Privacy Policy

Last updated: October 9, 2026

AT Stellar LLC helps home-service businesses, such as HVAC companies, get found on Google and get calls worth answering. We work on our clients’ Google Business Profiles and local search rankings, run their Google Local Service Ads, work on how AI assistants recommend them, and answer and pre-qualify their calls around the clock with an AI receptionist. This policy explains what personal information we collect, why, which companies handle it for us, and what you can ask us to do with it. It covers our website, our ads on Facebook and Instagram, the calls we book with businesses interested in our service and the text messages we send them, our client portal, and the work we do for our clients.

Three groups of people are described here. Our prospects (people who visit this site, answer one of our ads or book a call with us), our clients (businesses who buy the service), and our clients’ callers and customers (people who phone a client’s business, or whom we deal with on a client’s behalf). What we hold, and who is responsible for it, differs for each — so each is covered separately below.

1. Who we are

This site and service are operated by AT STELLAR LLC (“we”, “us”), a New Jersey limited liability company, at 971 US Highway 202N, Ste N, Branchburg, NJ 08876. For privacy questions, write to mail@getatstellar.com.

Until October 2026 our service was called CallFlow. That is why you may still see the address needcallflow.com on this website and in our emails.

For information about our own prospects and clients, we are the controller — we decide what is collected and why. For the information described in section 4, we act as a processor on behalf of the client we are working for; that business decides what happens to it, and we handle it on their instructions.

2. Information about prospects

This section is about you if you use a form on our website, fill in a lead form in one of our ads on Facebook or Instagram, or book a call with us.

Forms on our website

When you use a form on our site, such as the one that books your free Google audit, we collect:

Your name.
Your business name and the city you work in.
Your mobile number and email address.
Your answers to the form's questions, such as whether you own the business.
Whether you ticked a box agreeing to text messages, and if you did: which box, its words, and when. The boxes are optional, and none is ticked for you (section 11).

On our contact page we collect your name and email address and, if you give them, your business name, your mobile number and your message, and the same record of the boxes.

The form saves as you type — before you press submit. Roughly every ten seconds, whatever you have typed into the enquiry form is sent to our server and stored, and it is sent once more if you close the tab. We do this so that a half-completed form still lets us follow up. It means that if you type your phone number and then change your mind and leave, we still have what you typed. We think you should know that rather than discover it. To have it removed, email us at mail@getatstellar.com — see Your rights.

We also automatically receive standard technical information any web server receives, such as your IP address and browser type, which we use to keep the service running and to apply rate limits that stop abuse.

Lead forms in our Facebook and Instagram ads

If you fill in a lead form in one of our ads, Meta sends us what you entered on it: usually your name, phone number and email address, and your answers to the form's questions. With it come the campaign, ad set and ad you responded to, whether you were on Facebook or Instagram, and when you sent it, and whether you ticked any consent boxes on the form. We use that to follow up with you, and to learn which of our ads bring businesses that book a call and become clients. If you haven't booked a call a few minutes later, we email you with a link to book, and may send a reminder the next morning. After that we may email you again from time to time, for up to four months after you sent the form: about the audit you asked for, or about a call you booked, missed or cancelled. Every such email has an unsubscribe link, and using it stops them. Our lead forms on Facebook and Instagram have no box for text messages, so we do not text you because you filled one in (section 11). We also let Meta know, from our server, that your lead came in (see section 6), so our ads can learn which people go on to book. If you go on to book a call or to become a client, we may tell Meta that too: section 6 says when, and what. What Meta itself does with your information is covered by Meta’s privacy policy.

When you book a call with us

You book through Calendly, on our website or from a link we send you. Calendly passes us your booking: your name, email address and phone number, the time you picked, and anything else you entered on the booking page. Then:

The person on our team who looks after your booking is sent reminders with your name, phone number and booking time, and may call you, from our phone system or their own phone, to confirm the call and remind you of it. They text you only if you ticked a box agreeing to text messages (section 11). We may also email or call you about the call you booked or the enquiry you started.
We note who on our team booked you and who runs the call, and afterwards how it went: whether it went ahead and, if you became a client, what you paid us. These are our own sales records.
If you came to us through one of our Facebook or Instagram lead forms, we match your booking to it by your email address or phone number, so we know which ad led to it. What we tell Meta about your booking, and about your becoming a client if you do, is in section 6.

