Privacy, in plain English

We're a small team. We made mr CHUY. because we wanted a voice assistant that didn't feel like surveillance. So we built one we'd actually trust ourselves. This page tells you exactly what we do with your voice, your name, and your contacts — no legal-ese padding, no hidden clauses.

The short version

What we collect, and why

What	Why	How long
First name + last name + email	So Chuy can greet you, save your contacts to your account (not someone else's), and send you a welcome email.	Until you unsubscribe or ask us to delete
Your voice (audio stream)	Speech-to-text and AI response. Sent to OpenAI in real time.	Not retained. Streams through, never stored.
Conversation transcripts	Shown back to you in the chat bubble UI. Used for the Analyze feature if you turn on Listen mode.	Lives in your browser only. Cleared on session end.
Contacts you save	So Chuy can email people by name. Stored in our database, scoped to your email.	Until you delete them
Browser preferences (language, theme, voice)	So we don't ask twice. Lives in your browser only.	Until you clear browser storage. Skipped entirely if you reject non-essential cookies.
Usage events (session start, tool use, errors)	So we can fix bugs and know what features matter. No personal content captured.	30 days, then aggregated

Who else touches your data

We don't run our own AI or our own email servers. These are the companies who do the heavy lifting:

Company	What they do for us	What they see
OpenAI	Voice processing, AI responses	Your audio stream + conversation. Subject to OpenAI's API data policy — they don't train on it.
Supabase	Database (your name, email, contacts)	Encrypted at rest. Hosted in the US.
Vercel	Web hosting + serverless functions	Network logs (IP addresses, request paths) for ~24 hours.
Google Workspace (Gmail)	Sending welcome and notification emails on our behalf	Email content + recipient. Standard email sending.

We don't sell to any of them. They're processors acting on our instructions. If we ever swap one out we'll update this page.

What we don't do

• No voice biometrics. We don't create or store a "voiceprint." We can't tell two people apart by voice. (BIPA disclosure for Illinois residents.)
• No advertising or marketing trackers. No Google Analytics, no Facebook Pixel, no Mixpanel, no Segment, none of it.
• No selling your data. We have no business model that involves selling user data, and we won't pivot to one without telling you and giving you a real opt-out first.
• No reading your email inbox. When Chuy sends an email, we use Gmail to deliver it. We never log into anyone's account or read their inbox.
• No surveillance of your conversations. Transcripts shown in the app live in your browser. We don't aggregate them on our servers.

Your rights, and how to use them

You have all the standard rights, and you can actually use them — most of them just take an email to privacy@chuyvoice.com:

• Access — ask us what we have on you. We'll send you a JSON export.
• Correction — wrong name? wrong email? Tell us.
• Deletion — ask us to wipe your record. We'll do it within 30 days. The only thing we keep is your email on a "do not contact" suppression list, so we can guarantee we never accidentally re-add you.
• Portability — your data, your file. JSON export on request.
• Opt-out of marketing — every email we send has a one-click unsubscribe link at the bottom. Click it. Done.
• Withdraw consent — you can revoke consent for AI voice processing at any time by closing the app. The next session, the consent modal will ask you again.
• Cookie preferences — pick "Reject Non-Essential" in the cookie banner. We honor it.

California residents (CCPA/CPRA): Your "right to know," "right to delete," and "right to opt out of sale" are covered by the rights above. We don't sell your data so the opt-out is automatic.

EU/UK residents (GDPR/UK GDPR): Lawful basis is consent (you accepted the consent modal). Data transfers to the US are protected by Standard Contractual Clauses (SCCs). You also have the right to lodge a complaint with your local supervisory authority.

Canadian residents (PIPEDA): Standard PIPEDA principles apply. Contact privacy@chuyvoice.com for any privacy concern.

Virginia, Colorado, Connecticut, Utah residents: Same rights as above. We process the same way regardless of state.

Children

mr CHUY. is for users 13 and older. We require age confirmation in the consent modal (COPPA compliance). If you believe a child under 13 has used the app, email privacy@chuyvoice.com and we'll delete the record immediately.

Recording laws (Listen mode)

Listen mode transcribes audio in real time so Chuy can summarize it later. You are responsible for complying with recording laws in your jurisdiction. Many U.S. states require all-party consent (CA, CT, DE, FL, IL, MD, MA, MT, NH, PA, WA). EU laws vary by country. When in doubt: tell the people in the room that you're recording. It's polite and it's the law.

Security

We do the basics right and we're honest about what we don't do:

• HTTPS everywhere. Your traffic is encrypted in transit.
• Identity-cookie auth on personal-data endpoints (your contacts list isn't fetchable by guessing your email).
• HMAC-signed tokens for unsubscribe links and admin sessions.
• No SOC 2, no HIPAA, no enterprise compliance certifications. We're a small team building an MVP. If you need an app for handling regulated data (health records, etc.), we are not the right tool yet.

If we change this page

We'll update the "Last updated" date at the top. For material changes (new data we collect, new third parties, new uses), we'll show you a notice the next time you open the app and re-prompt for consent. We won't sneak changes past you.

Contact

Privacy questions or requests: privacy@chuyvoice.com
General support: support@chuyvoice.com
Operator: CleverAlpha LLC

A note on those addresses: we're standing them up as part of MVP launch. If you email and don't hear back within 24 hours, please also try the support email or the contact form on chuyvoice.com — we want to hear from you.