What we collect, and what we do with it

The short version

• We record how our pages are used, with our own analytics and with Microsoft Clarity. Our business pages, where offices learn about, order and manage Lobbypie, also set cookies.
• On office pages, embeds and the kids’ privacy notice, Clarity runs with its cookies off. Office pages and embeds are also masked for it, so the words on them are not sent to Microsoft.
• We collect business and staff details to make and run each office’s page, and we may email offices about Lobbypie.
• We never sell personal information.
• Each pictured person gives their own consent and can take it back at any time. We keep a permanent record of each answer.
• Anyone pictured who would rather not use their photo can choose an avatar from our collection instead.
• Anyone pictured can instead choose, on their own link, to show their own photo as it is, cropped to a square around their face.
• We never receive patient names, phone numbers or appointment details. Offices send their own reminders.
• We keep each kind of information for a set time, listed below, then delete it.
• Please never send us information about a patient.

Who we are

Lobbypie is made by Storypie LLC, a company based in Ohio, United States. In this notice, "we" and "us" mean Storypie LLC, doing business as Lobbypie.

Questions about privacy go to Talk to us. A person on our team reads and answers every message.

You can also write to Storypie LLC, doing business as Lobbypie, at 3535 Rolling Hills Drive, Pepper Pike, OH 44124, or email hello@lobbypie.com.

When you visit this site

Fonts come from our own servers. How we measure the use of our pages, and the cookies our business pages set, are set out under Analytics and cookies.

Like every website, our servers receive your internet address, your browser type and the page you asked for. We use them to send the page, to limit abuse, such as too many form attempts from one address, to fix problems and, as the next section says, to measure how our pages are used.

Our hosting keeps standard server logs for security and troubleshooting. We keep them for up to 90 days, then they are deleted.

Office pages ask visitors to choose Kids or Adults. This choice selects content; it is not an account, age verification or visitor profile. A link, audio or video request may carry the audience and language, and standard server logs may contain those requests.

Analytics and cookies

We record how people use Lobbypie, to improve it and to learn which of our pages, messages and ads lead to orders. We do this with our own analytics, whose records we keep ourselves in our own database at our cloud hosting provider and never sell, and with Microsoft Clarity, which is described below.

Our business pages. On the home page, pricing, the pages about each kind of place, the demo, the printable summary, ordering, your account, Talk to us, the page about adding Lobbypie to your website, the safety page, this notice, the terms and the voice and photo policy, we record the pages you open, the website that sent you here and any campaign words in your link, what you click and which forms you send, never what you type in them, how far you scroll, how long you stay, how quickly each page loads and any error it meets, and your kind of device and browser. We also record each step of an order and your account, such as starting an order, paying, setting up your page, going live, add-ons and cancelling.

These pages set two cookies of our own:

• _lp_vid: a random code that tells your browser apart from others, so we can see when you come back. It lasts one year.
• _lp_sid: a random code for a single visit. It ends when you close your browser.

When you order or sign in, we connect these records to your order or account, so we can see how you found us and what you looked at before. When you write to us, we record that you did and the choices on the form, never what you wrote.

We may also use advertising partners’ tools on our business pages to measure our own ads, never on office pages, embeds or kids’ pages. Those partners would receive information about your visit under their own privacy notices. We add each one to this notice before it runs.

Office pages. On the pages visitors open from an office’s sign, link or website, we count each time a page opens, a person is tapped and a question is played, with the audience and language chosen, and whether it plays to the end. We also note where the page is tapped, how far it is scrolled, how long it stays open, how quickly it loads, any error it meets and the kind of device and browser. The kids’ privacy notice explains this for parents.

Private links. The private pages we send staff to give their permission, and offices to switch their page on or off, are counted the same way as office pages: each time one opens, where it is tapped, how far it is scrolled, how long it stays open, how quickly it loads, any error it meets and the kind of device and browser. We also record each step taken on them, such as a permission given or a page switched on or off, with the order it belongs to.

Other pages. The kids’ privacy notice, each office’s signs page and the QR codes downloaded from it, and the page shown for an address that does not exist or when something goes wrong are counted the same way as office pages.

We keep our own records for about 400 days, then delete them.

