Privacy Policy

Mousilli Holdings LLC, of Houston, Texas (“Insert Fuel”, “we”) is the controller of the personal data described here. This policy covers the Insert Fuel platform, the Let Go Boss community, and our public sites.

Where you use Insert Fuel to run your own business, we are the controller of your Account data and a processor of the data you bring with you about your own clients. You remain the controller of that.

Privacy questions and rights requests: privacy@insertfuel.com.

You give us:

• Identity and contact details: name, email, phone, profile photo, job title, city, country, timezone, language.
• Content: messages, notes, files, images, tickets, calendar entries, and business records you create.
• Voice and video: recordings and transcripts of calls, video calls, voice messages and screen shares. These are captured automatically, by default, for everyone present. See section 5.
• Payment details: handled by our payment processor. We store the plan, the amount and the status, never full card numbers.

We collect automatically:

• Technical data: IP address, browser and device type, and approximate location derived from your IP.
• Usage data: pages opened, features used, sign-in times and errors encountered.
• Cookies and similar storage, described in clause 6.

We receive from others:

• Contact and conversation records from GoHighLevel, where your business uses it.
• Calendar and contact data from Google, where you connect your account.
• Booking and property data from Hospitable, where it applies to you.

Only if you allow it, and each with its own explainer before we ask: your camera, your microphone, your precise location, and browser notifications. Each can be withdrawn at any time (clause 11).

• To provide the Service — running your Account, Brands, messages and files. Basis: performance of a contract.
• To keep it secure — authentication, fraud and abuse prevention, error monitoring. Basis: legitimate interests, and legal obligation.
• To support you — answering requests, investigating faults. Basis: performance of a contract, and legitimate interests.
• To improve it — understanding which features are used and where they fail. Basis: legitimate interests.
• To communicate — service notices, and marketing only where you have opted in. Basis: legitimate interests, and consent for marketing.
• Optional features — location-based matching, events and weather; camera and microphone. Basis: consent.
• To comply with law — tax, accounting and lawful requests. Basis: legal obligation.

You may object to processing based on legitimate interests. See clause 11.

Some features send your Content to AI model providers so that output can be generated: drafting a message, summarising a call, or answering a question about your own records.

• Providers process that Content under contract, solely to return the result to us.
• We do not use Member Content to train publicly available models, and we do not permit our providers to do so.
• An owner-scoped clone does not disclose its owner’s private Content into a channel containing people outside that scope.
• We do not make decisions producing legal or similarly significant effects about you by automated means alone.

Calls, video calls, voice messages and screen shares on Insert Fuel are recorded and transcribed automatically. This is on by default and applies to everyone in the conversation. Calls placed through a connected phone system are recorded as well.

We do this so the platform can give you replays, summaries, action items and searchable history, and so the AI features described in section 4 have the context to be useful.

• A recording is visible to the people with access to the conversation or Brand it belongs to.
• Our staff can access one where support, billing or safety requires it.
• We do not sell recordings, and we do not use them to train publicly available AI models.
• You can ask us to delete a specific recording or transcript at any time. See section 12.

If you invite somebody onto a call, including a client or a guest, telling them it is being recorded is your responsibility. Recording laws differ by country and by state, and some require the consent of everybody present. Where consent is needed, get it before the call starts.

If a conversation should not be on the record, hold it somewhere else.

We disclose personal data to:

• Other Members, according to the permissions of the Brands and channels you are in. Your profile is visible to the community; internal notes are not visible to clients.
• Service providers acting on our instructions: hosting and database (Supabase), application hosting (Vercel), messaging and CRM (GoHighLevel), calendar and mail (Google), real-time calls (LiveKit), payment processing, and AI model providers.
• Professional advisers, where necessary and under a duty of confidence.
• Authorities, where we are legally required, and we will tell you unless we are prohibited from doing so.
• A successor, if our business is sold or merged. This policy continues to apply until you are told otherwise.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We use a small number of cookies and browser storage keys, all of them necessary:

• Authentication — keeps you signed in. Without it every page would ask for your password again.
• Session and account context — keeps you on the right Brand when you belong to more than one.
• Preferences — your dashboard layout, theme, language and sound setting.
• Security — protects against cross-site request forgery.

There are no advertising cookies and no third-party tracking cookies on this platform. That is why accepting is required rather than optional: everything we set is needed for the Service to work, so there is nothing meaningful to decline. You can clear cookies in your browser at any time; the only effect is that you are signed out and your preferences reset.

Our infrastructure is hosted in the United States. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess each provider’s safeguards before using it.

Stated plainly, because these are the ones people actually want to know:

• We never sell your personal data. Not aggregated, not anonymised, not as a favour to a partner.
• We never train a publicly available AI model on your Content.
• We run no advertising trackers.
• Encrypted notes stay encrypted. We cannot read them.
• Internal notes never reach a client through any outbound channel.
• If we get any of this wrong, we tell you. We do not wait to be found out.

• Account and profile — while your Account is open, then 30 days after a deletion request.
• Content — until you delete it, or 30 days after Account deletion.
• Call recordings and transcripts — until deleted from the call they belong to.
• Backups — retained on a 30-day rolling cycle, then overwritten.
• Security and error logs — up to 12 months.
• Billing and tax records — 7 years, as required by law.

Where an Account is deactivated rather than deleted, data is retained so that the Account can be restored, until you ask us to delete it.

Access is controlled at the database level by row-level security, so a request can only return rows the signed-in person is entitled to. Data is encrypted in transit and at rest, encrypted notes are additionally encrypted so that we cannot read them, and outbound messaging is gated to prevent accidental contact at scale. No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator within the time the law requires.

Subject to your location, you have the right to:

• be told what we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing, including profiling;
• receive your data in a portable format;
• withdraw consent at any time, without affecting what was done before;
• complain to your data protection authority.

Camera, microphone, location and notification permissions can each be withdrawn in Settings or in your browser at any time, and withdrawing location means we forget it.

To exercise any right, email privacy@insertfuel.com. We respond within 30 days and will tell you if we need longer. We do not charge, and we do not treat you differently for asking.

The rights in clause 11 are your rights under the GDPR and the UK GDPR, and the lawful bases we rely on are in clause 3. Where processing is based on consent you may withdraw it at any time. You may complain to your national supervisory authority, or in the United Kingdom to the Information Commissioner’s Office.

Under the CCPA as amended by the CPRA you may request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose to; ask us to delete or correct it; and limit the use of sensitive personal information.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit. We do not discriminate against you for exercising any right.

An authorised agent may make a request on your behalf with written proof of authority.

The Service is not directed at children under 13 and we do not knowingly collect their personal data. Members aged 13 to 17 require verified parental or guardian consent and are excluded by default from open community channels. If you believe a child under 13 has given us data, contact us and we will delete it.

We may update this policy. Where a change is material we will give notice in the Service or by email at least 14 days before it takes effect. The version and date at the top of this page always identify the current text.