio recordings of widget voice conversations. We do not create voiceprints or other biometric identifiers, and we do not use voice to identify or authenticate anyone.

If a customer enables the feature, FALA may recognize a returning browser and remind the Visitor of contact details they shared before, in masked form (for example, “an email starting with b”), and asks whether they are still correct. Recognition is based on the browser identifier only.

The assistant is designed never to read or fill password or payment fields, and never to tick consent boxes or submit a form for the Visitor; the Visitor confirms every submission. Customers choose how long their Visitor information is kept.

How We Use Information

We use personal information to: provide, operate, and maintain FALA, including running AI voice and chat agents, building knowledge bases, generating Output, routing leads, sending handoff tickets, and syncing the integrations customers enable; create and manage accounts and workspaces; process payments, measure usage, and bill for it; provide support and respond to requests; send service, security, and transactional messages; and send marketing communications where permitted, which you can opt out of at any time.

We also use it to: secure the Services, detect and prevent fraud, abuse, spam, and violations of our terms, and enforce our agreements; debug, monitor, and improve the reliability and performance of the Services; understand how our websites and dashboard are used so we can improve onboarding and the interface; measure the effectiveness of our advertising on our own websites; comply with legal obligations and respond to lawful requests; and establish, exercise, or defend legal claims.

We use Visitor information only to provide the Services to the customer that deployed the assistant, and as that customer instructs, together with the limited operational uses (such as security, abuse prevention, and metering) that our Data Processing Addendum allows.

Artificial Intelligence and Your Data

FALA uses AI models from third-party providers, currently Google (Gemini), xAI, and OpenAI, to understand and generate speech and text, create embeddings for knowledge search, and generate images and configuration suggestions. Content is sent to these providers only as needed to produce a response.

We do not use customer content, Visitor conversations, or transcripts to train or fine-tune AI models, and we use our providers’ business API services, under which they do not use that content to train their models. Providers may keep prompts and responses for a limited period, typically up to 30 days, to detect abuse and comply with law, under their own terms.

FALA does not use AI to make decisions that produce legal or similarly significant effects about you. Customers are responsible for how they configure their agents and must ensure human review of any consequential decision.

Legal Bases for Processing (EEA, UK, and Switzerland)

Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases: performance of a contract (to provide the Services you request); our legitimate interests (to secure, maintain, and improve the Services, prevent abuse, measure our marketing, and communicate with business customers), balanced against your rights; consent (for non-essential cookies, certain marketing, and text messages), which you may withdraw at any time; and compliance with legal obligations.

How We Disclose Information

Service providers and subprocessors that host, store, secure, and help us operate the Services, process payments, send email and text messages, provide AI models, and support customer integrations, under contracts that limit their use of the information.

Affiliates of Elav8 that provide parts of the Services, such as our account and billing platform (ELAV8 Account) and our telephony service (Aether), under the same protections.

Third-Party Services a customer connects (such as a CRM, helpdesk, calendar, messaging tool, or knowledge source), when the customer directs us to send or receive information through them. A customer’s workspace administrators can see the conversations, leads, and settings in that workspace.

Advertising and analytics partners, only on our own websites and as described in “Analytics And Advertising.” We never share conversation content or knowledge base content with them.

Professional advisers, auditors, and insurers; law enforcement, regulators, courts, and other parties when we believe disclosure is required by law or necessary to protect the rights, property, or safety of Elav8, our customers, Visitors, or others; a buyer or successor in connection with a merger, acquisition, financing, reorganization, or sale of assets; and others with your consent or at your direction.

Vendors And Subprocessors

To deliver the service we rely on a limited set of categories of vendors: identity, entitlement, and payment providers; cloud hosting and managed infrastructure; object storage; AI model providers for voice, chat, embeddings, and image generation; transactional email; observability and security tooling; and customer-enabled CRMs, communications, and calendar tools.

We require vendors to process data only for authorized service purposes. A current, itemized Subprocessor List is available to signed-in customers on request.

Analytics And Advertising

On FALA’s own websites — fala.elav8.ai and the ELAV8 Account sign-in pages at id.elav8.ai — we use Google Tag Manager to load Google Analytics 4, Google Ads, the Meta (Facebook) Pixel, the TikTok Pixel, and the Reddit Pixel. These measure site traffic and how well our advertising works, including signup and product-demo conversion events.

