Privacy Policy

CallAngel (“we”, “us”, or “our”) operates an AI-powered voice receptionist platform that answers inbound calls, books appointments, and sends SMS confirmations on behalf of businesses. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

We collect the following categories of personal information:

• Identity data: name and email address provided during account registration or collected during a call.
• Contact data: phone number used for SMS notifications and voice call identification.
• Appointment details: service type, scheduling preferences, and session information collected through voice calls or the dashboard.
• Call transcripts and summaries: machine-generated transcripts and AI-written summaries of inbound calls handled by our AI voice system.
• Calendar data: availability windows and event details exchanged with your connected calendar for appointment scheduling.
• Payment data: deposit amounts and payment status. We do not store full card numbers; all payment processing is handled by our payment provider.
• Usage data: log data, IP addresses, browser type, and pages visited, collected automatically when you use our web interface.

2. How We Use Your Information

• Answering inbound calls via our AI voice system and booking appointments on your behalf.
• Sending SMS messages for appointment confirmations, payment deposit links, and service preparation instructions.
• Scheduling and managing appointments through your connected calendar.
• Processing deposit payments securely.
• Displaying call history, job records, and analytics in the business owner dashboard.
• Improving our AI models and service quality (using anonymized or aggregated data only).

3. AI Voice Processing

Inbound voice calls are handled by our AI voice system, which processes the call audio in real time, generates a transcript, and returns a structured summary to our system. We do not store raw audio recordings — only the transcript and AI-generated summary are stored and accessible to the business account owner.

4. SMS Messaging

We send SMS messages on behalf of the businesses that use CallAngel. When you call a business powered by CallAngel and request a service — such as booking an appointment — transactional SMS messages are sent as a direct result of your service request to the phone number you called from. These messages include appointment confirmations, payment deposit links, and service preparation instructions. No marketing or promotional messages are ever sent.

CallAngel does not sell, share, or transfer your phone number or SMS opt-in consent to any third party. SMS messages are sent solely to fulfill your request made during a phone call.

• Message frequency: 1–3 messages per appointment.
• Message and data rates may apply.
• Reply STOP to opt out at any time. No further messages will be sent after opt-out.
• Reply HELP for assistance.
• Mobile phone numbers are never shared or sold to third parties for marketing purposes.

SMS messages are delivered by major US wireless carriers including AT&T, T-Mobile, Verizon, and others. Carriers are not liable for delayed or undelivered messages.

5. Voice Calls and Transcription

When a caller contacts a phone number powered by CallAngel, the call is answered by an AI voice agent. The call is processed by an automated AI system in real time and a transcript is generated. No audio recording is stored. Callers are interacting with an automated AI system. Business owners who use our platform are responsible for ensuring that any local call recording or call-processing disclosure requirements are met for their jurisdiction.

6. Calendar Integration

When a business owner connects Google Calendar, we use that integration to read availability and create appointment events. We access only the calendar data necessary to check availability and book appointments. We do not read, store, or share the content of existing calendar events.

CallAngel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data obtained through this connection is used solely to check the business’s availability and to create and manage the business’s own appointment events. We never use this data for advertising, we never use it to train non-personalized AI or machine learning models, and we never sell, rent, or transfer it to third parties except as strictly necessary to provide this calendar feature.

7. Payments

All payment processing is handled by Stripe, a PCI-compliant payment provider. We store only the payment status and deposit amount in our system. Full card numbers, CVV codes, and bank account details are never transmitted to or stored on our servers. Stripe’s own privacy policy governs the data you provide directly to Stripe.

8. Data Storage and Security

Your data is stored in a secure, hosted PostgreSQL database in the United States. We enforce strict access controls that restrict each business owner’s access to their own data only. Data in transit is encrypted using TLS. Data at rest is encrypted by our cloud storage provider.

