Executive Assessment

The proposed policy is directionally strong in transparency, customer responsibility, security disclaimers, and jurisdictional caveats. The principal risk is not that it protects James Hoyt LLC too aggressively. The larger risk is that several clauses could be read as granting rights that posting alone may not legally create, particularly where a change materially expands the use of information already collected.

1. Policy Changes: Avoid Unlimited Retroactive Effect

The policy can state that posting is the ordinary way bizMelio communicates revisions. The dangerous step is treating that statement as permission to apply a materially expanded use to personal information collected under an earlier, more restrictive promise.

In the FTC’s Gateway Learning matter, the agency alleged that the company changed its privacy policy after collecting information and then applied the more permissive policy to previously collected data. The FTC characterized retroactive application of a materially changed policy as an unfair practice and required affirmative consent before previously collected information could be shared under the new policy.¹

FTC: “retroactive application of a materially changed privacy policy … was an unfair practice.”

The FTC reinforced this position in 2024 in the AI context, warning that it may be unfair or deceptive to begin sharing consumer data with third parties or using that data for AI training and disclose the change only through a retroactive amendment to terms or a privacy policy.²

2. Continued Use Is Not a Reliable Substitute for Affirmative Assent

The proposed statement that continued use constitutes acknowledgment of an updated policy should not be the legal foundation for consent to materially expanded data practices.

In Berman v. Freedom Financial Network LLC, the Ninth Circuit explained that online agreements based on inquiry notice generally require both reasonably conspicuous notice and an action that unambiguously manifests assent. The court contrasted strong clickwrap implementation with passive browsewrap arrangements.³

Ninth Circuit: a website generally needs “reasonably conspicuous notice” and an action that “unambiguously manifests” assent when it relies on inquiry notice.

The same line of authority traces back to Nguyen v. Barnes & Noble, in which the Ninth Circuit held that proximity of a terms hyperlink to buttons on a website, without more, was insufficient to create constructive notice of an arbitration agreement.⁴

3. Privacy Disclosures Shape Reasonable User Expectations

Privacy notices affect more than disclosure compliance. Courts may use them to determine what a reasonable user believed the company would or would not collect.

In Calhoun v. Google LLC, the Ninth Circuit reversed summary judgment because the lower court had not properly evaluated whether a reasonable user reading Google’s various disclosures would understand that the disputed data collection was occurring. The decision emphasizes that consent analysis turns on how a reasonable user would understand the actual disclosures, not merely on internal technical distinctions.⁵

4. “Strategic Partnerships” Needs Purpose and Recipient Guardrails

The term “strategic partner” can preserve useful commercial flexibility, but it should not read like an unrestricted secondary-use license.

The FTC’s Avast enforcement is a useful warning. The agency alleged that Avast collected detailed browsing information, retained it, and sold it without adequate notice and consent while marketing privacy-related products. The final order included a $16.5 million payment and restrictions on selling, disclosing, or licensing browsing data for advertising purposes.⁶

FTC: Avast allegedly failed to adequately inform users that detailed, re-identifiable browsing data would be sold.

California law also grants consumers the right to opt out of the sale or sharing of personal information and imposes notice and operational duties on covered businesses.⁷

5. Service Improvement and AI: Separate Operations from Generalized Training

The policy may reasonably reserve rights to maintain, secure, test, analyze, and improve the services. The harder issue is using identifiable call recordings, transcripts, CRM data, message content, or customer/end-user content to train generalized models that benefit customers other than the customer from whom the information originated.

The FTC has stated that AI companies must honor privacy and confidentiality commitments and that retaining or using consumer information for other purposes without clear notice and affirmative express consent can create enforcement risk, particularly when the change is hidden in legalese, hyperlinks, or fine print.⁸

6. California Privacy: Notice, Rights, Risk Assessments, ADMT

California remains one of the most important jurisdictions for an AI-enabled CRM and communications platform. The California Attorney General currently identifies rights including access, deletion, correction, opt-out of sale/sharing, limitation of certain sensitive-information uses, and non-discrimination.⁷

The California Privacy Protection Agency adopted updated CCPA regulations that became effective January 1, 2026. The rulemaking addresses cybersecurity audits, privacy risk assessments, and automated decision-making technology, with phased compliance dates for some requirements.⁹

7. Call Recording: California Creates Interstate Risk

Because bizMelio.ai supports voice-agent workflows, recording and transcription cannot be treated as a purely abstract customer-compliance issue.

