Privacy Policy

Effective date: September 14, 2026

Knoesis is a marketing intelligence platform operated by The Arete Group LLC, a Texas limited liability company doing business as Make Waves Media Co. (“Knoesis,” “we,” “us”). It helps local service businesses — our customers (“Clients”) — understand and improve their marketing, phone calls, leads, and revenue by connecting the systems those businesses already use.

This policy explains what we collect, how we use it, and the choices available. It covers two situations:

• When we act for ourselves — for visitors to knoesis.ai and for the Client staff, agency operators, and portal users who hold Knoesis accounts.
• When we act on behalf of a Client — most of the personal information we handle belongs to a Client's own customers and leads (“Consumers”), which we process as a service provider under the Client's instructions. If you are a Consumer, the business you contacted is responsible for the notices and choices on its own website and phone lines, and its privacy policy applies alongside this one.

1. Information we collect

Accounts and our own sites

• Account details for Client staff and operators: name, email address, role, and sign-in records. Authentication is provided by Google Firebase.
• knoesis.ai itself sets only essential first-party cookies (security and sign-in). We run no advertising trackers or third-party analytics on our own sites.

Information processed on behalf of Clients

When a Client connects its systems to Knoesis, we receive and store, at the Client's direction:

• Phone calls — from call-tracking and phone systems (such as CallTrackingMetrics and RingCentral): caller name and phone number, call time, duration and outcome, marketing source, and call recordings, which we transcribe using a speech-to-text service.
• Customer and sales records — from the Client's shop-management / point-of-sale system (such as Tekmetric): customer names, phone numbers, email addresses, street addresses, vehicle information, appointments, and invoice / payment records.
• Website visits and form submissions — via a measurement snippet a Client may install on its own website: pages viewed, referring page, campaign parameters and advertising click identifiers, device/browser information, IP address, and the contents of forms a visitor submits (fields that look like passwords, card numbers, or government IDs are excluded by design). The snippet sets first-party cookies on the Client's site (persisting up to 365 days) to connect a visit to a later inquiry.
• Advertising leads — lead forms and lead calls delivered by advertising platforms the Client uses (such as Google Ads, Google Local Services Ads, and Meta), including name, phone, email, and, for Local Services Ads, lead call recordings.
• Reviews and business listings — public reviews of the Client's business (reviewer display name, rating, review text, and the Client's replies), for example from Google Business Profile.
• Search and site analytics — performance data about the Client's own website from Google Search Console, Google Analytics, and Bing Webmaster Tools.

Information we create

• Transcripts and AI analyses of calls and leads: summaries, quality and follow-up assessments, and coaching insights.
• Location analysis: we geocode customer street addresses (using Google Maps) and assign them to U.S. Census areas to help Clients understand where their customers come from.
• Market research data: search-results and AI-assistant visibility data about businesses and services in a Client's market, purchased from data vendors. This is business-focused data, not Consumer profiles.

2. How we use information

• To provide the service to each Client: connecting marketing to calls, appointments, and revenue; identifying missed or at-risk leads and notifying the Client's own staff so they can follow up; reporting and market analysis.
• To transcribe and analyze calls and leads with AI so Clients can see what happened and act on it, including an AI assistant that answers a Client's questions about its own business data.
• To operate, secure, and improve the platform: authentication, access control, fraud and abuse prevention, troubleshooting, and audit logging.

About AI. Transcripts, lead details, and business data are processed with large-language-model providers — currently Anthropic (Claude) and Google (Gemini on Vertex AI) — and calls are transcribed by Deepgram. These providers process data to provide the service to us and are not permitted to use it to advertise. AI outputs are assessments, not facts; Clients remain responsible for how they act on them.

3. When information is shared

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Information is shared only:

• With the Client it belongs to — in the Knoesis dashboard and portal, and in notifications delivered to the Client's own email addresses, Slack workspace, or staff phones. These notifications can include a caller's name, phone number, and call details so staff can follow up.
• With service providers (subprocessors) that host or process data for us: Google Cloud / Firebase (hosting, storage, identity), Deepgram (transcription), Anthropic and Google Vertex AI (AI processing), Mailgun (email delivery), Twilio (staff text notifications and click-to-call), Slack (delivery into the Client's workspace), Google Maps and the U.S. Census Bureau geocoder (location analysis), and our internal operations tools.
• With advertising platforms, at the Client's instruction — to report that the Client's own ad produced a real customer (“conversion reporting”) to platforms such as Google, Meta, and Microsoft on the Client's own ad accounts. Where identifiers are included they are cryptographically hashed (email, phone, name) together with the ad-click identifier, the sale value, and limited fields a platform requires (such as region, and for some platforms the visitor's IP address and browser information). Consumers who opt out of marketing are excluded.
• For legal reasons — if required by law, or to protect our rights, our Clients, or others.
• In a business transfer — if Knoesis is involved in a merger, acquisition, or sale of assets, with notice of any material change to this policy.