Microsoft Clarity. On our business pages other than ordering and your account, on office pages and embeds, and on the kids’ privacy notice, we also use Microsoft Clarity, a service from Microsoft that shows us how our pages are used. While a page is open, Clarity records how it is used: where it is clicked and tapped, how the pointer moves, how far it is scrolled, what the page shows, how quickly it loads and any error it meets. From these we watch recordings of visits and read heatmaps of where people click and scroll. Clarity does not record what you type into a form.

Microsoft receives these records together with the page’s address and title, the address of the page that linked to it, your internet address and details of your device and browser, such as its kind, screen size and language. Microsoft handles them as its own, under the Microsoft Privacy Statement at privacy.microsoft.com/privacystatement, and its terms let it use them for its own purposes, which include providing Clarity, improving its products and Microsoft Advertising. Microsoft keeps a recording for up to 30 days, and some for up to 9 months.

On the business pages where it runs, Clarity sets cookies of its own: _clck, which tells your browser apart from others for one year, and _clsk, which joins the pages of one visit and lasts one day. It also keeps a code for the open tab in the browser until the tab is closed. Microsoft may also set cookies of its own from clarity.ms and bing.com. On office pages, embeds and the kids’ privacy notice we run Clarity with its cookies off: it then gives each page view a code of its own, so one visit is not connected to the next. Office pages and embeds are also masked for Clarity, so the words on them, such as people’s names, questions and answers, are not sent to Microsoft.

To stop Clarity, turn on Global Privacy Control in your browser, which Clarity follows, or choose Microsoft at optout.aboutads.info. You can also block or delete cookies in your browser’s settings. Our pages still work without them.

When you order

Ordering needs no password. The order form asks for:

• Your office: its name, what kind of place it is, its city, region and country, its website if you give us one, and the web address you would like.
• You: your name and email, and if you choose, your phone number and role.
• The people visitors will see: each person’s name, display name, role, headshot or avatar chosen from our collection, and voice choice.
• Your content: questions, office answers, audiences, requested languages and anything answers should never say.
• Your plan: which plan you chose, how many locations, and whether you pay month to month or a year at a time.

If you ask us to import from your office website, we read its public team, location, service, FAQ and visit pages and send their text, with the names, roles and photo addresses on them, to our image and language model provider to suggest your team and locations and to write suggested questions and answers for your page. You choose what to keep. We keep the text of those pages with your order for up to 30 days and delete it sooner when you cancel, when you take someone off your page, and within 7 days after we start making your page. After you pay, we also have our image and language model provider copy staff bios and service descriptions from those pages, word for word, for the intro video on your waiting room TV, and we keep them with your order as How long we keep things says.

You can also have us read your office website on the first step of an order, before you pay. We read the same pages and send their text to our image and language model provider in the same way, and we keep a scrambled code of your internet address to limit how many reads one address can ask for. Before you pay, we show you only what we found about your office: its name, its kind of place, how many people and locations we found, and each location’s name, city and state. If you do not pay for that order, we delete what we read 60 minutes after the read, or after your order last took it up. If you pay, it becomes part of your order as described above.

In your setup you can have us email each person on your page their own private link. We then keep that person’s email address, which you type or which we find shown with their own name on your office website (never a shared office address, and never one we make up). We use it only to send them their link, and delete it within a day after they answer, after they are taken off your page, or after you cancel.

If your kind of place is not on our list and you type it, we send what you typed, with the category you picked or typed, to our image and language model provider to check it and to suggest questions for it. A question you add to those goes to that provider too. The questions suggested or added for a kind of place are shared with the next office of the same kind. We keep what you typed, and the category you typed, with our record of that kind of place, to check later orders against it. The name we give that kind of place is read from your words, and the next office of the same kind can see it.

We save your order as you go, so you can come back to it. Your private link holds a secret code. We store only a scrambled version of that code, so our database alone cannot open your order.

When your order is paid, we email you a receipt and a link to confirm your email address and open your account, and we let our team know.

Your Lobbypie account

When an order is paid, we open an account for the email address on the order. The office owner uses it to set up the office page, send each person their permission link, approve its answers, turn the page off or on, see each pictured person’s permission status and manage billing. Visitors and children never have an account.

There is no password. You sign in with a link and a six-digit code we email to that address. Each works once and for 30 minutes, and we store only scrambled versions of them.

When your order is paid, we also email you a link to confirm your email address. It signs you in, works once and for 24 hours, and we store only a scrambled version of it.

