Privacy Policy

Effective Date: January 1, 2026

jchowlabs, LLC (“jchowlabs,” “Company,” “we,” “us,” or “our”) is a California limited liability company that operates two service offerings:

• jchowlabs.com – a personal portfolio website with insights articles and interactive labs.
• jchowlabs.chat – a managed services provider that builds and manages AI voice agents on small business websites and telephone systems.

Our voice agents are built to process your voice in real time without retaining it — this policy explains what we do collect, what we don’t, and your rights. It covers your access to and use of our websites, including:

• https://jchowlabs.com
• https://jchowlabs.chat

(collectively, the “Sites”).

If you engage jchowlabs to build and operate a voice agent on your own branded website or telephone system, that client deployment is not covered by this Privacy Policy. Your deployment will be governed by your own privacy policy, and jchowlabs will act as your service provider under a separate written agreement. See Section 12 for the roles and responsibilities in that relationship.

By accessing or using the Sites, you acknowledge that you have read and understood this Privacy Policy.

1. Eligibility and Age Restriction

The Sites and all associated features are intended solely for individuals 18 years of age or older. We do not knowingly collect, process, or store personal information, voice data, or any other information from individuals under the age of 18. If we become aware that such data has been collected from a minor, we will promptly delete it.

By using the Sites, you represent and warrant that you are at least 18 years old. For our telephone-based voice agent, we are unable to verify a caller’s age before processing begins. By placing a call, you represent that you are at least 18 years old.

2. Scope and Intended Audience

The Sites are directed at residents of the United States. While the Sites are accessible over the public internet, our services and compliance posture are designed for a US-based audience.

We do not currently offer services in the EU/EEA and have not implemented GDPR compliance measures. If you are accessing the Sites from outside the United States, please be aware that your data will be processed and stored in the United States, and US privacy law may provide different protections than those available in your jurisdiction. We recommend you carefully consider whether to use the Sites or submit any personal information.

We reserve the right to restrict access to the voice agent feature from specific jurisdictions where doing so is appropriate in light of applicable biometric or voice-data laws. See Section 10.

What applies where.

On jchowlabs.com, “interactive labs” refers to the WebAuthn/passkey, facial liveness, and browser fingerprinting demos described in Section 3E. On jchowlabs.chat, the voice agent itself functions as an interactive lab — a live, hands-on demonstration of the product jchowlabs builds for clients.

3. Categories of Information We Collect

A. Information You Provide Directly

When you contact us directly through either Site, you may voluntarily provide:

• Name
• Email address

Providing this information is optional; however, certain features (such as scheduling a consultation) may not be available without it.

B. Voice Agent — Website Interactions

Each of our Sites includes an AI-powered voice agent. As you talk with the agent, it can navigate you to a relevant page, article, lab, or section of the site. Beyond that, the agent’s capabilities differ by Site:

• jchowlabs.com: The agent answers questions about the site’s content (research, articles, interactive labs) and helps you navigate to relevant pages.
• jchowlabs.chat: The agent answers questions about our managed AI voice services, helps you navigate the site, and can facilitate consultation bookings (see “Booking data” below).

AI disclosure. At the start of every voice session, the agent announces that it is an AI assistant — for example: “Hi, I’m the AI assistant for jchowlabs. How can I help you today?” We do not deploy agents that represent themselves as human.

Opt-in activation. The voice agent is only made available after you accept both this Privacy Policy and our Terms of Service on your first visit. Voice processing does not begin until you affirmatively click the voice button to initiate a session.

Zero Retention Mode — production agents. Our production voice agents operate with Zero Retention Mode (ZRM) enabled. Voice audio and speech-to-text transcripts are processed in real time and are not retained after the session ends — not by jchowlabs or its downstream processors. To generate a response, the text of your conversation is forwarded to a large language model (Google or OpenAI); this text is processed transiently and is not retained or used to train their models. We do not record, store, or have subsequent access to the content of your voice sessions.