To credit a conversion to the ad that led to it, we may also send Google and Meta a record of the conversion from our servers: for example, that an account was created or a paid plan started, its plan value, the ad click identifier captured when you arrived, and a one-way SHA-256 hash of the account email address. We never send your raw email address, name, phone number, conversation content, or knowledge-base content to an advertising platform, and we send none of this about anyone who has opted out as described in “Your Privacy Choices”.

These technologies run only on FALA’s own websites — never inside the embeddable widget on customer websites. You can also limit ad personalization through your Google, Meta, TikTok, and Reddit account settings and standard browser controls.

Your Privacy Choices

Some US state privacy laws treat the advertising measurement described above as “selling” or “sharing” personal information, or as targeted advertising. FALA does not sell personal information for money, but you have the right to opt out of that selling, sharing, and targeted advertising, and we will not treat you differently for doing so.

We process Global Privacy Control (GPC) signals in a frictionless manner. If your browser or a browser extension sends GPC, we treat that browser as opted out automatically: the advertising pixels are blocked and Google’s advertising storage is denied before they load, and if you sign in, your FALA workspace is opted out of server-side conversion records too. To use GPC, turn it on in a browser that supports it (such as Firefox, Brave, or DuckDuckGo) or add an extension listed at globalprivacycontrol.org.

You can also opt out at any time with the “Your privacy choices” link at the bottom of every FALA page, or by emailing support@elav8.ai with the subject “Do not sell or share”. A choice made with the link applies to that browser, and to your FALA workspace when you are signed in.

Product-Usage Telemetry

Inside the authenticated FALA dashboard, we collect first-party product-usage telemetry to understand activation, diagnose where builders get stuck, and improve onboarding and the interface. This includes the tabs and onboarding steps you reach, whether you start and connect a voice session, install-guide views and embed-snippet copies, session and active-time signals, and error and click-interaction events (including rage/dead-click detection).

This telemetry is first-party and operational: it stays within FALA, is never sold or shared with advertising networks, and never captures the content of your messages, keystrokes, form values, or knowledge-base text. Interaction coordinates are viewport-normalized and input fields are masked before anything leaves your browser. It is used solely to run and improve the service and is not collected inside the embeddable widget on customer websites.

Text Messages And Mobile Information

When you tick “Text me” on FALA’s website, we collect your mobile number and a record of your consent: the exact wording shown to you, the date and time, and the IP address and browser of the device that submitted the form. We keep that record, and any later opt-out, as evidence of your consent.

We use your mobile number only to send the FALA texts you agreed to and to honor your opt-out. Reply STOP to any message to opt out; we honor opt-outs promptly and always within ten business days.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of use exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

AI Assistants And Connected Apps

You can connect an AI assistant (for example ChatGPT, Claude or Cursor) to your FALA workspace through FALA's MCP server. You sign in with your FALA account and choose what it may do: read only, build, or publish. You can disconnect it at any time from your FALA workspace.

While connected, FALA receives the requests the assistant sends on your behalf (such as a website address or knowledge you ask it to add) and returns your workspace's brands, knowledge, widgets and install status. We record which tool was used and when, never the content of the request. The assistant's own handling of your conversation is governed by that assistant provider's privacy policy.

Emails We Send

We send transactional and service emails (for example, sign-in, security, billing, install, lead alerts, and usage notices), which are part of the Services. We may also send product updates and lifecycle emails to account holders, and follow-up emails to people who ask us to contact them, timed to arrive during business hours in the recipient’s time zone. Every marketing email includes an unsubscribe link, and you can also email support@elav8.ai to stop them.

Fala Research

Fala Research publishes studies about voice and text on websites. A customer may choose to include a widget in a study. When it does, FALA assigns each Visitor’s browser to a study arm inside the widget and counts, per day and per arm, how many browsers saw the widget, without storing any identity for those counts. Published findings use only aggregated, de-identified results and never identify a customer, User, or Visitor.

How Long We Keep Data

Workspace content (brands, knowledge bases, widgets and settings) is kept while your account is active and is deleted when you delete it or delete your account.

Leads and conversation transcripts are kept until you delete them, or until the retention period you set in FALA passes, after which they are deleted automatically.

