Privacy policy

Last updated: 2026-08-07 · Version 0.1 · Status: Draft for legal review — not yet in force

This policy describes what [COMPANY LEGAL NAME] does with personal information when a business uses our phone assistant, our chat assistant, or both. Every statement below was written from the code that runs the service. Where the software does something a privacy policy would rather not admit, the admission is here instead of an omission.

1. Who we are, and which role we play

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], operating the phone assistant and the chat assistant described at this site.

For information about a business's own customers — the people who call its phone number — that business decides what is collected and why. We process it on their instructions and under contract. Under PIPEDA the transfer of that information to us is a use by that business, not a disclosure, and the business remains accountable for it. Where the business is an Ontario health information custodian we are an electronic service provider and, in most configurations, an agent under PHIPA.

For information about the business's own staff — login email addresses, which member of staff used the assistant and how much — we decide the purposes ourselves, because that is how we run and bill for the service.

2. What we collect

2.1 Telephone calls

For every call answered by the phone assistant we store:

• the caller's telephone number, the business number dialled, and the caller's name if the assistant was told it;
• the complete transcript of the conversation, word for word;
• a link to the recording, where recording is switched on (it is on by default) — the audio itself is held by our telephony provider, not by us;
• the duration, the time, the cost of the call, and flags marking a call as spam or as needing follow-up.

The transcript is not summarised, filtered or redacted. Nothing in the software limits what a caller may say into it. For a dental practice that routinely means health information — symptoms, medication, why an appointment is wanted. For a law firm it can mean information subject to solicitor-client privilege.

2.2 Automated analysis of calls

After a call ends we send the transcript, together with the caller's number and the number dialled, to OpenAI, and store what comes back: a written summary, a sentiment reading, a satisfaction score, a list of topics, action items, and a reconstructed question-and-answer version of the conversation. The instructions we give the model also ask it to pick out the caller's name, email address and company from what was said, and we store those too.

2.3 The contact record built from your callers

Unless the business turns the feature off, the end of a call automatically creates or updates a contact record keyed to the caller's telephone number, holding their name, email, company, address, free-text notes, a lifecycle stage and a lead score — plus an interaction record containing a second copy of the transcript, the recording link, the AI summary, the sentiment and the action items.

2.4 The chat assistant

The chat assistant runs on a virtual machine rented for the business that uses it. The messages live on that machine, not in our database. What our database keeps is a pointer to each conversation: an identifier, which business and which user it belongs to, timestamps, and a title — and the title is the first 120 characters of the first message you sent, so it is content, not just a label.

2.5 Files you attach to a chat

Images, PDFs, Word documents, text files and MP3 audio are converted to text inside our application and never written to disk anywhere in our infrastructure: images are described by OpenAI's vision model, audio is transcribed by OpenAI, and documents are parsed in memory. The assistant never receives your file — only the text.

The text does, however, reach the assistant, and the assistant may commit it to its long-term memory, which is shared by everyone at your business and which deleting the conversation does not purge. A patient chart pasted into a PDF is therefore not stored as a file by us, and also not removable by you.

2.6 What you tell the assistant about your business

Opening hours, services, policies, greeting text and general information — up to 40,000 characters — plus a save history so a bad edit can be undone. The history keeps the last ten versions and nothing older than 180 days.

2.7 Reminders and notifications

A reminder stores the text you wrote, its schedule and timezone, when it last fired, and a snapshot of the title of the conversation it was created from. The text is delivered verbatim and is never sent to any AI model. If you allow browser notifications we also store, per browser, the push service's address and the two public keys your browser generated; the notification content is encrypted so that the push service itself cannot read it.

2.8 Usage records

Every metered action writes a row recording the business, the individual user, the conversation, what kind of work it was, the token counts, the model label and the time. This is how the bill is produced and how a surprising charge can be traced. It is also a record of which member of staff used the assistant, when, and how much.

