01 Scope & Our Roles
This Policy describes how CMADE handles personal data in connection with cmade.ai and the CMADE AI-employee service (the "Service"). CMADE plays two roles, and your rights depend on which applies:
- As a "controller" for our own business and account data — the information our direct business customers ("Clients") provide to buy and manage the Service, plus website-visitor data — we determine why and how that data is processed.
- As a "processor" for the operational data your AI employee handles on your behalf — appointments, leads, messages, and end-customer information you choose to route through it — we process that data only on your documented instructions under a data-processing agreement. For that data, you (the Client) are the controller and are responsible for the lawful basis, notices, and consents owed to your own customers.
Under the Colorado Privacy Act ("CPA," C.R.S. §§ 6-1-1301 to 6-1-1313), personal data processed in a purely commercial or employment context is generally outside the CPA's "consumer" protections, while data about individuals acting in a personal or household capacity (for example, your end-customers) generally falls within it. We honor the rights below for any data subject entitled to them under applicable law. The Service is intended for U.S.-based businesses.
02 Information We Collect
(a) Waitlist & account information you provide
When you join the waiting list or become a Client, we collect the details you submit through our forms: business name, your name, email, phone number, industry / trade, the tasks you want your employee to do, your budget or plan interest, and the business details you share to help us design and configure your employee (such as business hours, services offered, common customer questions, tools to connect, and brand-voice notes), plus billing-contact information.
(b) Operational data your employee processes
Appointments, leads, inbound and outbound calls, texts and emails, message and call content, and the end-customer information you choose to route through the Service. Depending on your configuration, this may include voice recordings or voiceprints and, in some setups, precise geolocation — categories treated as sensitive data under Colorado law (see Section 14).
(c) Usage, performance & diagnostic data
Logs, metrics, error reports, and device or telemetry data describing how your employee and its device are performing, which we use to operate, secure, and support the Service.
(d) Website data
When you visit cmade.ai, we collect limited data through strictly necessary cookies and basic analytics (see Section 10), which may include IP address, device and browser type, and pages viewed.
We practice data minimization: we collect only what is reasonably necessary for the purposes in Section 3, and we do not process it for unrelated secondary purposes without the consent the law requires.
03 How We Use Your Information
- Design, build, configure, operate, secure, monitor, troubleshoot, support, and improve the Service and your specific employee;
- Confirm and manage your waitlist spot, and respond to your inquiries;
- Authenticate users and administer accounts through your CMADE OS / Employee Hub;
- Process payments, billing, and subscriptions (via Square — Section 8);
- Communicate with you about the Service, including service, security, renewal, and — where you have opted in — occasional product updates;
- Maintain security, detect and prevent fraud or abuse, and enforce our agreements; and
- Comply with legal obligations and respond to lawful requests.
We do not use the content of your operational data to train general-purpose or third-party AI models, and we do not use it for our own marketing.
04 Legal Bases for Processing
The Colorado Privacy Act does not use the "legal basis" framework found in some other laws, but for transparency, we process personal data on the following grounds:
- To perform our contract with you — building, running, billing, and supporting your employee, and handling waitlist requests you submit;
- Your consent — where required, such as marketing calls, texts, or emails, and for processing sensitive data (Section 14). You may withdraw consent at any time;
- Our legitimate business operations — securing the Service, preventing fraud and abuse, and improving our fleet using de-identified data, in ways consistent with your reasonable expectations; and
- Legal compliance — meeting tax, accounting, recordkeeping, and other legal obligations, and responding to lawful requests.
05 Fleet Improvement (The Evolve Loop)
We continuously improve our fleet of employees. For this purpose we use only de-identified and/or aggregated performance and operational signals — never your Clients' or end-customers' identifiable personal information, and never to benefit a competing Client. Where we de-identify data, we commit, consistent with C.R.S. § 6-1-1303(11): (i) to take reasonable measures to ensure it cannot be re-associated with an individual or device; (ii) to maintain and use it only in de-identified form; and (iii) to contractually obligate any recipient to the same. We do not attempt to re-identify de-identified data except to test our own safeguards.
07 No Sale; No Targeted Advertising or Profiling
We do not "sell" personal data within the meaning of the CPA, and we do not process personal data for targeted advertising or for profiling that produces legal or similarly significant effects. Because we do not engage in these activities, there is nothing to opt out of. If that ever changes, we will update this Policy and provide a clear opt-out, including recognition of universal opt-out mechanisms such as the Global Privacy Control, as required by C.R.S. § 6-1-1306(1)(a) and 4 CCR 904-3.
08 Payments & Card Data (Square)
All payments and billing are processed by Square. When you pay, your card details are entered into and handled directly by Square — CMADE never sees or stores your full card number, security code, or bank credentials. Square processes that information as an independent controller under its own privacy terms; we recommend reviewing Square's privacy notice for how it handles payment data. We receive only limited billing confirmations (for example, that a charge succeeded and the last four digits) needed to manage your subscription.
09 Customer Messaging, Consent & Opt-Outs
(a) Our messages to you
If you provide your phone number and opt in, CMADE may contact you by call, text, and email about your waitlist spot, your inquiry, and — where you consented — CMADE products and updates, including with automated or AI-assisted technology. Consent is not a condition of any purchase. Message frequency varies and message-and-data rates may apply. You can opt out of texts by replying STOP (reply HELP for help), and unsubscribe from marketing emails using the link in any such email; every marketing email includes a valid postal address and unsubscribe mechanism, and we honor opt-outs as required by the TCPA and the CAN-SPAM Act.
