STARLING AI LLC — PRIVACY POLICY

Starling AI LLC, a Texas Limited Liability Company

Effective Date: June 25, 2026

Last Updated: June 25, 2026

This Privacy Policy explains how Starling AI LLC (“Starling AI,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with our website at starlingagent.com (the “Site”) and the Starling AI platform, including our CRM software, AI-powered messaging and automation agents, workflow automation, integrations, and related services (collectively, the “Services”).

Starling AI provides a business-to-business platform. Capitalized terms not defined here have the meanings given in our Terms of Service and Membership Agreement (the “Agreement”). This Privacy Policy is incorporated into the Agreement. If there is a conflict between this Privacy Policy and the Agreement regarding the processing of personal data, the Agreement controls as between Starling AI and our Clients unless this Privacy Policy expressly states otherwise.

1. Who This Policy Covers

This Policy applies to:

Visitors to our Site;
Clients — the businesses and individuals who subscribe to or access the Services, and their Authorized Users; and
End Users — the contacts, leads, prospects, and other individuals our Clients communicate with or manage through the Services.

Important for End Users. When our Clients use the Services to manage their own contacts and send communications, the Client — not Starling AI — decides what data is collected, how it is used, and who is contacted. In that context, the Client acts as the “controller” (or “business”) and Starling AI acts as a “processor” (or “service provider”) that handles data on the Client’s behalf and under the Client’s instructions. If you are an End User and want to access, correct, or delete your information, or stop receiving messages, please contact the business that is communicating with you. You can also reply STOP to any text message to opt out, or HELP for help. We will route requests we receive to the responsible Client where appropriate.

2. Information We Collect

2.1 Information You Provide to Us. When you create an account, subscribe to a Plan, register a messaging brand or campaign, contact support, or otherwise interact with us, we may collect: your name, business name, email address, phone number, billing and business address, account credentials, the business and use-case information you provide for messaging registration (such as A2P 10DLC brand and campaign details), and the contents of your communications with us.

2.2 Payment Information. Subscription and other fees are processed through our third-party payment processor (Stripe). We do not store full payment card numbers on our systems. Our payment processor handles your card and billing details in accordance with its own terms and privacy policy and applicable payment-card security standards.

2.3 Client Data and End-User Data. In using the Services, Clients input, upload, import, sync, generate, and transmit data — including contacts, lead information, notes, pipeline and appointment data, and the content of messages and conversations (across SMS, email, and social channels). This includes End-User Data: information relating to the End Users our Clients communicate with, such as names, phone numbers, email addresses, message content, and conversation history. Starling AI processes this data on behalf of and at the direction of the Client.

2.4 Information from Integrations. When a Client connects a third-party account or service to the Services — for example, a CRM (such as Follow Up Boss, GoHighLevel, Lofty, or Real Geeks), a calendar or email provider (such as Google), or telephony/messaging infrastructure (such as Twilio) — we receive and process information from those services as needed to provide the connected functionality, and only with the Client’s authorization. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

2.5 Information Collected Automatically. When you use the Site or Services, we and our service providers may automatically collect technical and usage information, such as IP address, device and browser type, operating system, pages and features accessed, dates and times of access, referring URLs, and similar log and analytics data. We use cookies and similar technologies for authentication, security, preferences, and analytics (see Section 8).

3. How We Use Information

We use the information described above to:

Provide and operate the Services, including engaging, qualifying, and following up with leads; booking appointments; routing conversations; and syncing data across connected systems;
Process transactions and billing, including subscription fees, renewals, and applicable taxes;
Provide support and respond to your requests;
Secure the Services, prevent fraud and abuse, and enforce our Agreement and policies;
Develop, train, fine-tune, test, evaluate, and improve our artificial-intelligence models, prompts, workflows, and the Services (see Section 4);
Analyze usage and generate aggregated and de-identified statistics and benchmarks;
Communicate with you about your account, service updates, security notices, and — where permitted — products and features; and
Comply with law and respond to lawful requests and legal process.

4. Artificial Intelligence and Model Improvement

The Services use artificial intelligence, including third-party large language models, to generate messages and other outputs. To operate and improve the Services, Starling AI may use Client Data and End-User Data — including the content of messages, conversations, interactions, and other data passed through or generated by the AI Agent and the Services — to develop, train, fine-tune, test, evaluate, and improve our AI models, prompts, workflows, and the Services.

We conduct this activity in a manner designed so that one Client’s identifiable Client Data and End-User Data is not exposed or made available in identifiable form to another Client through the Services. This use may continue after a Client’s subscription ends with respect to data already processed and any resulting model improvements.

Clients are responsible for providing all required notices and obtaining all required consents and lawful bases from their End Users for this processing, as described in the Agreement. AI-generated outputs may be inaccurate, incomplete, or otherwise unsuitable, and should be reviewed before being relied upon or transmitted.