In Kearney v. Salomon Smith Barney, the California Supreme Court addressed calls involving California clients that were recorded outside California and emphasized California’s strong privacy interest. The court also explained that a business that adequately advises all parties at the outset that the call will be recorded would not violate the provision discussed in the decision.¹⁰

In Smith v. LoanMe, Inc., the California Supreme Court held that Penal Code section 632.7 applies to parties to a call as well as nonparties, making the consent of all parties significant for covered cellular or cordless communications.¹¹

8. AI Voice Calls and the TCPA

The FCC announced in February 2024 that calls using AI-generated voices fall within the TCPA’s treatment of “artificial” voices. The FCC’s declaratory position makes consent analysis especially important for outbound AI-generated calls.¹²

The regulatory landscape changed in 2025. In Insurance Marketing Coalition Ltd. v. FCC, the Eleventh Circuit held that the FCC exceeded its statutory authority when it attempted to add a one-to-one-consent restriction and a logically/topically-associated restriction to the statutory concept of prior express consent.¹³ That decision did not erase the TCPA or every written-consent obligation applicable to covered telemarketing activity.

9. Data Security and Breach Language

The proposed statement that no system can be guaranteed completely secure is appropriate. It should not be paired with wording that appears to disclaim legal duties to maintain reasonable safeguards or respond to legally qualifying security incidents.

The California Attorney General states that, under specified circumstances, consumers may bring a CCPA claim arising from a breach involving specified nonencrypted and nonredacted personal information when the breach resulted from failure to maintain reasonable security procedures and practices. The AG identifies statutory damages of up to $750 per incident where the statutory requirements are satisfied.⁷

10. Processor / Service Provider Status Should Be Contractual

The public policy can explain that bizMelio may act as a processor, service provider, contractor, or similar role. The policy itself, however, does not establish those classifications for every transaction.

Actual status depends on the applicable law, contractual restrictions, purposes of processing, and real behavior of the platform. For that reason, the privacy policy should be paired with a Data Processing Addendum addressing customer instructions, confidentiality, subprocessors, security, rights requests, deletion/return, audit cooperation, international transfers where relevant, and the exact rules governing use of customer content for AI improvement.

11. Specific Draft Language to Revise

12. Counsel Review Checklist

• Confirm which comprehensive state privacy statutes currently apply to James Hoyt LLC and likely near-term triggers as bizMelio grows.
• Map website analytics, CRM, SMS, email, voice recording, transcription, AI inference, calendar, payments, advertising pixels, subprocessors, and exports.
• Determine whether identifiable customer or end-user content is ever used to train generalized AI models.
• Prepare a DPA and current subprocessor disclosure that match the public policy.
• Create a retention schedule by data category instead of relying only on “as necessary” language.
• Review call-recording and AI disclosure scripts for all-party-consent jurisdictions, particularly California.
• Review TCPA consent capture, evidence retention, revocation, do-not-call, SMS STOP, and suppression workflows.
• Assess cookies, pixels, analytics, and advertising relationships for California “sale” or “sharing” implications and Global Privacy Control handling.
• Make the notice-at-collection disclosures consistent with the full policy and backend practices.
• Keep versioned copies of every privacy policy and effective date to establish what representations were in force at a particular time.

Bottom-Line Opinion

The proposed policy is a credible foundation, but the strongest protective language should become more precise rather than more expansive. The recurring lesson across the cited authorities is alignment: the public policy, consent flows, contracts, DPA, product configuration, actual data uses, and subprocessor behavior should tell the same story.

James Hoyt LLC can reserve meaningful rights to analyze data, improve services, build integrations, use aggregated or de-identified information, and work with strategic partners. Those rights are more defensible when the permitted purposes and controls are defined than when the policy relies on a broad reservation of rights that could later be characterized as an undisclosed secondary use.

The highest-priority changes are: narrow retroactive-change language; avoid treating passive continued use as blanket consent; constrain strategic-partner disclosures; distinguish ordinary service improvement from generalized AI training; operationalize call-recording and TCPA compliance; and pair the public policy with a DPA, retention schedule, subprocessor inventory, and rights-request workflow.