Privacy policy

Privacy Policy

Last updated: May 20, 2026 · CP Global Dynamics LLC d/b/a Beverly Hills Growth

1. Who we are

This site is operated by CP Global Dynamics LLC, a California limited liability company doing business as Beverly Hills Growth. Our registered address is 425 N Doheny Dr, Beverly Hills, CA 90210. For any privacy question, write to audit@beverlyhillsgrowth.com.

2. What we collect, and why

2.1 Free audit form

When you submit the audit form on our homepage, we receive: your name, business name (optional), email address, website URL, business category (optional), and the free-text brief you provide. We also log your IP address and user-agent string at the moment of submission for abuse-prevention and rate-limiting. Lawful basis (GDPR Art. 6(1)(b)): performance of a pre-contractual request you initiated.

2.2 AI chat widget

When you use the chat widget at the bottom of the homepage, the text you type is sent to Google's Gemini API (model gemini-2.0-flash) for an AI-generated reply. We do not store the transcript on our servers unless you confirm you want a human follow-up. If you confirm, the full transcript plus your business name, website, and email are forwarded to our inbox via FormSubmit for human review. Lawful basis: legitimate interest in providing customer service, plus consent (you choose whether to ask for a human follow-up). We do not use chat content to train any AI model, neither ours nor Google's. Our Gemini API project is on the paid tier, under which Google's published terms confirm that prompts and responses are not used to improve Google products (verified 2026-05-22 via the API's serviceTier: standard response field).

2.3 Payment

When you purchase a service, payment is processed entirely by Stripe on Stripe's hosted checkout pages. We never see your card number, CVC, or full bank details. Stripe forwards us your name, email, billing country, and a tokenized customer ID so we can fulfill your order and recognize you for renewals. Lawful basis: performance of a contract.

2.4 Site analytics + error reporting

Vercel (our hosting provider) records standard server logs (IP, user-agent, timestamp, requested URL, status code). Sentry captures uncaught browser errors and unhandled promise rejections from our front-end code, so we can fix them. Sentry receives your IP address and a redacted stack trace, but not the contents of any form you've filled in. Lawful basis: legitimate interest in keeping the site reliable and secure.

2.5 Bot protection

Cloudflare Turnstile runs on the audit form and the chat-lead form to detect automated abuse. Turnstile is privacy-preserving by design (it does not use tracking cookies and does not fingerprint), but Cloudflare does receive your IP address and a brief interaction signal. Lawful basis: legitimate interest in preventing abuse.

2.6 Cold outreach (if we email you first)

If you receive an unsolicited email from us, we found your business in a public Google Maps listing and identified a public contact email via Hunter.io. We do not buy email lists. Each cold email contains our physical mailing address and a working one-click unsubscribe link; unsubscribing is honored within 10 business days as required by CAN-SPAM § 7704(a)(4). Lawful basis: legitimate interest in business-to-business outreach (GDPR Recital 47); we do not send cold email to identifiable individuals at non-business addresses.

3. Third parties we share data with (sub-processors)

We share the minimum data necessary with the following service providers. Each provider has its own privacy policy; we link directly so you can read it.

We do not sell or share your personal information for cross-context behavioral advertising, in the sense those terms are defined by the California Privacy Rights Act, the Colorado Privacy Act, or any comparable US state law.

4. Cookies and tracking

We do not use advertising cookies, retargeting pixels, social-media tracking, or analytics cookies. We do not run Facebook Pixel, Google Ads conversion tracking, LinkedIn Insight Tag, TikTok Pixel, or any comparable tracker. For full detail of what does load on your browser, see our Cookie & Tracking Notice.

5. AI processing notice

The chat assistant on this site is powered by Google's Gemini large-language model. Replies are generated automatically and may be inaccurate or out-of-date. We do not use chat content to train any AI model. Read more on our AI Disclosure page.

5A. AI Voice Receptionist data (demo line and client deployments)

We operate a public AI Voice Receptionist demo service, and we deploy the same service for paying clients under our Voice Receptionist subscription tiers (Starter, Pro, Concierge, Enterprise).

5A.1 Calls to our demo line

When you use the separately arranged AI voice demo, the call is answered by an AI agent (named "Olivia") built on Retell AI with voice synthesis by ElevenLabs and language-model inference by OpenAI. We collect: your caller phone number in E.164 format, the call start timestamp and duration, an AI-generated text summary of the call, and any booking metadata you provide (name, email, requested service). Calls to the demo line are recorded for quality and training. Lawful basis (GDPR Art. 6(1)(b)): performance of a pre-contractual request you initiated by calling. California two-party consent (CIPA § 632): notice is provided in the agent's opening greeting and in the disclaimer published on our website next to the demo controls. If you do not wish to be recorded, hang up and email us at audit@beverlyhillsgrowth.com.