Text messaging (SMS) consent. When a consumer calls or texts a Client's business number and the Client replies by text through Knoesis, the consumer's phone number and their consent to receive those texts are used only to carry on that conversation with that Client. No mobile information, phone numbers, or SMS opt-in consent will be shared with third parties or affiliates for marketing or promotional purposes. Sharing with subcontractors that support the messaging service (for example Twilio, which delivers the messages) is permitted; all other categories of sharing described in this section exclude text-messaging originator opt-in data and consent, which will not be shared with any third party.

4. Google user data

Some features connect to Google services with the Client's permission: Google Search Console and Google Analytics using read-only scopes, and Google Business Profile to read and manage the Client's reviews and listing insights. Knoesis's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the connected features to the Client who granted access, is not used for advertising, and is never sold. A Client can disconnect Google access at any time in the platform or at myaccount.google.com/permissions.

For Google Ads, Knoesis requests access to the Client's selected advertising account to read account and advertising data and support conversion reporting and corrections. The connection also requests Google Cloud access to list, adopt, or create a Google Ads transfer through BigQuery Data Transfer Service. This transfer imports advertising performance data into Knoesis's configured warehouse for spend reporting; it does not export conversions.

At the Client's instruction, Knoesis sends the Client's own conversion events to its configured Google Ads conversion destination through Google's Data Manager API. Events can include the event time, transaction identifier, sale value and currency, advertising click identifiers, and available cryptographically hashed user identifiers. Consumers who opt out of marketing are excluded. Conversion corrections use the Google Ads API. This is the first-party conversion reporting described in Section 3; it does not authorize repurposing data obtained from other connected Google services for advertising.

5. Cookies

• On knoesis.ai and the Knoesis app: essential first-party cookies only — session security (CSRF protection) and short-lived cookies that complete sign-in and account-connection flows. No advertising or analytics cookies.
• On Client websites: the measurement snippet described above sets first-party cookies under the Client's direction on the Client's own site. Choices about that tracking are offered by the Client on its website; contact the business whose site you visited.

6. How long we keep information

Retention is bounded by an internal, automatically enforced retention schedule. Typical windows: call, transcript, and message records — up to 2 years; call recordings — archived on a cold-storage schedule and deleted by 2 years; customer contact records — up to 10 years while the Client relationship continues; attribution and financial reporting ledgers — up to 7 years; short-lived operational data (sign-in tokens, queues, raw message payloads) — days. Records of a do-not-contact or marketing opt-out are kept longer on purpose, because deleting them would defeat the opt-out.

7. Your rights and choices

• Consumers (you called, messaged, or bought from a business that uses Knoesis): you can exercise access or deletion rights through that business, and we provide the business with tools to export or delete your information from Knoesis. You can also contact us directly (below) and we will act on the request with the relevant Client, verifying it before acting.
• Access / export: we can produce a copy of the personal information we hold about a specific person.
• Deletion: we can delete a person's identified records, including stored call recordings, subject to legal retention duties and the opt-out records noted above. Every privacy request is logged.
• Marketing opt-out: opted-out Consumers are excluded from conversion reporting to advertising platforms.
• Account holders can review and update account details in the platform, or ask us for help.

We honor applicable rights under U.S. state privacy laws (such as the CCPA/CPRA). We act as a service provider for information processed on a Client's behalf. We do not discriminate against anyone for exercising privacy rights.

Text messages. Reply STOP to any text message to stop receiving texts from that business; reply HELP for help. Message and data rates may apply.

8. Security

Data is encrypted in transit; credentials and connection secrets are held in a managed secret store; access is role-based and least-privilege; administrative and data-subject actions are audit-logged. No system is perfectly secure, but security review is a continuous part of how this platform is built.

9. Children

Knoesis is a business tool. It is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child's information has reached us, contact us and we will delete it.

10. Changes to this policy

If we change this policy materially, we will update the date above and notify Clients through the platform or by email. Continued use after a change means the updated policy applies.

11. Contact

The Arete Group LLC d/b/a Make Waves Media Co. — Knoesis
2605 Pinon Ct, Grapevine, TX 76051
Email: max@makewavesmediaco.com