What we collect, why, who touches it, and how to have it deleted.

Plain words. Effective 2026-10-11. This policy applies to rosli.ai and to the Rosli AI receptionist service.

Cookie And Us LLC, doing business as Rosli (“Rosli,” “we,” “us,” or “our”), operates the Rosli AI phone receptionist for insurance agencies and other offices, the website at rosli.ai, the client dashboard, and the summary emails and text messages the service sends. Our address is 14101 129th Ave NE, Kirkland, WA 98034. This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have.

This policy covers three groups of people:

Callers: anyone who calls a phone number that an agency or office has forwarded to Rosli.
Business customers: the agencies and offices that sign up for Rosli, and the owners and staff they name on the account.
Visitors to rosli.ai.

If you are a caller, Rosli answered on behalf of the business you called. We process your information as that business’s service provider, and that business decides how it is used afterwards. For questions about how a specific agency uses your information, contact the agency directly. Our Terms of Service and Security page describe our obligations to the businesses we serve.

1. Information we collect

From callers. Rosli tells every caller at the start of the call that they are speaking with an automated assistant and that the call may be recorded or transcribed. During the call we collect what the caller says and what the business has configured us to ask for, which can include:

name, the number the call came from (caller ID), and a callback number;
the reason for the call and the caller’s relationship to the business (new customer, existing customer, third party);
intake details for the request, such as a mailing address, date of birth, email address, driver’s license number and state, vehicle details (year, make, model, VIN), policy number, carrier, and claim details (what happened, when, where);
a written transcript of the conversation and the language it was held in;
for returning callers, a small memory of safe fields only: name, language, email, address, date of birth, and call count. We never store a license number, VIN, or violation history in that memory.

We do not store audio. We keep a text transcript so the summary can be written; our telephony provider stores no recording either. Our speech provider (OpenAI) may retain audio for up to 30 days for abuse monitoring under its standard API terms. Rosli does not ask for payment-card numbers or health information, and is not designed to receive them; if a caller volunteers such information it may appear in the transcript.

From business customers. When an agency signs up at rosli.ai/get-started, or when we set an office up by hand, we collect the owner’s name, agency name, email address, and cell number; the agency’s carrier, website, main office number, phone system, and team size; the numbers Rosli should transfer and ring to; office hours, languages, and call-handling preferences; the mailbox that should receive call summaries; the email addresses allowed to sign in to the dashboard; and, if the owner chooses to receive call-summary text messages, the mobile number to text and the date and time consent was given. If you give us a website address we read public facts from it (address, hours, lines, languages) and ask you to confirm them. When billing is set up we collect the business’s billing contact and payment details through our payment processor; we never see the full card number.

From visitors to rosli.ai. Our hosting provider keeps standard server logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting. We do not run advertising pixels or third-party analytics on rosli.ai. The sign-up form records the submitting IP address to limit abuse.

Automatically, during the service. Call metadata (time, duration, the Rosli number dialed, the forwarding number, whether a transfer was accepted, delivery status of summary emails and texts), and operational logs. Our logs are redacted so that names, phone numbers, addresses, and policy details do not appear in them; a test in our build fails if that guard is removed.

2. How we use information

We use the information above only to:

answer, understand, and route calls for the business the caller reached, including recognizing returning callers;
produce the call summary, intake, message, or transfer preview that the business receives, by email, in the dashboard, and, for owners and staff who have opted in, by text message;
set up, operate, secure, support, and bill the business’s account, and send the emails that go with it (confirmation, test, summaries, sign-in links, notices);
detect and block spam, abuse, fraud, and misuse of the service;
improve the service, using aggregated or de-identified data that does not identify any business or caller;
comply with law and enforce our Terms.

We do not use caller information for advertising or marketing, and we do not send marketing messages to callers. We do not sell personal information, we do not rent it, and we do not share it with third parties for their own marketing. We do not use caller data to train AI models.

