This Privacy Policy explains how Warm'd LLC (“Warmd,” “we,” “us”) collects, uses, discloses, and retains personal information. It applies to our website, the Warmd application, and the communications the platform sends.
1. The roles we play
Understanding this distinction explains everything else in this policy.
When you are our customer, we are the controller of your data. You signed up, and we decide how to use your account information to run our business. This policy governs that relationship, and you can exercise the rights in Section 9 directly with us.
When you are a lead (a consumer a business contacted using Warmd), we are a processor, not the controller. We hold your information because a business uploaded it and instructed us to contact you. That business decides what happens to it. We process it only to deliver the service they asked for. If you want your information corrected or deleted, the business that contacted you is the right party, and Section 10 explains how we help you reach them and what we can do directly.
2. Website visitors, waitlist, and our own text messages
When you visit our website or join our waitlist, we are the controller of the information you give us.
Information we collect from website visitors and waitlist sign-ups. When you join our waitlist on warmd.ai, we collect the email address you provide, along with your IP address, browser information, the form you signed up from, and the time. Our separate text updates form at warmd.ai/text-updates collects your email address and your mobile phone number, together with the same technical information. That form has two separate SMS consent boxes, one for account and service texts and one for marketing texts. When you check either, we also record the exact consent language of each box you checked and when you agreed. If you type a mobile number but check neither box, we do not keep the number.
Warmd text messages. If you opt in, Warmd will send you text messages about your waitlist status and demo requests, account and onboarding notifications, and replies to messages you send us; and, only if you also checked the marketing box, product updates and occasional marketing messages. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. Providing a phone number and consenting to texts is optional and is not a condition of joining the waitlist or of any purchase. See the Warmd SMS program terms.
We do not share mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes at any time. Mobile phone numbers, text messaging originator opt-in data, and SMS consent are never sold, rented, or shared with any third party, affiliate, or lead generator. The only parties that handle this information are service providers that help us deliver the messaging service itself, such as our messaging platform provider and mobile carriers, and they may use it solely to deliver messages on our behalf, not for their own purposes. All the categories of sharing described elsewhere in this policy exclude text messaging originator opt-in data and consent; that information is not shared with any third party.
To come off the waitlist or have this information deleted, write to admin@warmd.ai. If you consented to texts, we retain the record of that consent and of any opt-out for the period described in Section 8: it is the evidence that our messages to you were authorized, and the opt-out record is what stops us from texting you again.
3. Information we collect about customers
Affiliate links and the affiliate program. When you arrive by an affiliate’s link, we store that link’s referral code in your browser (see the Cookie Notice) and add one to a daily count of visits for that code; nothing that identifies you is kept with the count. If a workspace starts its first subscription with an affiliate’s code, we record which code it used. The affiliate then sees, for that workspace: the first three letters of the business’s name, the day it signed up, whether it is on a trial, paying or ended, and the commission its payments have produced. An affiliate does not see your name, your email address, your plan, your invoices, or anything inside your workspace. If you join the program yourself, we keep your name and email address, your codes, the visits, sign-ups and payments attributed to them, the payouts we record, and any tax form you give us, under our Affiliate Program Terms.
- Account information: name, business name, email, phone, and authentication identifiers, collected at signup through our authentication provider.
- Billing information: plan, billing contact, and payment metadata. Full card numbers are collected and stored by Stripe; we never receive or store them.
- Configuration and content: your agent persona, knowledge-base content, qualification questions, connected integrations, and business details.
- Usage and diagnostic data: feature usage, message volumes, API requests, IP address, browser and device information, and error logs.
- Communications with us: support requests and their content, including messages sent through in-product support.
4. Information we process about leads
On the instruction of our customers, we process the following about the consumers they contact:
- Contact and identity data: name, phone number, email address, and any other fields the customer supplies with the lead.
- Communications content: the text of SMS messages, emails, and chat messages.
- Derived information: qualification answers extracted from conversations, conversation summaries, disposition labels, and appointment details.