Booking data (jchowlabs.chat only). If you choose to book a consultation through the jchowlabs.chat voice agent, it will collect your name and email address. This information is transmitted directly to our Cal.com scheduling account and used solely to schedule and follow up on your appointment. It is not used for marketing. The jchowlabs.com voice agent does not collect this information.

No voiceprints. We do not generate voiceprints, use voice data for speaker identification or authentication, or use voice data to train AI models.

C. Voice Agent — Telephone Interactions

On jchowlabs.chat, you may reach our AI voice agent by calling our published telephone number. Telephone calls are handled through Twilio (telephony) and ElevenLabs or Vapi (voice AI processing), depending on the agent’s configuration. Both platforms are used interchangeably and operate under the same Zero Retention Mode architecture described below.

AI disclosure. The agent announces it is an AI assistant at the start of every call before processing your request.

Zero Retention Mode. Our telephone production agents operate with Zero Retention Mode enabled. No audio or speech-to-text transcript is retained after the call ends. As with the website agent, conversation text is forwarded transiently to the large language model to generate responses and is not retained. Twilio retains standard call metadata — originating telephone number, called number, duration, and timestamps — which does not include call content.

No call recording. We do not enable call recording on our telephone agents. Call content is processed transiently in real time and discarded at session end; no recording is made.

Booking data. If you choose to book a consultation during a call, the voice agent will collect your name and email address, which are transmitted directly to our Cal.com scheduling account for appointment purposes.

No voiceprints. We do not generate voiceprints, use voice data for speaker identification or authentication, or use voice data to train AI models.

D. Development and Testing Environments

During development and testing of new or updated voice agents, we may operate non-production versions with audio recording and transcription enabled. These sessions occur solely between jchowlabs personnel and the client business owner for whom the agent is being built — they are never conducted with real end-users or members of the public. Development agents are configured separately from production agents and are not accessible to the general public.

Audio recordings and transcripts from development sessions are retained for up to 30 days and then deleted. We do not use development session data to train AI models or for marketing purposes. Client business owners who participate in development sessions do so under the terms of their engagement agreement (MSA and DPA), which governs consent to recording in that context.

E. Interactive Labs (jchowlabs.com)

jchowlabs.com includes interactive security and identity demonstrations. All of these run entirely within your browser:

• WebAuthn / passkey demos — demonstrate passwordless authentication concepts; no credentials are transmitted to our servers.
• Facial liveness detection — uses your device camera to demonstrate liveness-checking techniques; video and any derived data are processed locally in your browser and are never transmitted to or stored by us or any third party.
• Browser fingerprinting — displays the information your browser exposes to websites; this information is shown to you for educational purposes only and is not collected, transmitted, or stored by us.

None of these features transmit personal data to our servers. When you navigate away or close the browser tab, all locally processed data is discarded.

F. Cookies, Local Storage, and Tracking Technologies

We use a minimal number of cookies and browser storage mechanisms. We do not use advertising cookies, retargeting pixels, cross-site trackers, or analytics cookies.

First-Party Storage We Set

Consent Preference (localStorage) — We store your acceptance of both this Privacy Policy and our Terms of Service in your browser’s localStorage under the key jchowlabs-consent. This entry never leaves your device and is never transmitted to any server. It persists until you clear your browser’s site data for the relevant jchowlabs domain, or until we issue a material update to either document, at which point the notice will reappear.

Third-Party Cookies and Storage

• Voice agent widget (ElevenLabs or Vapi). When you accept both this Privacy Policy and our Terms of Service and the voice widget loads, ElevenLabs or Vapi — whichever powers that agent — may set its own cookies or storage entries to operate the widget. If you decline, the widget is not loaded and no such cookies are set. Governed by the ElevenLabs Privacy Policy or the Vapi Privacy Policy, as applicable.
• Hosting and content delivery providers. Our Sites are served through GitHub (static hosting) and Cloudflare (content delivery, edge routing, and security). These providers may set short-lived functional cookies necessary for site delivery and abuse prevention. These cookies are not used for tracking or advertising.