Raw dashboard product-usage events are deleted after 180 days. Sign-in access for a connected AI assistant expires after one hour and its refresh token after 30 days unless you disconnect it sooner.

When you delete your account we delete its workspace data. We keep a record that the deletion happened, and consent records (including text-message opt-ins and opt-outs), which we keep as evidence of consent. Our billing provider, Paga/Elav8, keeps billing and tax records for as long as the law requires.

Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, storage with providers that encrypt data at rest, server-side workspace isolation, role-based access, sign-in through the ELAV8 Account with optional two-factor authentication, hashed API keys and access tokens, encrypted integration credentials, domain-locked widget keys, rate limiting, and an append-only audit trail of sign-ins, changes, exports, and administrative access.

No method of transmission or storage is completely secure, and we cannot guarantee the security of any information. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as the law requires.

International Transfers

Elav8 is based in the United States, and FALA is hosted in the United States. Our providers may process information in other countries where they maintain facilities. Where the law requires a transfer mechanism for information leaving the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, or on another lawful mechanism.

Children’s Privacy

FALA is a business service. It is not directed to children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact support@elav8.ai and we will delete it.

Rights And Requests

Customers may request access, correction, export, or deletion of account data, subject to legal, billing, security, and abuse-prevention retention needs. Most workspace content can be exported or deleted directly in FALA.

Depending on where you live, including if you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, or in the European Economic Area, the United Kingdom, or Switzerland, you may have the right to know what personal information we hold about you and how we use it; to receive a copy in a portable format; to have it corrected or deleted; to opt out of its sale, sharing, or use for targeted advertising (see “Your Privacy Choices”); to opt out of profiling in furtherance of significant decisions (we do not engage in such profiling); to restrict or object to certain processing; to withdraw consent; and to appeal a decision we make about your request.

To make a request, email support@elav8.ai with the subject “Privacy Request.” We will verify your identity by matching the information you provide with information we hold, and we may ask for more information to do so. You may use an authorized agent; we may require proof of the agent’s authority and ask you to verify your identity directly. We respond within the time the applicable law requires. If we deny your request, you may appeal by replying to our decision with the subject “Privacy Appeal,” and if your appeal is denied you may contact your state attorney general.

We will not discriminate against you for exercising your privacy rights.

Visitors should contact the business whose website uses the widget first; FALA will assist customers with verified privacy requests.

California Notice at Collection and Disclosures

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above: identifiers (such as name, email, phone number, IP address, and account and device identifiers); customer records (such as billing and contact details); commercial information (such as plans purchased and usage); internet or other electronic network activity (such as website, dashboard, and widget interactions); approximate geolocation derived from IP address; audio and electronic information (Visitor and Architect speech processed in real time and stored as text transcripts); and professional or employment-related information (such as company and role).

We disclose each of these categories for business purposes to the service providers and recipients described in “How We Disclose Information.” We have not sold personal information for money. We have “shared” identifiers and internet activity collected on our own websites with advertising partners for cross-context behavioral advertising, as described in “Analytics And Advertising,” and you may opt out of that at any time. We do not knowingly sell or share the personal information of consumers under 16.

We do not collect or use sensitive personal information to infer characteristics about you. We keep each category of personal information for as long as described in “How Long We Keep Data,” and otherwise only as long as reasonably necessary for the purposes for which it was collected, to comply with law, and to resolve disputes.

California residents may also request information about our disclosure of personal information to third parties for their own direct marketing purposes; we do not make such disclosures.

Do Not Track and Global Privacy Control

There is no common industry standard for browser “Do Not Track” signals, so we do not respond to them. We do honor Global Privacy Control signals as an opt-out of selling, sharing, and targeted advertising, as described in “Your Privacy Choices.”

Your Rights in the EEA, UK, and Switzerland

If data protection law in the European Economic Area, the United Kingdom, or Switzerland applies to you, you may exercise the rights described above, and you also have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first at support@elav8.ai.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, if the changes are material, notify account holders by email or in the Services before they take effect.

Contact Us

Privacy questions and requests: support@elav8.ai (subject “Privacy Request”).

ELAV8 AI LLC, a Florida limited liability company. Email support@elav8.ai. Our mailing address for formal legal notices is listed on our Contact page at fala.elav8.ai/contact.