- Consent and compliance records: the consent basis the customer attested to, the exact disclosure text presented, timestamps, opt-out events, and the audit trail of every contact attempt and the rules applied to it.
Where a lead sends a customer’s public form, we also process the answers they give and the IP address they came from, for the consent record, rate-limiting and abuse prevention.
5. AI is involved in conversations
Text, email, and chat conversations are handled by an AI agent, not a human. The agent identifies itself as AI when asked; this is enforced by us and cannot be removed by a customer. A person in a conversation can ask for a human at any time, and the agent notifies the business.
Conversation content is sent to the AI providers listed on our Subprocessors page to generate replies and to extract structured information. Those providers are engaged under terms that prohibit them from using this content to train their models.
6. How we use information
We use personal information to:
- provide, operate, secure, and support the Service;
- deliver the messages our customers instruct us to send, and apply the compliance rules that govern them;
- authenticate users, prevent fraud and abuse, and enforce our terms;
- bill accurately and collect payment;
- maintain the consent, compliance, and audit records described in Section 8;
- improve reliability and performance using aggregated or de-identified data;
- send customers service and administrative messages and, with consent where required, marketing about our own product.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use lead conversation content to train foundation models.
Where the GDPR or UK GDPR applies to our processing of customer data, our legal bases are: performance of a contract (providing the Service), legitimate interests (security, abuse prevention, product improvement), legal obligation (recordkeeping, tax), and consent (marketing, where required).
8. Retention
We keep account and configuration data for as long as the account is active, and delete Customer Data 30 days after termination.
Consent records and compliance audit events are retained for 5 years. This is not a preference. These records are the evidence that a contact was authorized, and they are retained for that period to meet recordkeeping obligations and to defend claims. They are stored append-only and cannot be edited or deleted, including by us and including on request. Section 10 explains how this interacts with deletion rights.
9. Your rights as a customer or website visitor
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to opt out of sale or targeted advertising (we do neither), and to appeal a denied request. Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have these rights; so do residents of the EEA and UK.
Contact admin@warmd.ai to exercise them. We will verify your identity and respond within the period the applicable law requires, generally 45 days. We will not discriminate against you for exercising a right. If we deny a request you may appeal by replying to our response; if we deny the appeal you may contact your state attorney general.
10. If you are a lead and want your data removed
You can stop contact immediately by replying STOP to any text message, by telling the agent in a message that you do not want to be contacted, or by writing to admin@warmd.ai. Opt-outs are honored across every channel and are permanent unless you ask us to reverse them.
For deletion, the business that contacted you is the controller and decides. Write to admin@warmd.ai with the phone number or email that was contacted and we will identify the business and forward your request within 10 business days, and tell you who they are so you can contact them directly.
What we cannot delete: the record proving you opted out, and the underlying consent and audit records, are retained for the period described in Section 8. Deleting the opt-out record is the one action that could cause you to be contacted again, and the rest is the evidence that the contact was authorized. We will delete or de-identify everything else the controller instructs us to.
11. Security
We encrypt data in transit and at rest, isolate each customer’s data at the database level with row-level security enforced per request, encrypt third-party credentials with AES-256-GCM, hash API keys, restrict internal access on a need-to-know basis, and rate-limit and monitor our public endpoints.
No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the relevant authorities as required by law. Report a suspected vulnerability to admin@warmd.ai; we will not pursue legal action for good-faith research that respects user privacy and does not degrade the Service.
12. International transfers
We operate in the United States and our subprocessors process data there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ. Where required, we rely on Standard Contractual Clauses for transfers from the EEA, UK, or Switzerland; our Data Processing Addendum incorporates them.
13. Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal information. If you believe a child’s information has been provided to us, contact admin@warmd.ai and we will delete it. Our text message program is only for people 18 or older.
14. Changes and contact
We may update this policy. Material changes will be notified by email or in-product at least 30 days before taking effect, and the version and effective date at the top of this page always reflect the current text.
Privacy questions and requests: admin@warmd.ai. Data protection contact: admin@warmd.ai. Postal: Warm'd LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702.