5A.2 Client deployments

For paying clients on a Voice Receptionist subscription, we provision a similar agent to answer the client's business phone. In that case the client is the data controller for incoming caller PII; Beverly Hills Growth acts as a processor. Each client engagement is governed by the Master Services Agreement and, where required, a Data Processing Addendum. Concierge-tier clients may request a Business Associate Addendum where the data subject relationship involves HIPAA-regulated health information; we do not auto-include a BAA on lower tiers.

5A.3 Retention

• Demo line transcripts and recordings: 90 days from the call, then deleted.
• Demo line booking records and AI-generated summaries: kept indefinitely as an operational record of demo activity.
• Client deployment transcripts and recordings: retention is set per the client's instructions in the engagement SOW; default is 90 days.

5A.4 Sub-processors specific to the voice service

5A.5 Your rights

The full CCPA / GDPR / PIPEDA rights described in Sections 7-9 apply to voice service data. To request a copy or deletion of any voice recording, transcript, or booking record we hold on you, email audit@beverlyhillsgrowth.com with subject Voice data request and include the phone number from which you called. We respond within the timelines set out in Sections 7-9.

6. How long we keep your data

We retain personal data only as long as we need it:

• Audit form submissions: 24 months from submission, then deleted from our inbox and internal records.
• Chat transcripts: deleted within 24 hours if you did not request a human follow-up; 24 months otherwise.
• Stripe customer records: while a paid relationship is active, plus 7 years thereafter for tax and accounting law compliance.
• Cold-email suppression list: retained indefinitely so we never email you again after you unsubscribe.
• Vercel server logs: 30 days, per Vercel's default retention.
• Sentry error events: 90 days, per our Sentry retention setting.

The retention windows above mirror our internal records-retention schedule. A copy is available on written request to audit@beverlyhillsgrowth.com.

7. Your rights, California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we have collected about you, the categories of sources, and the categories of third parties we have shared it with;
• Request deletion of your personal information;
• Request correction of inaccurate personal information;
• Limit our use of sensitive personal information (we do not collect sensitive personal information in the CPRA sense);
• Opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising (automatic for everyone here, because we do neither);
• Data portability: receive your data in a portable, machine-readable format;
• Non-discrimination: we will not deny service, charge a different price, or provide a lower quality of service because you exercised a privacy right.

To exercise a right, email audit@beverlyhillsgrowth.com with subject CCPA request. We respond within 45 days. We may need to verify your identity by confirming an email match to records we already hold. You may authorize an agent to submit a request on your behalf; the agent must provide written permission signed by you.

8. Your rights, EU + UK + Switzerland (GDPR, UK GDPR, FADP)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the right to:

• Access: get a copy of the personal data we hold about you (GDPR Art. 15);
• Rectification: correct inaccurate data (Art. 16);
• Erasure, "right to be forgotten" (Art. 17);
• Restriction of processing (Art. 18);
• Data portability: receive your data in a structured, commonly-used, machine-readable format (Art. 20);
• Object: to processing based on our legitimate interest (Art. 21);
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with your national supervisory authority (e.g. CNIL in France, ICO in the United Kingdom, FDPIC in Switzerland).

To exercise a right, email audit@beverlyhillsgrowth.com with subject GDPR request. We respond within 30 days (extendable by 60 additional days for complex requests, with notice). When we transfer personal data from the EEA, UK, or Switzerland to the United States, the transfer is covered either by the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor) signed with each of our sub-processors, or by the recipient's certification under the EU-US Data Privacy Framework where applicable. A copy of the SCCs we have in place is available on request.

EU representative: not appointed. At our current processing volume we qualify for the GDPR Art. 27(2)(a) exemption ("occasional" processing, not large-scale, no special categories). If our volume increases past this threshold we will appoint a representative under Art. 27 and update this notice.

9. Your rights, Canada (PIPEDA)

If you are in Canada, you have the right to access the personal information we hold about you and to request correction. Contact audit@beverlyhillsgrowth.com. If we cannot resolve your concern, you may complain to the Office of the Privacy Commissioner of Canada.

10. Security

We follow industry-standard practices: TLS 1.2+ for every connection (HSTS preload), server-side input validation on every form, Cloudflare Turnstile bot protection on every public form, HMAC verification on every Stripe webhook, separate secrets per service stored in encrypted environment variables, no production secret ever committed to git, and quarterly review of authorized human and machine identities. We do not store payment card data; Stripe holds it. We do not have a SOC 2 report (we are a sole-operator business); if a SOC 2 report is required by your procurement team, contact us before purchasing.

11. Children's privacy

This site is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe we have, email audit@beverlyhillsgrowth.com and we will delete it.

12. Changes to this policy

If we materially change this policy, we update the "Last updated" date at the top and, for changes that affect how we handle data we already hold, email everyone on our active client list at least 30 days before the change takes effect. Continued use of the site after a change indicates acceptance.

13. Contact

Privacy questions, data-rights requests, or anything else: audit@beverlyhillsgrowth.com. We typically respond within 2 business days. Mailing address: CP Global Dynamics LLC, 425 N Doheny Dr, Beverly Hills, CA 90210, USA.