The Google OAuth access token itself is never stored at all — it is used once during the calendar connection flow and then discarded. The only Google-related data we persist is the timestamp of the connection and the email address of the connected Google account, and this data is protected by the same TLS-in-transit encryption, encryption at rest, and per-owner access controls described above.

9. Data Retention

We retain data for the following periods:

• Call transcripts and summaries: Retained for the duration of your subscription, then deleted within 30 days of account closure.
• Booked appointment records: Retained for the duration of your subscription, then deleted upon account closure.
• Demo lead data (phone, email): Retained until deleted by our team; we do not currently run an automated deletion schedule for this data.
• Billing records: Retained for 7 years as required by applicable tax law.

You may request early deletion by emailing privacy@callangel.ai.

10. Your Rights (GDPR and CCPA/CPRA)

Depending on your location, you may have the following rights regarding your personal data:

• Right to access the personal data we hold about you.
• Right to correct inaccurate personal data.
• Right to erasure (“right to be forgotten”).
• Right to data portability.
• Right to opt out of the sale or sharing of personal information. We do not sell personal data for money, but our website analytics and advertising tools (see Section 11) fall under CPRA’s broader definition of “sharing” for cross-context behavioral advertising. Use the toggle below to opt out — it disables those tools for your browser: Your Privacy Choices.
• Right to non-discrimination for exercising your privacy rights.

We handle access, correction, erasure, and portability requests manually, on a best-effort basis — we do not currently offer an automated self-service tool for these. If your request involves data from a call to a business that uses CallAngel, we act as that business’s data processor and they remain the data controller for their callers, so we may need to coordinate with them to fulfill your request.

To exercise any of these rights, contact us at support@callangel.ai.

11. Third-Party Services

We rely on third-party providers to deliver our service. Each processes data under its own privacy policy:

• Stripe — payment processing
• Google Calendar — appointment scheduling (when connected by the business owner). See Section 6 for our Google API data-use commitments, including the Limited Use disclosure.
• Google Analytics (GA4) and Google Ads — website usage analytics and ad-conversion tracking on our public marketing pages only (never on the dashboard or any authenticated page). Respects the opt-out in Section 10.
• Meta (Facebook/Instagram) Ads — ad-conversion tracking pixel on our public marketing pages only. Respects the opt-out in Section 10.
• OpenAI Ads Manager — ad-conversion tracking pixel on our public marketing pages only. Respects the opt-out in Section 10.
• PostHog — product analytics on our public marketing pages only (never on the dashboard or any authenticated page).

12. Security Incident Response

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery as required by applicable law. To report a security concern, contact us at support@callangel.ai.

13. Children’s Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. Continued use of our services after changes are posted constitutes acceptance of the revised policy.

15. Contact

For any privacy-related questions or requests, please contact us at support@callangel.ai.

16. New Zealand (Privacy Act 2020)

This section applies to individuals in New Zealand and to calls made to New Zealand businesses that use CallAngel. We handle personal information under the Privacy Act 2020 and its Information Privacy Principles (IPPs). In particular:

• We collect only the personal information needed to handle a call for the business you are calling (Information Privacy Principle 1).
• We tell you why it is collected: every call opens with a spoken notice that you are speaking with an AI assistant and that the call is transcribed (IPP 3).
• We store personal information securely and protect it against loss and misuse (IPP 5).
• You may request access to (IPP 6) and correction of (IPP 7) your personal information, free of charge, through the business you called or by contacting support@callangel.ai. We respond within 20 working days.
• Where we handle information on behalf of a business, that business is the agency responsible for it, and we help it respond to your request.

Overseas disclosure (IPP 12). Personal information is processed and stored in the United States by CallAngel and its service providers on our hosted infrastructure in the United States. We rely on contractual safeguards that provide protections comparable to those of the Privacy Act 2020.

Notifiable privacy breaches. If a privacy breach is likely to cause serious harm, we notify the Office of the Privacy Commissioner and affected individuals as soon as practicable.

Our Privacy Officer can be reached at support@callangel.ai. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.