Cookies We Do NOT Set

We do not set or permit advertising or retargeting cookies, social media tracking pixels, cross-site tracking of any kind, or analytics or behavioral cookies.

Do Not Track

Because we do not use tracking, analytics, or advertising technologies on our Sites, DNT signals have no practical effect on our data practices.

Managing Your Consent Preference

You may reset your consent preference at any time by clearing site data or localStorage for the relevant jchowlabs domain in your browser settings. Once cleared, the privacy notice will reappear on your next visit.

G. Customer Portal (jchowlabs.chat)

The jchowlabs.chat customer portal is available exclusively to jchowlabs.chat business clients — it is not accessible to general website visitors. When you create a portal account, we collect:

• Account information: Name, business name, and email address
• Authentication: Passkey or email one-time password (OTP) — we do not store passwords
• Activity logs: Invoices paid, support tickets submitted, and agent usage statistics
• Payment processing: Invoices are generated and paid through Stripe; jchowlabs does not store payment card numbers or credentials

The portal does not collect or store voice data, end-customer data, or information about your customers’ interactions with the voice agent. Portal data is hosted on Amazon Web Services. It is retained for the duration of your engagement with jchowlabs and deleted within 30 days of engagement end, or upon your written request.

4. How We Use Information

We use collected information only to:

• Operate and maintain the Sites and voice agents
• Respond to managed services inquiries
• Schedule and follow up on consultation bookings
• Test and improve voice agent configurations during development (using only internal development sessions — not real end-user data)
• Monitor system performance, detect abuse, and maintain security
• Comply with applicable legal obligations

We do not sell personal information. We do not use personal information for advertising or commercial profiling. We do not use voice data, transcripts, or any other information collected through the Sites to train AI models or to develop new products.

5. Consent

Access to the voice agent requires affirmative consent. On your first visit to either Site, a notice asks you to review and accept both this Privacy Policy and our Terms of Service. If you decline, the voice agent is not loaded and no voice processing occurs. If you accept, the voice agent becomes available and voice processing begins only when you click the voice button to start a session. By accepting, you consent to the real-time voice processing described in this Policy.

For telephone-based interactions, you consent to AI-assisted call handling by continuing a call after the AI disclosure at the start of the call. If you do not wish to interact with an AI assistant, you may end the call at any time. We do not offer a human alternative for telephone inquiries.

Informational content on the Sites is accessible regardless of your consent choice.

6. Third-Party Service Providers

We use the following third-party providers to operate the Sites and our voice agent services:

Note on LLM providers. The language model used for any given voice agent depends on the applicable use case. We do not authorize any provider to use conversation data to train their models on our behalf.

These providers act as service providers or data processors and are contractually limited in how they may use data on our behalf. We do not authorize any service provider to use your information for their own independent marketing or commercial purposes.

Sub-processor updates. We may add, modify, or remove sub-processors as our technology stack evolves. We will update this Privacy Policy before a new sub-processor begins processing personal data collected through our Sites.

7. Data Retention

8. Data Security

We protect personal information with the following technical and organizational measures:

• Encryption in transit. All data between your device, our Sites, and our vendors is encrypted using TLS.
• Access controls. Administrative access to systems and vendor accounts that process personal data is restricted to the sole member of jchowlabs. Multi-factor authentication is enforced on all vendor accounts, with real-time alerts for any unrecognized login.
• Zero retention by default. Production voice agents are configured to process and discard voice data in real time — it is never written to persistent storage.
• Reputable vendors. Voice processing, telephony, and payment providers are selected in part for their security certifications (SOC 2, PCI-DSS Level 1 for payment processing, as applicable).