3. SMS notifications to business customers

Rosli can text an office owner or staff member a short summary when the AI receptionist takes a message or when a caller hangs up before finishing. These texts go only to business customers who have opted in, by checking the “Text call summaries to my cell” box on the sign-up form or by asking us in writing at support@rosli.ai. Rosli never sends text messages to callers, and sends no marketing or promotional texts. Message frequency varies with the office’s call volume, typically a few messages per day. Message and data rates may apply. Reply STOP to any message to cancel and HELP for help; opting out does not affect your service or your summary emails.

Mobile phone numbers and SMS opt-in consent will not be shared with or sold to third parties or affiliates for marketing or promotional purposes.

We record the number, the consent, and the date and time it was given, and keep that record for as long as the account is active plus four years so we can show that consent existed. The full program terms, including the opt-in process and the exact sign-up disclosure, are in our SMS notification terms.

5. How long we keep information

Call records and transcripts are kept for as long as the business’s account is active so the office can review them in its dashboard. Returning-caller memory is kept for the life of the account. Sign-up submissions, account settings, and consent records are kept for the life of the account; consent records for text messages are kept four years beyond that. Billing records are kept as tax and accounting law requires. Server and application logs are rotated within 30 days. We are building a scheduled purge that removes sensitive intake fields (license numbers, VINs, dates of birth) after a default of 30 days, with a retention period each office can set; the Security page says when it is in place.

When a business closes its account, we delete or de-identify the office’s call records, transcripts, caller memory, and settings as described on the Security page, except what we must keep for billing, legal, or consent-record purposes. Data held by our vendors is deleted on their own schedules under their terms.

6. Security

Data is encrypted in transit (TLS, including the phone leg) and at rest (AES-256 in our database). Every screen that shows caller data is behind sign-in: the client dashboard uses a one-time link sent only to the addresses the business lists, and our own operations pages are password-protected. Webhooks from our telephony and AI vendors are signature-verified. No method of transmission or storage is perfectly secure, and we cannot promise absolute security; the controls in place today, and the ones we are building next, are listed on the Security page. Summary emails carry caller details in plain text to the mailbox the business designates, and securing that mailbox is the business’s responsibility.

7. Your choices and rights

Callers. You may ask the business you called, or email us at support@rosli.ai with the business name and the phone number you called from, to have your call records and caller memory deleted. We remove them and confirm in writing, unless the business must keep them for a legal reason. You may also ask what we hold about you and have it corrected.

Business customers. Every call and transcript is visible in your dashboard; ask us for an export at any time. You can change any setting, address, or number by emailing support@rosli.ai, and stop text messages by replying STOP or by email. Closing your account deletes your office’s data as described above.

State privacy laws. Depending on where you live, you may have the right to know, access, correct, delete, or obtain a copy of your personal information, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context advertising, and we do not discriminate against anyone for exercising a privacy right. To exercise a right, email support@rosli.ai; we will verify the request against the information we hold and answer within the time the law allows. Where Rosli acts as a service provider to a business, we will pass the request to that business or direct you to it. Insurance-related information held by a licensed agency may also be governed by the Gramm-Leach-Bliley Act and state insurance privacy rules, which the agency is responsible for.

Do Not Track. rosli.ai does not track visitors across other sites and does not respond to browser Do Not Track signals, because there is nothing to turn off.

8. Children

Rosli is a business service and is not directed to children under 13. We do not knowingly collect information from children; a caller’s date of birth is collected only as part of an insurance request made by or for an adult. If you believe a child’s information reached us, email support@rosli.ai and we will delete it.

9. Where data is processed

Rosli is offered to businesses in the United States and Canada, and all data is processed and stored in the United States by the vendors listed above. If you contact us from elsewhere, your information is transferred to and handled in the United States under this policy.

10. Changes to this policy

We may update this policy by posting the new version at rosli.ai/privacy and changing the effective date at the top. For material changes we also notify business customers by email or in the dashboard before they take effect. The posted version is the one that applies.

11. Contact

Cookie And Us LLC, doing business as Rosli
14101 129th Ave NE, Kirkland, WA 98034
support@rosli.ai