Privacy Policy

Effective date: October 22, 2026
Last updated: October 22, 2026

This Privacy Policy explains how Derival LLC, a Virginia limited liability company ("Derival," "we," "us"), collects, uses and shares personal information when you visit derival.co (the "Site"), send us an inquiry, email us, call our AI receptionist, or otherwise contact us about our services. We're a small business, and we've tried to keep this short and plain.

1. The short version

• We collect what you choose to give us, such as your name, business, email and message, plus the basic technical information needed to run and protect the Site.
• Calls to our phone line are answered by an AI assistant and are recorded and transcribed.
• Some automatic email replies are written with the help of an AI service.
• We use your information to reply to you, provide our services, and keep our systems secure.
• We don't sell your personal information, and we don't share it for targeted advertising.
• To access, correct or delete your information, email hello@derival.co.

2. Information we collect

2.1 The inquiry form

When you submit the "Get in touch" form, we collect:

• your name
• your business name
• your email address
• your phone number (optional)
• the service you're interested in (picked from a list)
• your message (up to 2,000 characters)

Please don't include health, financial-account or ID details in your message. The form also has a hidden "leave blank" field that helps filter out spam. It doesn't collect anything about you.

When you submit the form:

• Your submission is emailed to our inbox. Cloudflare's email service sends it, and the inbox is hosted by Google (Gmail).
• We add it to our CRM. Your name, business, email, phone number and message are saved in HubSpot, our customer relationship management system (see section 2.5).
• We send you a confirmation email through Resend, an email delivery service. To send it, Resend receives your email address, first name and business name. We don't use open or click tracking in these emails.
• We use your IP address briefly for protection. It's used to check that the submission isn't from a bot (see section 2.3) and to limit repeated submissions.

2.2 Emails you send us

Emails sent to our addresses at derival.co are received through Cloudflare Email Routing and forwarded to our inbox, which is hosted by Google (Gmail).

Automatic acknowledgments. When you email hello@derival.co, you may get a short automatic reply confirming that we received your message. To write it, we send the subject line and text of your email to Cloudflare Workers AI, an AI service that writes a brief acknowledgment. The reply is checked against fixed rules (no prices, links or promises) before it's sent. According to Cloudflare, Workers AI doesn't keep these inputs or outputs after processing the request and doesn't use them to train AI models (Cloudflare Workers AI data usage). A person reads your actual email and replies personally.

2.3 Spam and bot protection (Cloudflare Turnstile)

The form uses Cloudflare Turnstile to tell people from bots. When the form loads and when you submit it, Turnstile processes technical signals from your device and browser, such as your IP address, TLS fingerprint, browser user-agent, and the site key and website origin. According to Cloudflare, Turnstile uses these signals only to detect and block bots and to improve its bot detection, not to identify, profile or target individuals.

Cloudflare acts as our service provider when it protects the Site. It also acts on its own account when it uses these signals to improve Turnstile. See the Cloudflare Turnstile Privacy Addendum and Cloudflare's Privacy Policy.

2.4 Calls to our AI receptionist

Calls to Derival's phone line are answered by an AI voice assistant, an automated system, not a person. The assistant tells callers at the start of each call that it's an AI assistant, and it will confirm it's an AI if asked.

Calls are recorded and transcribed. If you don't want to be recorded, please hang up and email us at hello@derival.co, or use the form on the Site.

When you call, we collect:

• your phone number (caller ID), and the date, time and length of the call
• the audio recording and transcript of the call
• any details you share, such as your name, business, email and what you need
• an automated summary of the call, which is sent to us

xAI provides the AI voice, call handling, recording and transcription on our behalf. xAI says it doesn't use business customers' call content to train its models (xAI Enterprise Terms).

Please don't share payment card numbers, passwords, health details or other sensitive information on the call. Our phone line isn't for emergencies. If you have an emergency, hang up and dial 911.

2.5 Our CRM (HubSpot)

We use HubSpot to keep track of prospects and clients. We may store your contact details (name, business, email and phone), your inquiry message, notes and call summaries, emails we exchange, and where we are in the sales or project process. HubSpot processes this information on our behalf (HubSpot Privacy Policy). The Site doesn't load HubSpot tracking code.

