Privacy Policy

This Privacy Policy is intended for U.S. users and customers. It describes our practices generally and also explains certain additional rights that may apply to residents of particular U.S. states, including California, where applicable. By accessing or using the Services, or otherwise interacting with us, you acknowledge that your personal information will be handled as described in this Privacy Policy.

1. Scope

This Privacy Policy applies to personal information we collect:

• through our websites and online services;
• when you create an account, request a demo, or enquire about our Services;
• when you use our AI voice, messaging, call handling, workflow, booking, or integration features;
• when we communicate with you for support, billing, compliance, or business purposes;
• from third parties and service providers connected to our Services; and
• through recordings, transcripts, analytics, logs, and usage data generated through use of our Services.

This Privacy Policy does not apply to third-party websites, applications, platforms, or services that we do not control, even if they integrate with our Services.

2. Categories of personal information we collect

The categories of personal information we collect depend on how you interact with us and use the Services. They may include:

2.1 Identifiers and account information

• name;
• business name;
• employer;
• job title;
• email address;
• phone number;
• billing contact details;
• account credentials; and
• support and contact history.

2.2 Commercial and transaction information

• subscription details;
• invoices;
• payment confirmations;
• service plan information;
• order history; and
• other billing and account records.

2.3 Communications and interaction data

• phone numbers;
• caller and recipient details;
• call metadata;
• SMS or messaging content;
• call recordings;
• voicemails;
• transcripts;
• summaries;
• chat logs;
• call routing outcomes;
• booking details;
• prompts, scripts, and workflow instructions; and
• support interactions.

2.4 Technical, device, and usage data

• IP address;
• browser and device information;
• operating system;
• log data;
• session data;
• API activity;
• integration metadata;
• analytics data;
• cookie and similar technology data; and
• diagnostic and performance information.

2.5 Compliance and operational data

• consent records;
• opt-out records;
• suppression and do-not-contact records;
• complaint records;
• campaign configuration data;
• lead source information; and
• industry and use-case information.

2.6 Sensitive information

We do not intentionally collect sensitive personal information unless reasonably necessary for a permitted business purpose, a client-enabled feature, or a lawful and properly authorised use case. If a client enables functions involving recordings, voice analysis, speaker verification, healthcare workflows, financial workflows, or similar higher-sensitivity use cases, additional controls or addenda may apply.

2.7 Children's information

Our Services are not directed to children under 13, and we do not knowingly collect personal information online from children under 13 in a manner subject to COPPA. If we become aware that we have collected covered personal information from a child under 13 without the required authorization, we will take appropriate steps to delete it.

3. How we collect personal information

We may collect personal information:

• directly from you when you create an account, complete forms, request a demo, contact us, or use the Services;
• from your employees, contractors, agents, or representatives;
• from your connected systems, integrations, CRMs, calendars, websites, phone systems, and other software;
• from people who communicate with AI agents or workflows operated by you through the Services;
• from payment processors, carriers, cloud providers, analytics providers, and other vendors;
• automatically through cookies, logs, telemetry, and analytics tools; and
• where permitted by law, from public sources and third-party data providers.

If you provide us with personal information about another person, you must ensure you are authorized to do so and that the person has been informed their information may be handled in accordance with this Privacy Policy.

4. Why we collect, use, and disclose personal information

We may collect, hold, use, and disclose personal information for purposes including:

• providing, operating, maintaining, securing, and supporting the Services;
• setting up and administering accounts;
• authenticating users and controlling access;
• provisioning phone numbers, workflows, integrations, and service features;
• enabling inbound and outbound communications;
• generating call recordings, transcripts, summaries, and related outputs;
• troubleshooting issues and providing support;
• billing, collections, payments, renewals, chargeback handling, and financial administration;
• monitoring, investigating, preventing, and responding to fraud, abuse, spam, security incidents, and unlawful conduct;
• enforcing our Terms, acceptable use requirements, and other legal rights;
• complying with legal, regulatory, contractual, and carrier obligations;
• improving, testing, developing, and analyzing our Services, security, operations, and performance;
• communicating with you about service changes, updates, notices, renewals, and support matters; and
• sending marketing communications where permitted by law.

We may also use or disclose personal information for any other purpose permitted or required by law.

5. SMS and mobile messaging

Callrix AI may send SMS or mobile text messages to users, customers, prospects, or business contacts who provide a mobile phone number and consent to receive messages from us. These messages may include onboarding information, product updates, support messages, account-related notices, appointment reminders, call summaries, follow-up links, and other service-related communications.

We do not sell, rent, or share mobile phone numbers with third parties for their marketing or promotional purposes. Mobile phone numbers may be shared only with service providers, telecommunications providers, messaging platforms, and other vendors where necessary to deliver messages, operate our services, comply with legal obligations, prevent fraud, or protect the rights and security of Callrix AI, our customers, and users.

Message frequency may vary depending on your interaction with Callrix AI, your account settings, and the services you use. For marketing or onboarding communications, you may receive up to 4 messages per month. Transactional, service-related, support, verification, appointment, or call-summary messages may vary based on your activity and preferences.

