Privacy policy

Last updated November 10, 2026

Salesman Hal (salesmanhal.com) is run by Callingly LLC ("we", "us"). This policy explains what we collect, why, who we share it with and the choices you have. Questions or requests: [email protected].

What we collect

When you run the free scan

• The website address you enter. We fetch that site's public pages to grade it, the same way a search engine or AI assistant would.
• The scan results. They're published on a report page for that domain, which isn't indexed by search engines.
• If you ask us to email you the report: your name (optional) and email address.

When you create an account

• Your name and email address, a hashed version of your password, and any two-factor or passkey details you set up.
• Session details for signing you in, including your IP address and browser type.

When you connect a website with the WordPress plugin

• The site's address and name, and the business details you enter in the plugin's settings.
• The title, text, address and publish date of the published content you choose to sync. Password-protected pages and pages marked noindex in Yoast or Rank Math are never sent.
• The fields of your lead forms, but never their past submissions, plus scheduling links found on your pages.
• Visits from known AI agents: the agent's user agent, the page path and the time. Ordinary human visitors are never logged.

Unless the site owner turns it off, a connected site's pages also load a small script from us, so AI agents working in a visitor's browser can use the business's tools (WebMCP). Like any file a web page loads, fetching it tells our servers the visitor's IP address and browser type. We don't store them, though our hosting provider may keep standard server logs for a short time. The script reads nothing on the page except the business's MCP server address.

Unless the site owner turns it off, a verified site's pages also include a 1×1 tracking image loaded from us, which sends the page path (never its query string) along with the visitor's IP address and browser type. We record the visit only when the browser type is a known AI agent; requests from people aren't stored, though our hosting provider may keep standard server logs for a short time.

When an AI assistant contacts a connected business

A visitor can ask an AI assistant, such as ChatGPT or Claude, to send a business an inquiry, ask for a quote or book a meeting through that business's Salesman Hal server. The assistant must confirm the visitor agreed first. We then receive:

• What the visitor agreed to share, such as their name, email address, phone number, message and answers to the business's form.
• The assistant's user agent, and a one-way hash of the request's IP address, which we use for rate limiting and abuse prevention.

We also log each tool an assistant uses (which tool, whether it worked and which assistant) without the content of the request.

When a business connects Calendly

• The access tokens Calendly issues (stored encrypted), the Calendly account and event type chosen, and the meetings AI assistants book.

How we use it

• To run the service: scanning sites, sending reports, answering AI assistants from a business's own information, delivering inquiries to the business's forms or email, booking meetings, and showing businesses their dashboard and monthly reports.
• To send the emails you ask for, and account emails such as email verification and password resets.
• To keep the service secure, prevent abuse and enforce rate limits.
• To understand how the service is used and improve it.

We don't sell personal information, show ads or use third-party analytics or advertising trackers.

Information about a business's customers

When a visitor's details reach a business through Salesman Hal, we handle them on that business's behalf, to deliver the request to it. The business decides what to do with them under its own privacy policy. If you sent a request to a business and want it changed or deleted, contact that business. You can also write to us and we'll help.

Who we share it with

• The business you contacted. Inquiries, quote requests and bookings go to the business, through its own form plugin, by email or on its Calendly.
• Service providers who process data for us under contract:
  • Laravel Cloud, for hosting and databases.
  • Resend, for sending email.
  • Anthropic, which provides AI answers: a visitor's question and the relevant pages of the business's site are sent to its Claude API to write the reply.
  • Calendly, for businesses that connect it.
• AI assistants. We give assistants the business's public information so they can answer visitors. The assistants are run by other companies under their own privacy policies.
• When required. We share information to comply with the law, to protect rights and safety, or as part of a merger or sale of the business, under this policy.

Cookies

We only use cookies the site needs to work: a session cookie that keeps you signed in, a security token that protects forms, and your light or dark mode preference. We don't use advertising or tracking cookies.

How long we keep it

• Account and connected-site data: while the account or site stays connected, and until you ask us to delete it.
• Inquiries and bookings: until the business deletes them or asks us to.
• Scan results: while the report page is up. A site owner can ask us to remove it.
• Addresses that unsubscribe: kept so we never email them again.

Disconnecting the plugin stops all syncing and visit reporting. What was already sent stays with us until you ask us to delete it.

Your choices and rights

• Every report email has an unsubscribe link.
• You can update your account details in your settings, or delete your account there.
• You can ask us for a copy of your information, or to correct or delete it, by writing to [email protected]. We'll reply within 30 days.
• Depending on where you live, for example California, the EU or the UK, you may have further rights, including the right to object to or restrict certain uses, and to complain to your local data protection authority. We'll honor them as the law requires.

Security

Data is encrypted in transit. Passwords are hashed, and secrets such as Calendly tokens and signing keys are encrypted at rest. Requests we send to a website are signed so only we can make them. No system is perfectly secure, so we can't guarantee absolute security.

Where it's processed

We're based in the United States. Your information may be processed there and in other countries where our service providers operate.

Children

Salesman Hal is a service for businesses and isn't directed at children under 16. We don't knowingly collect their information.

Changes

We'll update this page when our practices change and change the date at the top. For significant changes, we'll also email account holders.

Contact

Callingly LLC, for Salesman Hal: [email protected].