We do not sell Client Data or End-User Data. We do not disclose, license, or make available the identifiable content of Client Data or End-User Data to unrelated third parties for those third parties’ own independent or marketing purposes. We share information only as follows:

5.1 Service Providers (Subprocessors). We share information with vendors that help us provide and support the Services, bound by obligations to protect it and to use it only to provide their services to us. These include providers of:

Hosting and cloud infrastructure;
Database and storage (such as Supabase);
Telephony and messaging (such as Twilio);
Large language model and AI providers;
Payment processing (such as Stripe);
Authentication and integrations (such as Google); and
Analytics and operational tooling.

5.2 At the Client’s Direction. For Clients, we share and transmit data as the Client directs through its use and configuration of the Services, including to the third-party systems the Client connects and the recipients the Client chooses to contact.

5.3 Legal and Safety. We may disclose information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to enforce our Agreement, protect the rights, property, or safety of Starling AI, our Clients, or others, or to detect, prevent, or address fraud, security, or technical issues.

5.4 Business Transfers. If Starling AI is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality protections consistent with this Policy.

5.5 Aggregated and De-Identified Data. We may create and use aggregated, anonymized, statistical, and de-identified information (which does not identify any Client, Authorized User, or End User) for any lawful business purpose, including analytics, benchmarking, and improving and marketing the Services.

6. SMS, Messaging, and Your Opt-Out Rights

The Services enable our Clients to send SMS, voice, and email communications to their own contacts. As between Starling AI and the Client, the Client determines the recipients, content, timing, and consent status of those communications and is the sender for purposes of the Telephone Consumer Protection Act (TCPA) and analogous laws; Starling AI acts as a technology provider at the Client’s direction.

No mobile opt-in data is shared with third parties. Phone numbers, SMS opt-in, and consent information collected for messaging are not sold or shared with any third parties or affiliates for their own marketing purposes, and consent is never shared with third parties.

If you receive messages through the Services, you can reply STOP at any time to opt out of further messages, or reply HELP for assistance. Message frequency varies, and message and data rates may apply. Opt-out and revocation requests are honored by the responsible Client; if you contact us directly, we will route your request to that Client where appropriate.

7. Data Retention

We retain information for as long as needed to provide the Services, operate our business, comply with our legal obligations, resolve disputes, and enforce our agreements. For Clients, we retain Client Data and End-User Data for the duration of the subscription and, following termination, for a limited period during which the Client may request export, after which we may delete or de-identify the data in the ordinary course, subject to the Agreement and any data we are required or permitted to retain.

8. Cookies and Analytics

Our Site and Services use cookies and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage so we can improve performance. Most browsers let you control or block cookies through their settings; blocking some cookies may affect how the Site and Services function. Where required, we honor applicable browser-based opt-out preference signals.

9. Security

We implement commercially reasonable administrative, technical, and organizational measures designed to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee that the Services will be free from unauthorized access, loss, or other security incidents. Clients are responsible for maintaining the security of their account credentials and for keeping their own backups and copies of Client Data.

10. Your Privacy Rights and Choices

Depending on where you live and your relationship with us, you may have rights regarding your personal information. Where Starling AI processes End-User Data on behalf of a Client, the Client controls that data; please direct your request to the Client. For personal information we control (for example, our Client account and Site-visitor information), you may have the rights described below.

10.1 California (CCPA/CPRA). California residents may have the right to know what personal information we collect, use, and disclose; to access and delete personal information; to correct inaccurate personal information; and to be free from discrimination for exercising these rights. We do not “sell” or “share” personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes that would trigger a right to limit. To exercise these rights, contact us using the details in Section 14.

10.2 EU/UK/EEA (GDPR). Where the GDPR or UK GDPR applies, individuals may have rights to access, rectify, erase, restrict, or object to processing of their personal data, and to data portability. Where we process End-User Data on a Client’s behalf, the Client is the controller and individuals should direct requests to the Client. Where required, Starling AI and the Client will enter into a Data Processing Addendum.

10.3 How to Exercise Your Rights. You may submit a request using the contact details in Section 14. We will respond consistent with applicable law and may need to verify your identity before fulfilling certain requests. You may use an authorized agent where permitted by law.

11. Children’s Privacy

The Site and Services are intended for businesses and are not directed to children, and are not intended for use by individuals under 18 for personal, family, or household purposes. We do not knowingly collect personal information directly from children. If you believe a child has provided us personal information, please contact us so we can take appropriate action.

12. International Data Transfers

Starling AI is based in the United States, and we and our service providers process information in the United States and potentially other countries. If you access the Services from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above, and, where required, provide additional notice. Your continued use of the Site or Services after an update takes effect constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise a privacy right, contact us:

Starling AI LLC Texas, United States Email: admin@starlingagent.com Phone: (832) 808-6483