The account holds its email address, a name, the order that opened it, when it was made, when you last signed in, when you confirmed your email address, a scrambled code of the internet address you signed in from, our payment provider’s customer reference for your billing, and the times of the latest sign-in and confirmation emails and code tries, which limit how many go out in a day.

When you set up your answers, you can record your points instead of typing them. We use that recording only to turn it into text you can check and edit, and delete it right after. Our voice provider, which turns speech into text for us, may keep a copy under its own standard policy. It is never used to make a voice.

You can also dictate an answer, during setup or when you add answers to your page. We use that recording in the same way, only to type out your words for you to check, and delete it right after. We then write the answer from your words, and you approve it before it goes on your page.

Signing in sets a cookie named lobbypie_account that keeps you signed in for up to 30 days, renewed as you use the account. It is needed for the account to work, and it is sent only to the account pages, never to an office page. Signing out removes it, and Sign out everywhere ends every signed-in device at once. Our analytics cookies, under Analytics and cookies, are separate from it.

Do not sign in on a lobby tablet or any other device visitors use.

We keep the account while your office uses Lobbypie. Ask us through Talk to us and we delete it; the orders and billing records under it keep the times listed below.

Headshots

Headshots go straight into private storage and never have a public web address. We check each file, make a clean copy without hidden details such as where or when it was taken, and delete the original. If a person chooses to show their own photo as it is, then once they give their permission we publish a square cut from it around their face for their office’s page, and delete the headshot itself. When an office adds its team from its own website, we may also keep up to three other photos of a person from it beside their headshot, for that person alone to choose from on their own link. The office never sees them. We delete the ones they did not choose when they answer, and otherwise by the same rules as a headshot. Photos of them from their office’s website are the exception: while they appear with an avatar from our collection, we keep them, as How long we keep things says. A photo they add themselves on their link does not delete the one from the office’s website either: that one waits beside the others and is kept or deleted with them.

We use a headshot only for the look its person chooses, with their permission: their own photo shown as it is, cropped to a square around their face, or their custom avatar, drawn from it. A person who would rather not use their photo can appear with an avatar from our collection instead, chosen by the office or by that person on their own link. Then no headshot of them is used. One already given is deleted straight away when the office chooses the avatar, or when the person chooses it after giving their permission. When the person chooses it on their link before answering, we keep their headshot until they answer, so they can still go back to it, and delete it when they give their permission or say no. Photos of them from their office’s website are the exception: we keep them, and until they answer they can go back to one on their link. How long we keep things says when we delete them. Our voice and photo policy explains how custom avatars, avatars from our collection, voices and recordings are kept and deleted.

When someone gives consent

Each pictured person opens their own private link. We keep a permanent record of each yes: their typed name, what they agreed to, the exact words they saw, the date and time, the internet address (IP address) it came from and the browser they used.

If they choose their own voice, they record a spoken consent statement and a short reading on that page. Nothing can be recorded until they have given voice permission.

If they take their permission back, they come off the page right away. We add that to their permanent record with the same details, and we delete their headshot and recordings.

On their link, a person can also choose an avatar from our collection instead of their photo, before or after they agree. We record which avatar and when, with a scrambled code of their internet address, and keep that choice in their permanent record too. If they choose it after they agree, we delete their headshot straight away. If they choose it before, we keep their headshot until they answer and delete it then. Photos of them from their office’s website are the exception: we keep them, as Headshots says.

When you write to us

The Talk to us form requires your name and email. Optional fields include your organization, number of locations, kind of place, your description of another business type, message, what your message is about, how many people kids meet at your place, which plan you are looking at and how you found us. Some fields are filled in from the page you came from. If you bring an estimate from pricing, we also keep its plan, team size, office answers, requested languages, voice choices, and setup and monthly totals. The form shows this estimate separately from your message. Editable estimates can be changed through Edit estimate before sending; for earlier options the calculator cannot edit, describe changes in your message.

If you came from one of our links or printouts that carries a short label, such as a link in an email from us, the form also sends that label, so we know which of our messages or printouts reached you.

We use all of this to reply to you, and we send you a short note saying your message arrived.

Records that help stop abuse

When an order, a message or a consent is saved, we also save a scrambled code made from the internet address it came from. The code is made with a secret key, so it cannot be turned back into the address. We use it to spot abuse and as part of the consent record. A consent is different in one way: its permanent record keeps the internet address as it is, as proof of who answered and from where.