2.9 Accounts, forms and operational logs

• Accounts: email address and a hashed password. There are exactly two roles: a customer user, and our own administrators.
• Signup requests: business name, contact name, email, telephone, whatever you typed in the message box, the source of the form, and the IP address it was submitted from. A signup creates this row and an email to us, and nothing else — no account, no telephone number, no machine.
• Contact and intake forms from our marketing site are emailed to us and not stored in the application at all.
• Operational events record things like a blocked caller or a rejected webhook. Some of these contain a caller's telephone number in plain text. They are deleted after 90 days.
• Server logs written by the operating system also contain caller telephone numbers. Their lifetime is controlled by the server's log configuration and not by the application; API keys, authorisation headers and request bodies are deliberately never logged.
• Machine health: how full each customer's chat machine's disk is, sampled every fifteen minutes and kept for 30 days. No personal information is in these rows.

3. Why we collect it

• To answer the telephone. A transcript is how the business finds out what its caller wanted.
• To tell the business what happened. Summaries by email and SMS, follow-up items, and the contact record.
• To run the chat assistant and to give it the facts about the business it needs to answer correctly.
• To bill accurately and to warn a customer before they pass an allowance.
• To keep the service working — spam and abuse controls, rate limits, disk and error monitoring.

We do not sell personal information, we do not share it for advertising, and we do not use call transcripts or chat messages to train our own models. What our AI providers may do with what we send them is governed by our agreements with them; see the sub-processor list.

4. Where it goes — all of it is in the United States

A complete list of who receives what is at Sub-processors. One item on it is worth repeating here: our telephony provider uses its own speech-to-text vendor, which we do not currently pin to a named company, so caller audio is heard by a provider we cannot name for you today.

5. How long we keep it

In summary: call records and their AI analysis are deleted six months after the call; operational events after 90 days; the knowledge save history after 180 days; machine health samples after 30 days. Several other tables — including the contact records built from your callers, the usage ledger, chat conversation pointers and signup requests — are not deleted by anything today. Backups are kept for a further period after deletion.

The full table-by-table schedule, including the gaps, is at Data retention & deletion. We publish the gaps rather than a rounded-off promise because a retention period that is not enforced by a running job is not a retention period.

6. What deleting something actually does

We would rather write that paragraph than the sentence a template offers — "you may delete your data at any time" — which in this product would be untrue in five separate places.

7. Your rights, and how to use them

You may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, ask how it has been used and to whom it has been disclosed, and withdraw consent subject to legal and contractual limits. Where the information belongs to a business's customer rather than to the business itself, we will normally direct the request to that business, since it decides what happens to it — and we will help them act on it.

Send requests to [PRIVACY OFFICER NAME AND TITLE] at [PRIVACY CONTACT EMAIL]. We will respond within [RESPONSE TIME — PIPEDA'S OUTER LIMIT IS 30 DAYS].

8. Automated decisions

The assistants generate speech and text automatically, and the analysis assigns a sentiment, a satisfaction score and a lead score to a caller. None of these makes a decision about anyone on its own — they are notes for a human at the business. The assistant can be wrong, and it can misunderstand what was said; its output is not advice of any kind, medical, legal or otherwise.

9. Safeguards

Summarised here, and set out honestly — including what is not protected — in the security overview. Briefly: passwords are hashed; per-customer credentials are encrypted in our database with a separate key; traffic is encrypted in transit; API keys and request bodies are never written to logs; each customer's chat assistant normally has a machine of its own. Transcripts, caller names, telephone numbers and contact notes are stored as ordinary text in the database, not encrypted field by field.

10. Breaches

If personal information in our care is lost, stolen or accessed without authorisation and there is a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals and the affected business as soon as feasible. Where the business is a health information custodian we will notify it at the first reasonable opportunity. We keep a record of every such incident for at least 24 months.

11. Changes to this policy

The date at the top of this page changes whenever the document does. Material changes will be notified to customers by email before they take effect.

12. Complaints

Complain to us first — [PRIVACY CONTACT EMAIL] — and we will investigate and tell you what we found. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial regulator where one applies (Alberta, British Columbia and Quebec each have one, and Ontario's Information and Privacy Commissioner oversees health information).