Message and data rates may apply. Message delivery is subject to your mobile carrier and is not guaranteed. You may opt out of receiving SMS messages at any time by replying STOP. For help, reply HELP or contact us at support@callrix.ai.

6. AI, recordings, and operational use of data

Calls, chats, and workflows may involve automated speech recognition, natural language processing, AI-generated outputs, transcription, summarization, routing, and related automated or assisted processing.

Where reasonably necessary to provide, maintain, secure, support, and enforce the Services, we and our service providers may host, store, copy, transmit, process, and otherwise use personal information and client data. We do not acquire ownership of client data merely because it is processed through the Services.

Unless we expressly agree otherwise in writing, we do not use recordings, transcripts, or other client content to train general models for unrelated customers.

If a client enables speaker verification, voice analysis, or other higher-sensitivity features, that client is responsible for configuring and using those features lawfully and for obtaining any required notices or consents.

7. Google user data (Google Calendar integration)

Callrix AI offers an optional Google Calendar integration that lets our AI voice and messaging agents check a connected user's availability and schedule, reschedule, or cancel appointments on that user's behalf. This section describes specifically how we access, use, store, and share Google user data. To the extent it differs from the general provisions of this Privacy Policy, this section controls with respect to Google user data.

7.1 When we access Google data

We access Google user data only after you (or your authorized representative) connect a Google Account to Callrix AI through Google's OAuth consent flow and grant the requested permissions. Connecting is optional; Callrix AI operates without the Google Calendar integration if you decline. You can disconnect at any time (see Section 7.7).

7.2 Google permissions (scopes) we request

We request only the Google OAuth scopes needed to identify the account you connect and operate the scheduling features you enable:

• openid - to sign in and confirm the identity of the Google Account you connect, so we can associate the connection with the correct account.
• https://www.googleapis.com/auth/userinfo.email - to read the email address of the Google Account you connect. We use it only to label the connected account in your Callrix AI dashboard so you can see which account is linked; we do not use it for advertising or marketing.
• https://www.googleapis.com/auth/calendar.freebusy - to read your free/busy availability so our agents can offer open time slots. This permission returns only busy and free time ranges, not the contents, titles, or attendees of your events.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly - to show you the list of calendars on your account, so you can choose which ones we check for availability and which one we book into.
• https://www.googleapis.com/auth/calendar.events - to create, update, and cancel appointment events on the calendars you select. Google grants this permission at the account level rather than per calendar, so it technically permits access to events on your calendars generally; we use it only to manage appointments booked through Callrix AI, as described in Section 7.3.

We do not request permission to download the full contents of your calendars (for example, the broader calendar.readonly or calendar scopes), and we do not request access to Gmail, Drive, Contacts, or any other Google service.

7.3 How we use Google data

We use Google Calendar data solely to provide the user-facing scheduling features you enable - specifically to determine availability, book appointments, reschedule or cancel appointments, and send related confirmations and reminders. We use the email address of the connected account only to identify and display which Google Account is linked. We do not read, index, or analyze the contents of events that Callrix AI did not create. Our use of Google user data is limited to providing these prominent, user-facing features.

7.4 How we store Google data

We store only what is necessary to operate the integration - for example, OAuth access and refresh tokens (held in encrypted form), the Google account identifier and email address of the connected account, calendar identifiers, and the details of appointments booked through Callrix AI. Tokens are stored securely and used only to make authorized Google Calendar API requests on your behalf. We retain this data only while your Google Account remains connected or as needed to provide the Services, and we delete it in accordance with Section 11 (Data retention) and upon disconnection or your request.

7.5 How we share Google data

We do not sell Google user data, and we do not transfer or share it with third parties except as strictly necessary to provide the integration to you (for example, our cloud infrastructure and Google API service providers acting as our processors under confidentiality obligations), to comply with applicable law, or as you direct. We do not use Google user data for advertising, and we do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

7.6 Limited Use - compliance with the Google API Services User Data Policy

Callrix AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data to serve advertisements; we do not transfer or sell it to third parties such as advertising platforms, data brokers, or information resellers; we do not use it to determine creditworthiness or for lending purposes; and we permit humans to read Google user data only (a) with your consent for specific data, (b) where necessary for security purposes such as investigating abuse, (c) where required to comply with applicable law, or (d) where the data has been aggregated and de-identified.

7.7 Revoking access

You can disconnect the Google Calendar integration at any time from within Callrix AI, or by revoking Callrix AI's access from your Google Account permissions at https://myaccount.google.com/permissions. Revoking access stops further data access; we will delete stored Google tokens and associated calendar data except where retention is required by law.

8. Cookies and similar technologies

We use cookies, pixels, local storage, SDKs, and similar technologies to operate the website and Services, remember preferences, understand usage, improve performance, maintain security, and support analytics and advertising.