Our forms use simple checks, such as a hidden field and a minimum time to fill them in, instead of puzzles.

Please do not send patient information

Lobbypie does not need information about patients, and we never ask for it. Please keep names, health details and anything else about a specific patient out of your order, your office answers and your messages.

Lobbypie receives no patient health information and is not a business associate under HIPAA, the United States health privacy law. We do not sign business associate agreements.

We do not send texts or emails to families. When an office tells families about its office page, it does so itself, on its own signs, reminders, emails, posts or printed materials, using the same Lobbypie links for everyone. Patient names, phone numbers, email addresses and appointment details never come to us.

If patient information reaches us by mistake, we delete it and do not pass it on.

Why we use it

• To prepare and run your office page, which your office can make live or take offline.
• To contact you about your order or your message.
• To send you the emails your order, account and messages need, such as your order confirmation, receipts, a link to confirm your email address, setup steps, answers waiting for your review, alerts about your page, your private link when you ask for it again, and a note that your message arrived.
• To email offices about Lobbypie. Every such email has an unsubscribe link, and unsubscribing does not stop the emails your order, account or page needs.
• To email each person on your page their own private link, when you ask us to.
• To show that each pictured person gave their own consent, and to act on it when they take it back.
• To keep the site and your order secure.
• To learn how people find and use Lobbypie, and which of our pages, messages and ads lead to orders, as Analytics and cookies says.
• To bill your office when it orders, for the setup fee and the first month and each month after that, or for a full year at a time, paid up front. Cards are paid on our payment provider’s secure page; we take no card details on this site.
• To meet our legal duties, such as keeping records of consent and of payments.

We do not sell your details.

Companies that help us

A small number of companies help us run Lobbypie. Each one handles information only to do that work for us.

• Our cloud hosting provider: our servers, private file storage, email sending, content delivery, including our own content delivery network at cdn.lobbypie.com, and the database that keeps our analytics records. For Plus videos, it also runs a language model made by another company, which writes each video’s animation from the answer, its question and the name and role of the person who reads it. That work can run in its regions outside the United States.
• Our database provider: our database, hosted by our cloud hosting provider.
• Our image and language model provider: draws each custom avatar from that person’s headshot (never for a person who appears with an avatar from our collection), reads the public pages of an office website you ask us to import from, to suggest your team and locations, to write suggested questions and answers from its service, FAQ and visit pages and, after you pay, to copy staff bios and service descriptions from them for the intro video on your waiting room TV, and checks a kind of place you type, to suggest questions for it. Its models also check the translations of your office’s answers, and translate again any that fail that check.
• Our translation model provider: its models translate your office’s answers into the languages you ordered, and check those translations.
• Our voice provider: makes each voice, and reads in it each answer, its question, each person’s greeting and the short lines around them, such as "Thanks for listening." A greeting says the name visitors see and the person’s role, or words the office writes with that person’s permission. A designed voice comes from a written description. A person’s own voice comes from the recordings they chose to make.
• Storypie: makes Lobbypie. Its answer engine drafts the answers, and its content delivery network sends the pictures, the audio and, on Plus, the videos to each screen.
• Our payment provider: takes your office’s payment by card and keeps its billing details, such as the billing address and any tax ID. We never see the card number.

Microsoft is one more company, and it is different. We use its Clarity service to see how our pages are used, and Microsoft handles what Clarity collects as its own, for its own purposes too, as Analytics and cookies says.

Our servers, database and file storage are in the United States. Making a Plus video can also run in our cloud hosting provider’s regions outside the United States, as its line above says. We share personal information only with these companies, when the law requires it, or when you ask us to.

We add a company to this list before it handles your information. The emails we send go through our cloud hosting provider.

How long we keep things

Each kind of information has a set time. When that time ends, we delete it from our systems. Backup copies of our database expire within 35 days after that.