No system can guarantee complete security. In the event of a data breach affecting your personal information, we will notify affected individuals and relevant authorities as required under applicable law, including California Civil Code §1798.82.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Access a copy of your personal information
• Correct inaccurate personal information
• Delete your personal information (subject to limited exceptions)
• Limit use of sensitive personal information (including voice recordings) to the purposes for which it was collected. To exercise this right, email privacy@jchowlabs.com with the subject line “Limit SPI Use.”
• Non-discrimination for exercising your privacy rights

We do not sell or share personal information as defined under the CCPA/CPRA.

To submit a request: Email privacy@jchowlabs.com with the subject line “California Privacy Request” and a description of your request. We will acknowledge receipt within 10 business days and respond substantively within 45 days, with a possible extension of up to 45 additional days as permitted by law.

We will take reasonable steps to verify your identity before processing access or deletion requests. Because our production voice agents operate with Zero Retention Mode enabled, we do not retain voice session content that could be subject to a deletion request. For booking data and any other retained personal information, deletion requests will be honored promptly.

10. Biometric-Specific State Rights

Some states treat voice recordings as biometric data. Here is how our architecture addresses that: production voice agents operate with Zero Retention Mode enabled, meaning no voice audio or transcripts are retained after the session ends. Because nothing is stored, there is no retained biometric data against which retention, consent, or deletion obligations under applicable state biometric privacy laws would apply.

In addition:

• No voiceprints. We do not generate, store, or use voiceprints for speaker identification, verification, or any other purpose.
• No sale. We do not sell, lease, trade, or otherwise profit from voice data.
• Consent and notice. This Policy and the consent notice on first visit provide written notice of our voice data practices before any session begins. Accepting the consent notice constitutes your written consent to the processing described in this Policy.
• Interactive labs. The facial liveness detection demo on jchowlabs.com processes camera input locally in your browser. No image, video, or derived data is transmitted to our servers or retained.
• Deletion requests. To request deletion of any retained voice data, contact privacy@jchowlabs.com. For production sessions, no retained data exists; for development sessions, data is deleted within 30 days.
• Jurisdictional restrictions. We reserve the right to restrict availability of the voice agent to visitors from specific jurisdictions where doing so is appropriate given applicable law.

11. International Users

The Sites are operated from the United States. Our services are designed for a US audience, and we have not implemented compliance measures for non-US data protection frameworks. By accessing the Sites from outside the United States, you understand that your information will be transferred to and processed in the United States, and that US privacy law may provide different protections than those available in your jurisdiction. If you are located outside the US, we recommend you carefully consider whether to use the Sites or submit any personal information.

12. Managed Services and Client Sites

When jchowlabs builds, deploys, or operates a website or telephone voice agent for a client, the client is the data controller for personal information collected from their customers, and jchowlabs acts as the client’s service provider under applicable state privacy laws. The client is responsible for their own privacy policy covering their customers’ data. jchowlabs processes personal information solely for the purposes set out in the engagement agreement with that client and does not use client customer data for its own purposes.

This Privacy Policy does not govern data collected on a client’s site. If you are a customer of one of our clients and wish to exercise privacy rights, please contact the client directly.

Information jchowlabs Collects Directly From Clients

In the course of a managed services engagement, jchowlabs collects contact details, contract documents, and invoicing information from our client contacts. That information is collected by jchowlabs as a business in its own right, and this Privacy Policy governs its handling.

13. Accessibility

We welcome feedback on accessibility. If you encounter an accessibility barrier or need content in an alternative format, please contact privacy@jchowlabs.com and we will make reasonable efforts to help.

14. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted with a revised effective date. For non-material changes, continued use of the Sites constitutes acceptance. For material changes — particularly those affecting collection or use of sensitive personal information or voice data — we will provide advance notice and, where required, seek fresh consent before changes take effect. When we update to a new version, the privacy notice will reappear on your next visit so you can review and confirm your preference.

15. Contact Information

jchowlabs, LLC
privacy@jchowlabs.com