This Privacy Policy describes how Poppy Marketing & Consulting LLC (“Poppy”, “we”, “us”, or “our”) collects, uses, and shares information about you when you use the Front Desk by Poppy service (“Service”), accessible at https://frontdesk.poppymarketingandconsulting.com and via SMS, voice, and web channels.
By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.
When you sign up for or use the Service, we collect:
When end consumers call your business via your Front Desk number, we automatically collect:
When you visit https://frontdesk.poppymarketingandconsulting.com, we collect standard web logs: IP address, browser type, operating system, pages viewed, referring URL, and date/timestamp. We do not use third-party advertising trackers.
We use the information we collect to:
We do not sell your information or your callers’ information to third parties for advertising.
We engage third-party service providers (subprocessors) to operate the Service. Each subprocessor is bound by a written contract that requires it to protect your information consistent with this Privacy Policy and our Data Processing Addendum, available at https://frontdesk.poppymarketingandconsulting.com/legal/dpa.
The current list of subprocessors is maintained at https://frontdesk.poppymarketingandconsulting.com/legal/subprocessors. We will provide at least thirty (30) days’ written notice (by email and on the subprocessors page) before adding or replacing a subprocessor that processes your data. You may object in writing within that notice window; if we cannot reasonably accommodate your objection, you may terminate the affected portion of the Service without penalty, as described in Section 4.4 of the Data Processing Addendum.
Subprocessor categories include (current providers listed on the subprocessors page): telephony, call recording storage, SMS messaging, A2P 10DLC registration, AI inference, database and storage hosting, application hosting, payment processing, web hosting, transactional outbound email, inbound email and shared drive, intake and operational records, and (Pro tier) scheduling.
We may share aggregated, de-identified data publicly in formats that do not identify any specific business or caller.
We may disclose your information when required by law, valid legal process, or to protect our rights, property, or safety, or the rights, property, or safety of our customers or others.
If Poppy is acquired or merges with another entity, your information may be transferred to the acquirer subject to this Privacy Policy. We will provide notice before your information becomes subject to a different privacy policy.
You are the controller of any personal information your callers provide. We process that information on your behalf as a service provider (under CCPA / CPRA terminology) and as a processor (under TDPSA terminology). The full processor obligations, subprocessor change rights, data subject request handling, security commitments, and audit rights are set out in our Data Processing Addendum, available at https://frontdesk.poppymarketingandconsulting.com/legal/dpa, which is incorporated into and forms part of the Customer Subscription Agreement when you use the Service.
By using the Service, you represent that:
We do not directly market to your callers. SMS messages sent on Pro customers’ behalf are transactional, scoped to the SMS Messaging and A2P 10DLC section below.
If a Customer uses Front Desk Pro, Poppy may send transactional SMS messages on the Customer’s behalf, such as lead alerts, booking confirmations, and related service messages. Poppy may process recipient phone numbers, message content, delivery status, opt-out status, and related metadata to provide SMS features. Poppy may also submit Customer business information, sample messages, use-case descriptions, and opt-in-flow information to Twilio, The Campaign Registry, mobile carriers, and related service providers for A2P 10DLC registration, vetting, delivery, filtering, and compliance purposes. Recipients may opt out of SMS messages by replying STOP and may request help by replying HELP.
Industry-standard SMS opt-out and help language is included in messages: “Reply STOP to unsubscribe. Reply HELP for help. Msg & data rates may apply. Msg frequency varies.”
Customer is responsible for maintaining any required SMS consent from message recipients, for not using Front Desk for marketing or promotional SMS unless separately approved by Poppy, for honoring opt-out requests received outside the Service, and for not asking Poppy to message anyone who has opted out. Carrier filtering, rejection, or suspension is outside Poppy’s control, and Poppy may suspend SMS features if compliance issues are detected.
The Service uses AI inference (provided by Anthropic, as listed on the subprocessors page) to handle inbound calls, generate transcripts and summaries, and assist with lead capture. Call audio is processed in real time for transcription. Transcripts and summaries are returned to your dashboard and stored consistent with Section 8 (Data retention).
We do not use your individual call data, your callers’ information, or your account data to train third-party AI models. AI model usage is limited to inference (running the model against your live calls) on the terms in our agreements with the model provider.
Subject to applicable law, you have the right to:
To exercise these rights, contact us at privacy@poppymarketingandconsulting.com. We will respond within forty-five (45) days, consistent with the response timelines under CCPA / CPRA and TDPSA. We may extend this period by an additional forty-five (45) days where reasonably necessary, with notice to you of the extension.
California residents: California Civil Code Section 1798.135 grants you specific rights regarding your personal information under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). The rights above incorporate the CCPA / CPRA framework for California residents.
Texas residents: the Texas Data Privacy and Security Act (TDPSA) grants similar rights. The rights above incorporate the TDPSA framework for Texas residents.
Your callers’ rights: rights of individuals who call your business are exercised through you as the controller. We will assist you in responding to those requests as described in the Data Processing Addendum.
We do not sell personal information for the purposes of CCPA / CPRA.
Call recordings, transcripts, summaries, call metadata, and caller contact details are retained while the subscription is active and for up to thirty (30) days after service access ends, unless a longer period is required by law, needed for security, billing, dispute, or legal purposes, or requested by Customer in writing. Customer may request export or earlier deletion during the applicable retention period, subject to legal, security, billing, and operational limitations.
| Category | Retention period |
|---|---|
| Account profile, settings, and integration credentials | Duration of your subscription |
| Subscription, billing, and tax records | Seven (7) years after service access ends, consistent with US tax and audit requirements |
| Acceptance and audit records (document versions accepted, timestamps, URLs, IP, user agent, Stripe session identifiers) | Seven (7) years after service access ends |
| Support, cancellation, and other communications with us | Two (2) years |
| Aggregated, de-identified analytics | Indefinite (no longer personal information) |
Subscriber Business Records are retained on standard US business-records and tax-audit timelines and apply to your own data as the subscriber, not to your callers’ data.
You can request earlier deletion of your data by emailing privacy@poppymarketingandconsulting.com. We will comply except where retention is required by law (for example, billing records subject to tax audit requirements) or where retention is needed for security, billing, dispute, or legal purposes. Where you request earlier deletion of Caller Data, we will act on your written instruction as the controller of that data, consistent with the Data Processing Addendum.
We implement reasonable physical, administrative, and technical safeguards:
No method of transmission over the internet or method of electronic storage is one hundred percent secure. We cannot guarantee absolute security, but we work to protect your information.
If we become aware of a Security Incident affecting personal information processed on your behalf, we will notify you without undue delay, and in any case within seventy-two (72) hours of confirmation. The notification will describe (to the extent then known): the nature of the incident, the categories and approximate volume of records involved, the likely consequences, the measures taken or proposed to address the incident, and a point of contact for further information. We will assist you in fulfilling any notification obligations you owe to your callers or to regulators.
A “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information.
The Service is not intended for individuals under 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, contact us at privacy@poppymarketingandconsulting.com and we will delete it.
The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. The data protection laws of the United States may differ from those of your country.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and by posting a notice on the Service at least thirty (30) days before the changes take effect. The “Last Updated” date at the top of this Privacy Policy indicates when it was last revised.
Questions, complaints, or requests:
Poppy Marketing & Consulting LLC 23015 FM 529 Rd, Ste 200 PMB1125 Katy, TX 77493 United States
privacy@poppymarketingandconsulting.com support@poppymarketingandconsulting.com cancel@poppymarketingandconsulting.com (cancellation requests)