• Orders you started but did not send: deleted, together with any headshots in them, 30 days after you last changed them.
• What we read from your website before you pay: deleted 60 minutes after the read, or after your order last took it up, unless you pay for that order.
• Staff bios and service descriptions we copy from your website: kept with your order until you use or dismiss them, and for no more than 60 days after we copy them. We delete them sooner when you cancel or take someone off your page.
• Orders you sent: kept for as long as your office uses Lobbypie. If you decide not to go ahead, ask us and we will delete your order. When an order is cancelled, its headshots and recordings are deleted within 30 days, and the order itself is kept for three years as the record of what happened.
• Billing records: kept for seven years after the payment, as tax and accounting rules require.
• Messages to Talk to us: kept for 24 months after our last reply, together with the topic, team size, plan, how you found us and any link label sent with them, plus any attached estimate or office type request. Ask us and we will delete them sooner.
• Email addresses of the people on your page: deleted within a day after that person answers their link, after they are taken off your page, or after the order is cancelled.
• Headshots: deleted within 30 days after the custom avatar is approved. We delete one sooner if that person says no, takes back their permission, is removed from the order, or has not answered within 30 days of the order being sent. If an avatar from our collection is chosen for them instead, we delete it straight away, or, when they choose the avatar themselves on their link before answering, as soon as they answer. Photos of them from their office’s website are the exception: while they appear with an avatar from our collection, we keep them until they say no, take back their permission, are removed from the order or have not answered within 30 days of the order being sent, or until the order is cancelled.
• Raw voice recordings: deleted within 30 days after the voice is made and checked. A recording whose voice is never made is deleted 45 days after it was uploaded.
• Recordings of your points: deleted right after they are turned into text. One that is never turned into text is deleted within a day.
• Custom avatars, voices and the recordings and videos made with them: kept while that person’s permission lasts. When a person takes it back on their own link, they come off the page right away. When it ends another way, they come off within one business day. Either way they are deleted within 30 days.
• Permanent consent records: each yes, each no and each take-back is kept for 7 years from the day it was recorded, in locked storage where nobody, including us, can change or delete it before then. It holds the words agreed to, the typed name, the date and time, the internet address and the browser, and no photo or recording. After 7 years it is deleted.
• The consent record in our database: kept for as long as the permission lasts and for three years after it ends, without any photo or recording, so we can show what was agreed and when. Then deleted.
• Scrambled internet address codes: kept with the order, message or consent record they belong to, and deleted with it.
• Server logs: kept for up to 90 days.
• Analytics records: kept for about 400 days, then deleted.
• What Microsoft Clarity records: kept by Microsoft, a recording for up to 30 days and some for up to 9 months.

Your rights over your information

You can ask us to show you the information we hold about you, to correct it, to delete it, or to send you a copy in a common file format. Ask us through Talk to us. We may ask you to confirm the request from the email address on your order or message, and we answer within 30 days.

We never sell personal information or use it to make automated decisions about you. To stop our analytics cookies and Clarity’s, block or delete them in your browser’s settings. To stop Clarity itself, see Analytics and cookies. To stop emails about Lobbypie, use the unsubscribe link in any of them.

Several US states give their residents privacy rights by law. Whatever state or country you live in, you have every right described here. If we turn a request down, we tell you why, and you can ask us to look at it again. We never treat anyone differently for using these rights.

Some records stay even after a deletion request, for the periods listed above: billing records and consent records. A permanent consent record cannot be deleted by anyone before its 7 years end, because it is the proof of what a person agreed to or took back.

A pictured person can take their permission back at any time through their own private link, even when we are not taking new orders. They come off the page right away, and only they can give it again.

Deleting an order also ends that office’s office page, because we cannot run it without those details.

Children

This site, ordering and the consent pages are for adults. We do not knowingly collect personal information from anyone under 18 here, and never from a child under 13. If you think a child has sent us something, tell us and we will delete it.

The office page, which families open on their own phones, on an office’s tablet or on an office’s own website, has its own kids’ privacy notice. It collects nothing that identifies a child, so we hold no personal information about children.

How we protect it

Everything travels over encrypted connections. Headshots and recordings are kept in private, encrypted storage and never have a public web address. Our team views them only through links that expire within minutes. Private links for orders, consent and office controls use secret codes, and we store only scrambled versions of those codes. Our own admin pages need a password.

If we learn of a security breach that affects your information, we tell you without undue delay, and we tell the authorities where the law requires it.

Changes to this notice

When we change this notice, we update the date at the top. We will not start using information we already hold in a new way without telling you first. If a change affects an office with a live page, we email the contact on its order at least 30 days before the change takes effect.