3. Information about clients

If your business buys the service, we hold an account record containing:

Your email address, company name and phone number.
Your password, stored only as a bcrypt hash. We cannot read it, and we cannot tell you what it is.
Your chosen two-factor method (email or SMS) and the one-time login codes we send, which are stored hashed, expire after ten minutes, and are deleted once used.
The identifier of the voice agent that answers your calls, so we know which calls are yours.
Login sessions, as a random token that expires after seven days.

This website never asks for a card. There is no payment form anywhere on this site and no card details are collected, processed or stored by it. Our price is shown on our home page, and the service is invoiced separately — so nothing you type here is ever a payment.

Once you are a client, we also hold what we need to do the work:

The setup details the service is built from: your business name, phone numbers, business address, opening hours, the services you offer and the areas you cover, the languages your receptionist should speak, and any notes agreed with you.
Access to your Google Business Profile and your Local Service Ads account, the access you give us to work on them. The accounts stay yours, and you can remove our access at any time.
The photos and other material you send us to publish for you, such as photos of your jobs for your Google profile and website.
The results we track for you, such as where you rank on Google Maps and how many calls and leads you get, and what we discuss in your check-ins and weekly reviews.

Most of this is given on calls or by email rather than through this website.

4. Our clients’ callers and customers

Doing the work for a client means handling information about the people who deal with that business: mainly the people who call it, and the customers we ask for reviews. We handle it on the client’s behalf and on their instructions, and the client decides what happens to it.

Calls our AI receptionist answers

When our AI receptionist answers a call to one of our clients, it asks the caller's name and why they are calling, so that junk and sales calls can be screened out, and it can book an appointment or put the call through to someone at the business. We store, on that client's behalf:

The caller's phone number and, if they give it, their name.
An audio recording of the call, and a written transcript of it.
The time, date and length of the call and how it ended.
Anything the caller provided in order to book: appointment date and time, service address, and a description of the problem.

Recording consent is the business owner's responsibility. Many US states require that everyone on a call consents before it is recorded, and some require it before the recording starts. Our clients decide whether calls are recorded and are responsible for making sure callers are told and, where the law requires it, agree. If you called a business and want to know whether the call was recorded or want the recording deleted, contact that business — they control it. If you cannot reach them, write to us and we will pass the request on.

Review requests

If a client has us ask their customers for Google reviews, we receive those customers’ names and phone numbers or email addresses from the client, and use them only to send that client’s review requests — never for our own marketing. A review you leave is posted on Google under your own Google account, and Google’s privacy policy covers it. If you received a review request and don’t want another, reply STOP, or tell the business that did the work.

Local Service Ads

Leads and calls that come through a client’s Google Local Service Ads are collected by Google, which may record those calls, under Google’s own privacy policy. We see them in the client’s account, with the access the client gives us, to manage the ads and report results to the client.

5. How we use information

What we use	What for
Website form details	To contact you about the service you asked about, and to book and confirm your free audit.
Partially completed forms	To follow up with people who started an enquiry but did not finish it.
Facebook and Instagram lead-form details	To contact you about the service you asked about, and to learn which of our ads bring businesses that book a call and become clients.
Your mobile number, and the box you ticked for text messages	To send you the text messages you agreed to, and to stop when you reply STOP. See section 11.
Your booking, and how the call went	To remind our team, to confirm your call and remind you of it, and to keep our own sales records. Of how the call went, Meta is told one thing only: that you became a client, if you did (next line).
That you booked a call, and that you became a client	To tell Meta which of our ads led to a booked call, and which to a new client, so our ads reach businesses more likely to book and to become one. Never what you paid. See section 6.
Account details and login codes	To let you into your portal, and to verify it is you.
Client setup details, Google account access and the material you send us	To do the work you pay for — your Google profile, Local Service Ads, website and AI visibility — and to report your results to you.
Call recordings and transcripts	To show our client the calls their receptionist handled, and the jobs it booked.
Call timings and outcomes	To produce the statistics on the client's dashboard.
Customers’ contact details from a client	Only to send that client’s review requests.
IP address and request data	To keep the service available and to rate-limit abuse.

We do not sell personal information, and we do not use call recordings or transcripts to train our own AI models.