(b) Your employee's messages to your customers
When your AI employee contacts your customers by call, text, or email, you are the controller of that communication and are solely responsible for complying with applicable law — including the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, state telemarketing and consent laws, and the Colorado No-Call and consumer-protection rules — and for obtaining all required prior consent and honoring opt-outs (for example, replying STOP, unsubscribe links, and do-not-call requests). CMADE provides opt-out-handling tools to support your compliance, and you agree to the consent representations and indemnity in our Terms of Service.
11 Data Security
We use commercially reasonable, industry-standard safeguards designed to protect personal data, including encryption in transit and at rest, per-Client isolated devices, a private network not published to the public internet, role-based access controls, logging, and spend caps on AI usage. No method of transmission, storage, or security is perfect, and no system can be guaranteed against every breach; we do not warrant that the Service or your data cannot be accessed or compromised. Security is a shared responsibility — you agree to maintain the security of your own accounts, credentials, and connected tools. We maintain administrative, technical, and physical safeguards reasonably designed to protect personal data, consistent with our duty of care under C.R.S. § 6-1-1305(5).
12 Data Retention & Secure Wipe
We retain information for as long as your subscription is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting, or dispute-resolution obligations — and no longer than reasonably necessary. On cancellation or termination, the CMADE software, brain, security, monitoring, and operational data on your device are deactivated and securely wiped, except records (such as billing) we are required or permitted by law to retain. On request, we will confirm deletion to the extent feasible.
13 Client Data Ownership
Your business data is yours. As between you and CMADE, you own the business and end-customer data you provide or route through the Service, and we process it on your behalf under a data-processing agreement. CMADE owns its software, agent designs, prompts, models, configurations, and systems (the "CMADE IP"), as described in our Terms of Service. Our handling of your data as a processor does not transfer ownership of your data to us, and does not transfer ownership of our IP to you.
14 Sensitive Data
Some configurations process sensitive data as defined by Colorado law — for example, biometric identifiers such as voiceprints (under Colorado's biometric-privacy amendments, HB 24-1130, effective July 1, 2025) and precise geolocation, where applicable law treats it as sensitive. We process sensitive data only where we have a lawful basis and, where required, consent, and we maintain a retention-and-deletion schedule for biometric identifiers as required by law. Because much of this data belongs to your end-customers, you (the Client) are responsible for obtaining any required consent from those individuals before routing their sensitive data through the Service, and you instruct us to process it on that basis.
15 Your Privacy Rights & How to Exercise Them
Depending on your jurisdiction and the role in which we hold your data, you may have the right to: access — confirm and obtain a copy; correct inaccuracies; delete your personal data; obtain a portable copy; and opt out of any sale, targeted advertising, or qualifying profiling (we do not currently engage in these — Section 7).
To make a request, contact contact@cmade.ai. We will authenticate your request, respond within 45 days, and may extend once by 45 days when reasonably necessary, with notice (C.R.S. § 6-1-1306).
Appeals
If we decline to act, we will explain why and provide an easy way to appeal. If we deny the appeal, you may contact the Colorado Attorney General at coag.gov/file-complaint (C.R.S. § 6-1-1306(3)).
End-customer requests
If you are an end-customer whose data was routed through a Client's AI employee, we generally act as a processor and will refer your request to the relevant Client (the controller) and assist them in responding, as the law requires.
16 Children's & Minors' Data
The Service is built for businesses and is not directed to anyone under 16, and we do not knowingly collect personal data from individuals under 16. If we learn we have collected such data without a lawful basis, we will delete it promptly. (For reference: the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, applies under 13; the CPA's provisions on minors' data, as amended, impose heightened duties for known minors under 18, and we apply heightened care to any known-minor data. Colorado law does not require, and we do not operate, an age-verification system.)
17 Out-of-State & International Users
CMADE operates in the United States, and the Service is intended for U.S.-based businesses. Personal data we handle is processed and stored in the United States. If you access cmade.ai or use the Service from outside the United States, you understand your information will be transferred to, processed, and stored in the U.S., where data-protection laws may differ from those in your location, and you consent to that processing.
18 Data Breaches
If a security breach affecting personal information occurs, we will investigate, act reasonably to contain and remediate it, and provide notice as required by the Colorado data-breach statute (C.R.S. § 6-1-716) and other applicable law.
19 Changes to This Policy
We may update this Policy from time to time. Material changes will be indicated by an updated effective date and, where required, additional notice. Continued use of the Service after an update takes effect constitutes acknowledgment of the revised Policy.
20 Governing Law & Precedence
This Policy is governed by the laws of the State of Colorado and applicable U.S. federal law, without regard to conflict-of-laws rules. If this Policy conflicts with a signed Client Service Agreement, the Service Agreement controls for contractual matters and this Policy controls for privacy-notice matters. Commercial terms — fees, automatic renewal, refunds, disclaimers, limitation of liability, and indemnity — are in our Terms of Service, which is incorporated by reference.
21 Contact
For privacy questions or to exercise your rights, contact our data-protection contact:
CMADE LLC
Email: contact@cmade.ai
Phone: 719-431-3050
Pueblo, Colorado, USA
Our full mailing address is included in the footer of our commercial emails and is available on request at contact@cmade.ai. Every marketing email we send includes a valid physical postal address and a one-click unsubscribe link, and we honor opt-outs as required by the CAN-SPAM Act.