AI Phone Genius Privacy Policy
Draft dated July 21, 2026 — attorney review required before external sale.
1. Information handled
Workspace account and billing identifiers; contact lists supplied by customers; consent evidence; phone numbers; agent configurations; call metadata, recordings, transcripts, summaries, and analyses; web-chat preview messages; audit and security logs; and information submitted through the public contact form may be processed by the service.
2. Why it is used
We use this information to authenticate users, operate requested calls, enforce consent and do-not-call controls, produce reporting, process payments, deliver configured integrations and webhooks, provide support, prevent abuse, and maintain the service.
3. Service providers
Depending on deployment and enabled features, information may be sent to infrastructure and database hosts, Retell AI for voice operations, Stripe for billing, Inngest for background jobs, and customer-selected notification or webhook destinations. Customers must review and accept the terms of every provider they enable.
4. Retention and deletion
Data remains stored until an authorized operator deletes it or a separately enabled retention service removes it. The current retention preference screen records policy intent but does not run automated deletion. Customers may request manual deletion and should not promise an automated schedule until the operator confirms it is active.
5. Customer responsibilities
Customers control the contact data and calling instructions they place in the service. They are responsible for a lawful basis to process and call each person, required notices and recording consent, accurate consent evidence, responding to data-subject requests, and honoring opt-outs and applicable retention requirements.
6. Security and access
The service uses encrypted transport, signed session cookies, hashed passwords and API keys, role checks, tenant row isolation, signed provider webhooks, audit logs, and restricted outbound URL handling. No system is perfectly secure; credentials must be kept secret and suspected compromise should be reported promptly.
7. Requests and contact
Access, correction, deletion, or privacy questions should be submitted through the public contact page. The operator will verify authority before acting on workspace or call data.
This is a non-final operational draft and has not been reviewed by counsel. Add the operator's legal entity, address, jurisdiction-specific disclosures, and a dedicated privacy contact before publication.