Privacy Policy

1. Introduction

CallSphere LLC ("CallSphere," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our AI-powered voice agent platform and related services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies, please do not use our Services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and billing information when you register for our Services.
• Communication Data: Voice recordings, transcripts, chat logs, and related metadata when you interact with our AI agents.
• Payment Information: Credit card details and billing addresses processed through PCI-compliant payment processors (Stripe, Square).
• Support Requests: Information you provide when contacting our support team.

2.2 Information Collected Automatically

• Usage Data: Information about how you interact with our Services, including session duration, features used, and interaction patterns.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Analytics Data: Aggregated data about voice agent performance, customer satisfaction scores, and workflow metrics.

2.3 Device & Fraud-Prevention Data (Voice Agent)

• Device fingerprint: a probabilistic device/browser identifier (derived from canvas, WebGL/GPU, audio-stack, fonts, screen, timezone, language, and hardware characteristics) used to recognize returning abusive sessions.
• Network data: IP address (stored only as a salted, irreversible hash), approximate geolocation (country/region/city), and network/ISP reputation including whether the connection is a VPN, proxy, Tor, or datacenter IP.
• Audio device identifiers: identifiers/labels of microphone input devices exposed by the browser during a voice session (stored hashed), used to recognize repeat devices.
• Conversation safety signals: automated moderation scores and abuse/warning counts associated with a session.
• This data is used solely to detect, prevent, and block abuse, harassment, and fraudulent use of the voice agent, and to enforce our acceptable-use rules — not for advertising or profiling unrelated to security.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our AI voice agent and chatbot Services
• To process transactions and send related information, including purchase confirmations
• To train and improve our AI models (using anonymized and aggregated data only)
• To provide customer support and respond to your inquiries
• To send administrative information, such as updates to our terms and policies
• To detect, prevent, and address technical issues, fraud, or security concerns
• To comply with legal obligations and enforce our terms of service

4. Data Security

We implement security measures to protect your information:

• Payment Processing: Payments are processed by PCI-DSS compliant providers (e.g., Stripe). We do not store card details on our servers.
• Data Protection: Personal information is stored with role-based access controls and encryption where supported by our infrastructure.
• Encryption: Encryption in transit (TLS/HTTPS) and encryption at rest where supported by our cloud providers.
• Audit Logging: Admin actions are logged for security monitoring.
• Access Controls: Role-based access controls restrict sensitive operations to authorized personnel only.

For more details about our security practices, please visit our Security page.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who assist in providing our Services (e.g., Twilio for telephony, Stripe for payments, cloud hosting providers).
• Business Clients: If you interact with a voice agent deployed by one of our business clients, relevant interaction data may be shared with that client.
• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. Data Retention

We retain your information for as long as necessary to provide our Services and fulfill the purposes described in this policy. Specifically:

• Account information is retained while your account is active and for 30 days after deletion request.
• Voice recordings and transcripts are retained according to your subscription plan settings (default: 90 days).
• Analytics and aggregated data may be retained indefinitely in anonymized form.
• Payment records are retained as required by applicable tax and financial regulations.

7. Your Rights and Choices (GDPR/CPRA)

We support GDPR and CPRA rights requests. Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability/Export: Request your data in a structured, machine-readable format.
• Opt-Out: Opt out of marketing communications at any time.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, please visit our Data Rights page or contact us at support@callsphere.ai.

For business customers requiring a Data Processing Addendum (DPA), please contact us at support@callsphere.ai.

Lawful basis for fraud prevention. The device fingerprinting and the security signals described in Section 2.3 are processed under our legitimate interest (GDPR Art. 6(1)(f)) in protecting the Services and other users from abuse, harassment, and fraud, and as a strictly-necessary security measure under the ePrivacy Directive. This data is retained only as long as needed for that anti-abuse purpose. EU/UK and California users may contact us at support@callsphere.ai to exercise access and deletion rights with respect to this data.

8. Healthcare Customers (HIPAA)

HIPAA support is available for healthcare customers with a signed Business Associate Agreement (BAA) and eligible infrastructure configuration. If you are a covered entity or business associate under HIPAA, please contact us at support@callsphere.ai to discuss BAA requirements before transmitting protected health information (PHI) through our Services.

9. Children's Privacy

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children through our marketing site or account registration. If you believe we have inadvertently collected information from a child, please contact us immediately.

End-caller data. When our AI voice or chat agents are deployed by a business customer, that customer (not CallSphere) determines who may contact them and what data is collected. If a minor interacts with an agent operated by one of our business customers, CallSphere processes any resulting data only as a service provider/processor on that customer's behalf and under their instructions. The business customer is responsible for obtaining any required consents and for handling requests relating to such end-caller data; we will assist that customer in responding to verified requests as required by applicable law.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of our Services after changes become effective constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

13. Subprocessors

We use third-party service providers (subprocessors) to help deliver our Services. For a current list of our subprocessors and their purposes, please visit our Subprocessors page.