We send personal information only to the companies that work for us, to make the product work and to run our business. Each receives only what its job requires:

Provider	What it does	What it receives
ElevenLabs	Runs the AI receptionist on a client's phone line and generates demo voice audio	Call audio, transcripts, caller details; the name and company typed into the voice demo
Twilio	Sends SMS login codes	The mobile number of a client using SMS two-factor
Resend	Sends our emails: our team’s booking reminders, new-enquiry alerts and login codes. It also sends our first email and its reminder to someone who filled in one of our lead forms when our own mailbox at Google cannot (see Google, below)	Recipient email address and message contents, which can include the name, phone number and booking time of someone who booked a call with us, or the first name of someone who filled in a lead form
Kixie	Our team’s phone and text system: calls from our team, and text messages from our team if you agreed to them	Your name and phone number, and the calls and texts between us
HighLevel (GoHighLevel)	Sends and receives our text messages, through Twilio	Your name and mobile number, which box you ticked for text messages, and the text messages between us
n8n	Workflow automation that passes new enquiries to our team	What you give on our forms and lead forms (name, business, phone number, email), which form it came from and, for a Facebook or Instagram lead, which ad
Meta (Facebook and Instagram)	Runs our ads, and measures and optimises them	Website activity — see Cookies. When you fill in one of our lead forms: your email in hashed form and that lead’s ID, to say the lead came in. When you book a call: your name and email in hashed form, and, if you booked on our website, also your IP address, browser details and Meta’s own cookie identifiers. Sent from our server (Meta’s Conversions API). A booking made on our website is reported as a website booking. For a booking tied to your lead form we also send that lead’s ID, and we may hold it back when your answers suggest you are not an owner or manager of an HVAC business (we use your answers to decide, but never send them). If you become a client, we tell Meta that too, the same way: your email in hashed form and that lead’s ID. Never your answers themselves, never what you paid, and nothing else about how the call went.
Calendly	Runs the booking pages where you pick a time, and tells us about each booking	The name, email and phone number carried over from our forms, and anything else you enter on the booking page
Google	Google Calendar and Meet hold our calls with you. Our emails to people who filled in one of our lead forms go from our own mailbox at Google Workspace (Gmail), which also receives your replies. For clients, Google Business Profile and Local Service Ads, which we work on in the client’s own accounts	Your name and email address on the calendar entry for our call; your email address, your first name and the emails between us; for clients, what we publish on their Google profile, such as posts and photos
Google Sheets	A spreadsheet in our own Google Workspace account that our team works from, listing the people who filled in one of our Facebook or Instagram lead forms	What you gave on the lead form (name, email, phone number and your answers), which ad it came from, and how things went since: whether we emailed you, whether you booked, how the call went and any amount paid. If we delete your details, your line in it goes too.
Render	Hosts the application and its database	Everything stored by the service
Cloudflare	Serves and protects the website	Requests to the site, including IP address

The work we do for clients can also involve other tools, for example to send review requests or to host the websites we build. Each receives only what its job needs, and a client can ask us which ones we use for their account.

We may also disclose information if the law requires it, to enforce our Terms of Service, or as part of a merger or sale of the business — in which case we will say so before your information becomes subject to a different policy. Your agreement to text messages is never passed on in a merger or sale: it was given to us, for our own text messages (section 11).

7. Cookies and tracking

Portal session cookie (dl_session) — strictly necessary. It keeps a client logged in for up to seven days. It cannot be read by JavaScript and is only sent over HTTPS in production.
Browser storage — after a successful portal login we store a single flag in your browser recording that the last visit ended logged in, so the dashboard can start loading sooner. It contains no personal information and no session token.
Meta Pixel — on our public website only, never in the client portal. It reports website activity to Meta for advertising measurement and sets Meta's own cookies. You can opt out through your browser settings, an ad blocker, or your Meta ad preferences. When you book a call, our server also sends Meta a copy of that booking (the Conversions API, described in section 6); an ad blocker does not stop that copy.
Our own website analytics — on our public website only. It sets no cookies and sends nothing to a third party: the measurements stay on our own server. For each visit we record a random identifier held in your browser's storage, which pages you viewed, how long the tab was open and in use, how far down the page you scrolled, which buttons and funnel steps you reached, the site you arrived from, and a device and browser category. We do not store your IP address or your full browser identifier, and none of it is linked to you unless you enter your details in the form yourself. If your browser sends a Do Not Track signal, this measurement does not run at all.

We do not use analytics or advertising trackers inside the client portal.