We group these into four categories: Strictly necessary (always on - security, your consent record, attribution for purchases), Functional (preference memory), Analytics & performance (aggregate usage measurement), and Marketing & advertising (relevant ads and campaign measurement). Non-essential categories are set only after you opt in. Your consent record is stored for 12 months, after which we ask again.

You can review or change your choices at any time using the Cookie preferences link in the footer of every page. We honor the Global Privacy Control (GPC) browser signal as a request to opt out of sale or sharing. You can also control cookies through your browser settings, but disabling them may affect functionality.

B2B visitor identification (Snitcher). With your consent to marketing cookies, we use Snitcher to identify the company (not the individual) associated with visits to our website, using your IP address and related technical signals. This helps us understand which businesses are interested in Callrix AI and follow up with relevant B2B communications. Snitcher acts as our processor; data is handled under their privacy terms. You can opt out at any time by rejecting marketing cookies in our Cookie preferences, and you can review Snitcher's practices at https://www.snitcher.com/privacy.

9. How we disclose personal information

We may disclose personal information to:

• our related entities and corporate affiliates;
• carriers and communications providers;
• cloud and infrastructure providers;
• transcription, analytics, and AI providers;
• CRM, calendar, messaging, telephony, and integration partners;
• payment processors and billing providers;
• contractors, advisers, auditors, insurers, financiers, and professional service providers;
• resellers, channel partners, and implementation partners;
• regulators, courts, law enforcement, government agencies, or other parties where required or authorized by law;
• a purchaser, investor, financier, acquirer, or successor in connection with a proposed or actual corporate transaction; and
• other parties where the relevant individual has consented or where disclosure is otherwise permitted by law.

We may disclose personal information to service providers and contractors for operational business purposes. We do not disclose personal information to third parties except as described in this Privacy Policy or as otherwise permitted by law. Google user data is disclosed only as described in Section 7.5.

10. Data security

We take reasonable and appropriate steps to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. These steps may include:

• access controls and authentication measures;
• encryption and secure transmission methods where appropriate;
• monitoring and logging;
• vendor and infrastructure controls;
• staff training and internal policies;
• data minimization and retention controls; and
• incident response and security review processes.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, to comply with legal and regulatory obligations, to resolve disputes, to enforce our agreements, and for legitimate business and security purposes.

We may delete, destroy, or de-identify personal information when it is no longer required, subject to legal, regulatory, evidentiary, fraud-prevention, security, and operational retention needs.

12. U.S. state privacy rights

Residents of certain U.S. states may have privacy rights under applicable state laws, including rights to request access to, correction of, deletion of, or portability of certain personal information, and rights to opt out of certain uses or disclosures such as targeted advertising, sale, profiling, or sharing, where those rights apply.

We will process verifiable privacy rights requests in accordance with applicable law. We may need to verify your identity before acting on a request.

You may submit a privacy rights request by contacting us at support@callrix.ai.

We will not unlawfully discriminate against you for exercising applicable privacy rights.

13. Additional notice for California residents

This section applies to California residents to the extent the California Consumer Privacy Act, as amended, applies to our processing.

13.1 Categories of personal information

In the preceding 12 months, we may have collected the categories of personal information described in Section 2 of this Privacy Policy.

13.2 Purposes

We collect, use, retain, and disclose personal information for the business and commercial purposes described in Sections 3, 4, 6, 7, 8, 9, 10, and 11 of this Privacy Policy.

13.3 Sale, sharing, and targeted advertising

We do not sell personal information for money. We may use analytics, cookies, and similar technologies in ways that could be treated as "sharing" or a "sale" under certain U.S. state privacy laws, depending on the context. Where required by applicable law, you may have the right to opt out of those activities. We do not sell or share Google user data (see Section 7.5).

13.4 Sensitive personal information

We do not use or disclose sensitive personal information to infer characteristics about a consumer except as permitted by law or as necessary to provide the Services.

13.5 Rights

Subject to applicable law and verification, California residents may have the right to request:

• access to categories and specific pieces of personal information;
• correction of inaccurate personal information;
• deletion of personal information;
• information about categories of personal information disclosed for business purposes; and
• opt out of sale or sharing, where applicable.

Authorized agents may submit requests on behalf of California residents where permitted by law.

14. Role when we act for clients

When we handle personal information on behalf of a client, such as answering their calls, updating their CRM, operating workflows, or processing recordings and transcripts under their instructions, we may act as a service provider, processor, or contractor to that client depending on the context and applicable law. In those situations, the relevant client's privacy policy may also apply, and certain privacy rights requests may need to be directed to that client. We may assist our clients with such requests as required by law or contract.

15. International processing

We may store, host, process, back up, or otherwise handle personal information in the United States and other countries in which we or our service providers operate. Appropriate recipients may include affiliates, infrastructure providers, communications providers, and support providers involved in delivering the Services.

For entity-identification purposes, Callrix AI LTD is organized under the laws of Israel.

16. Third-party links and services

Our websites and Services may link to or integrate with third-party sites, tools, and platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our website with the revised effective date. If changes are material, we may also provide additional notice where appropriate.

18. Contact us