What happens to the data these systems touch.

When someone talks to an agent we build for you, the conversation is processed: what they typed or said, what the agent replied, and any details they gave — a name, a phone number, an email address, a vehicle, an address, an appointment time.

On this website specifically, the chat assistant processes the messages you send it and a randomly generated session identifier. It is not connected to a customer account and does not ask for identifying details.

The Guided Solution Finder records the options you select and, if you fill it in, the free-text field naming your current tools. The recommendation is recalculated on our server from those answers. Nothing is stored until you ask for the result by email — completing the questionnaire and closing the tab leaves no record.

Forms on this site collect what you type into them, plus two hidden anti-spam fields: an unused decoy input and the time you began filling the form in.

When you arrive from a campaign link, the campaign parameters in the URL are held for the length of your visit and attached to anything you submit, so we can tell which campaign produced an enquiry. We keep the page you landed on and the hostname of the site that referred you — never the full referring URL, and never a record of the pages you browse.

No analytics or tracking scripts are loaded on this site. Google Analytics is not configured, so no measurement script is requested and nothing is sent to Google.

The code supports GA4 if it is turned on later. This page states which is true at the time it was built, rather than describing tracking that is not happening.

AI model providers process conversation content in order to generate a reply. Telephony and messaging providers carry voice and SMS. Our hosting and database provider stores the records.

Which specific providers apply to your build depends on what we implement for you, and they are named in your scope document before anything goes live — not discovered afterwards.

We do not sell data, and we do not share it with advertising networks.

We do not use your conversations or your customers’ data to train our own models. We do not have a model of our own to train.

The third-party model providers we use offer commercial terms that exclude API content from training their models. Where that matters to you, ask and we will confirm in writing which provider your build uses and which terms apply.

Website chat conversations are pruned automatically on a schedule. They exist so we can see what the assistant actually said and correct it, not as a permanent record.

Solution Finder submissions that never received contact details are deleted after 90 days — there is nobody to follow up with, so holding them longer would be collecting for its own sake. Submissions with contact details are deleted after two years.

For systems we build for you, retention is set during implementation and written into your scope. Conversation records usually live in your CRM, under your retention rules, because that is where your team needs them.

Contact and order submissions are kept while we are in contact with you about them.

We read and listen to conversations. That is not a side effect — it is how monthly management works, and it is how a weak answer gets found before a customer complains about it.

Review is limited to the people working on your account. It is not outsourced.

Access is restricted to the people who need it. Client portal accounts see only their own records, enforced at the database level rather than by hiding buttons in the interface.

Administrative access requires a verified role stored where a signed-in user cannot edit it.

Credentials for connected systems are stored server-side and are never sent to a browser.

Email hello@newlevelsmedia.com to request deletion of your data or your customers’ data, and say what you need removed.

For data held in your own connected systems — your CRM, your calendar — we can tell you what was written and where, but deletion in those systems is under your control, not ours.

Every agent we build has a route to a human: named topics, trigger phrases, or the customer simply asking. You set those rules and can change them at any time.

Agents identify themselves as automated. Beyond being the right thing to do, disclosure requirements for automated callers vary by state and are tightening.

You are the one who decides what the agent is allowed to say, and you approve the source material it answers from. If it is wrong because the source was wrong, that is a content problem, not a model problem — and we will help you fix it.

You are responsible for having the right to use the customer data you connect to the system, and for any consent or opt-out obligations that apply to messaging your customers.

You are responsible for telling us when something material changes — hours, pricing, services, staff — so the agent can be updated.

We do not hold SOC 2, HIPAA, or PCI attestation, and we do not claim regulated-industry compliance.

That rules out some work: handling protected health information, giving financial or legal advice, taking card details in conversation, or anything where a regulator expects a certified processor. If your use case needs that, we are not the right vendor and we will tell you on the first call rather than after a contract.