8. How long we keep information

Enquiries, lead-form details, bookings and partially completed forms: 12 months from your last contact with us, unless you ask us to delete them sooner. If you become a client, they are kept with your client account.
Text messages: the record of the box you ticked (which box, its words, and when) is kept with your enquiry or lead-form details, for as long as they are. A number that replied STOP stays marked as not to be texted in our phone and messaging system, so that we don’t text it again.
Client accounts: for as long as the account is open, and 6 months after it closes.
Records of what clients paid us: for as long as tax and accounting law requires.
What we hold for a client — call recordings and transcripts, and the customer details we use for review requests: for as long as that client keeps their account, unless they ask us to delete it sooner. It is deleted when the account is closed and the period above has passed. What we published on a client’s Google profile stays there, because the profile is theirs.
What we send Meta: the details for each thing we tell Meta (that your lead came in, that you booked, that you became a client) wait on our server only until they are sent, and are dropped if they cannot be sent within seven days. When you book on our website, the note of your IP address and browser that goes with it is kept for three hours at most.
Login codes: ten minutes, or immediately once used.
Login sessions: seven days, and expired ones are purged.
Website analytics: the detailed event record is deleted after 180 days and the per-visit summary after 12 months, automatically.

9. How we protect information

Concretely, and not as a slogan:

Traffic is served over HTTPS, and browsers are instructed to refuse plaintext connections to this site.
Client passwords are stored as bcrypt hashes, never as text.
Portal login requires a second factor — a one-time code sent by email or SMS, stored hashed, single use, limited attempts.
Call recordings are not on the public web. They are stored outside the website's public folder and served only through a route that checks your session and confirms the call belongs to your account.
Each client's data is scoped to their own account in every query the portal makes.
API keys and credentials are held as server-side environment variables and are never sent to the browser.

No system is perfectly secure, and we cannot promise that it is. If a breach affects your personal information, we will notify you and any regulator that the law requires us to notify.

10. Your rights and choices

Wherever you live, you can ask us to:

Tell you what we hold about you, and give you a copy.
Correct anything that is wrong.
Delete it, including anything a partly-filled form captured.
Stop contacting you about the service.

Email mail@getatstellar.com and we will respond within 30 days. We may need to confirm your identity first. Exercising any of these rights costs nothing and we will not treat you differently for it.

To stop our text messages, reply STOP to any of them or just tell us; for help with them, reply HELP (section 11). To stop us calling you, just tell us. To stop marketing email, use the unsubscribe link or just tell us.

If your request concerns a call you made to one of our clients' businesses, or a review request you received from one, please see section 4 — that business controls those records and we will forward your request to them.

11. Text messages (SMS)

This section is about the text messages AT Stellar LLC sends to people who asked us for a free audit or booked a call with us.

Only if you agreed. We text you only if you ticked a box agreeing to text messages on one of our forms. Ticking a box is optional: no box is ticked for you, it is not a condition of purchase, and you can send the form without it. One exception: if you text us first, we answer you.
What we send. Only what the box you ticked says. There are two kinds of box, and a form can have both. One is for text messages about your request and your appointment: a confirmation of your call, reminders before it, the link to join it, word of a change, and answers to what you text us. The other is for marketing text messages: offers and examples of our work. Agreeing to one is not agreeing to the other.
What we collect for it, and how we use it. Your mobile number and your name; which box you ticked, its words, and when; and the text messages between us. We use them to send you the messages you agreed to, to answer you, to stop when you ask, and to be able to show that you agreed.
How often. Message frequency varies.
What it costs. We don’t charge for text messages. Message and data rates may apply.
To stop. Reply STOP to any text message from us.
For help. Reply HELP, or reach us at mail@getatstellar.com or +1 (973) 418-3063.

We do not sell, rent or share your mobile number or your text-message consent with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third party, except the companies that work for us to send the messages and to keep our records: the providers that deliver the messages (our phone and messaging providers and the mobile carriers) and the companies in section 6 that store our records. Your agreement to text messages is not passed on if the business is ever merged or sold.

The terms for these text messages are in section 17 of our Terms of Service.

12. US state privacy rights

If you live in California, Colorado, Connecticut, New Jersey, Virginia or another state with a comprehensive privacy law, you have the rights listed above, plus the right to appeal if we refuse a request and the right not to be discriminated against for exercising them.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by California law, other than what we tell Meta about visits to our website, lead forms, bookings and new clients (sections 6 and 7), which some laws may treat as sharing. Your mobile number and your agreement to text messages are never part of that (section 11). You can opt out of the Meta Pixel using the methods in section 7.

California residents may also designate an authorised agent to make a request on their behalf.

13. Children

This is a service sold to businesses. It is not directed at anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. If the change is significant, we will tell affected clients directly rather than rely on you noticing.

15. Contact us

AT STELLAR LLC
971 US Highway 202N, Ste N, Branchburg, NJ 08876
mail@getatstellar.com
+1 (973) 418-3063

← Back to AT Stellar LLC Terms of Service