2.6 Technical information and logs

• Hosting and security. The Site is hosted and delivered by Cloudflare. Cloudflare processes standard technical information, such as IP address, browser type, pages requested and timestamps, to deliver and secure the Site. Cloudflare also adds a small script that hides our email address from spam bots.
• Processing logs. Our form and email handling runs on Cloudflare Workers. Cloudflare's logs for this code (Cloudflare Workers Logs) record technical information about each form submission and email event, including email addresses and processing status, such as whether a message was forwarded or a confirmation was sent. Our own code doesn't log the contents of your form submission, or the subject line or body of your email. We use these logs only to confirm delivery and fix problems.
• Fonts. Our fonts are hosted on our own Site. We don't load fonts from third-party font services.
• Cookies. Our own Site doesn't set cookies. Cloudflare and Turnstile may use strictly necessary technical storage to provide security.
• Do Not Track. We don't track you across other websites or over time for advertising, so we don't respond differently to browser "Do Not Track" signals.

3. How we use information

We use personal information to:

• respond to your inquiry, schedule a process review, and send quotes and follow-ups you ask for
• send automatic acknowledgments and confirmations that we received your email or form submission
• answer and route calls, take messages, and send call summaries to our team
• provide, manage and bill for our services if you become a client
• review call recordings and transcripts to improve our AI receptionist's answers and quality
• keep short-lived technical logs to confirm delivery and fix problems
• protect the Site and our systems from spam, bots, fraud and abuse
• comply with legal obligations and enforce our agreements

We don't use your information to make automated decisions that have legal or similarly significant effects on you.

We don't send marketing or newsletter emails. If that ever changes, we'll update this policy first, and each such email will include an unsubscribe link.

4. How we share information

We share personal information only:

• With service providers that help us run our business, under terms that limit how they use it:
  • Cloudflare: hosting, content delivery and security; Turnstile; Email Routing and sending of form emails; Workers AI for automatic acknowledgments; and Workers Logs
  • Google: our Gmail inbox, where inquiries and emails are stored
  • Resend: form confirmation emails
  • HubSpot: CRM
  • xAI: our AI receptionist, call recordings and transcripts
• For legal reasons: if required by law, subpoena or court order, or to protect our rights, safety or property, or those of others.
• In a business transfer: if Derival LLC is involved in a merger, sale or reorganization. Any successor would be bound by this policy for the information it receives.
• With your permission, or at your direction.

We don't sell personal information, and we don't "share" it for cross-context behavioral (targeted) advertising, as those terms are used in state privacy laws.

5. Voice agents we build for clients

Derival builds and manages AI voice agents for other businesses ("clients"). If you call one of our clients and reach an AI agent we set up, that call is covered by the client's privacy practices, not this policy. Each client controls its own call recordings, transcripts and caller information. Each client is also responsible for its own greeting, its recording and AI disclosures, and its privacy notice. When we set up or support a client's agent, we act only as the client's service provider and follow its instructions. For questions about a call to a client's business, please contact that business directly. If you contact us instead, we'll forward your request to the client where appropriate.

6. How long we keep information

We keep personal information only as long as we need it for the purposes above, unless the law requires longer:

Cloudflare, Resend and our other providers may keep their own security and delivery records under their own policies. When we no longer need information, we delete it or de-identify it.

7. Your choices and rights

You can ask us to:

• access the personal information we hold about you
• correct information that's inaccurate
• delete your information

To make a request, email hello@derival.co with the subject line "Privacy Request." Tell us what you're asking for and how to reach you. We may need to verify your identity before acting, for example by confirming the email address or phone number you used with us. We'll respond within 45 days.

We may keep some information where the law allows or requires it, such as records we need for taxes, contracts or legal claims. We'll tell you if that applies. We won't treat you differently for making a request. Depending on where you live, your state's privacy law may give you additional rights. If we deny your request and your state's law gives you a right to appeal, you can reply to our decision to appeal it, and we'll respond as that law requires.

8. Security

We use reasonable safeguards to protect personal information, including encrypted (HTTPS) connections to the Site, spam and bot protection on the form, reputable service providers, access limited to the people who need it, and strong passwords with two-factor authentication where available. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you as the law requires.

9. Children

Our Site and services are meant for businesses and adults. They aren't directed to children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we'll delete it.

10. Links to other sites

The Site may link to other websites and services. Their own privacy policies apply, not this one.

11. Changes to this policy

We may update this policy from time to time. We'll post the updated version on this page and change the "Last updated" date. If we make material changes, we'll take reasonable steps to let you know, such as a notice on the Site.

12. Contact us

Derival LLC, a Virginia limited liability company
Email: hello@derival.co
Haymarket, Virginia