Privacy Policy

Click Refresh Inc., a California corporation ("Company," "we," "us," or "our"), operates CallWaiting.ai. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

We collect information in the following categories:

1.1 Account Information

Name, email address, business name, phone number, and billing information. Account credentials (passwords are stored in hashed form only).

1.2 Payment Information

Our payment processor, Stripe Inc., collects payment card information. We store only a tokenized version and do not maintain payment card numbers on our servers.

1.3 Call Data

Incoming caller phone numbers, call recordings, call transcripts, and call metadata (duration, time, outcome, caller intent). AI-generated call summaries. SMS messages sent on your behalf (Pro plan).

1.4 Business Configuration Data

Scripts, FAQs, hours of operation, custom responses, and escalation settings you configure in your dashboard.

1.5 Device and Technical Data

IP address, browser type and version, operating system, device identifiers, and referring URLs. Session information, pages visited, and features accessed.

1.6 Communication Data

Information you provide when contacting our support team.

2. How We Use Your Information

We use the information we collect to:

1. Provide, operate, and improve the CallWaiting.ai service.
2. Answer incoming calls on your behalf using AI voice technology.
3. Generate call summaries, transcripts, and analytics for your dashboard.
4. Send SMS follow-ups to callers on your behalf (Pro plan).
5. Process payments and manage your subscription.
6. Send you service notifications, billing information, and product updates.
7. Respond to support requests and troubleshoot issues.
8. Detect fraud, abuse, or violations of our Terms of Service.
9. Comply with legal obligations.
10. Generate aggregate, de-identified analytics to improve the Service (no individual user data is used for this purpose without consent).

We do not use automated decision-making or profiling that produces legal effects on users.

3. How We Share Your Information

We do not sell your personal information or your callers' data to third parties.

We may share information in the following limited circumstances:

3.1 Service Providers

We use the following third-party service providers who process data on our behalf:

• Retell AI - Voice AI processing (speech-to-text, text-to-speech, conversational AI)
• Twilio - Telephony and SMS delivery
• Stripe Inc. - Payment processing
• Amazon Web Services (AWS) - Cloud hosting and data storage
• NGX Labs LLC - Technology development and platform maintenance
• Google Analytics - Website usage analytics
• SendGrid - Transactional email delivery
• Google Workspace - Business email

These service providers process data on our behalf under their respective terms of service and data processing provisions.

3.2 Legal Requirements

We may disclose information if required by law, subpoena, court order, or to protect the rights and safety of Click Refresh Inc., our users, or the public.

3.3 Business Transfers

If Click Refresh Inc. is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information becomes subject to a different privacy policy.

4. AI Training Data

CallWaiting.ai does not use your call recordings, transcripts, or business configuration data to train AI models. Your data is processed solely to provide the Service to you and is not shared across other customers' accounts.

5. Call Recordings and Transcripts

CallWaiting.ai records and transcribes calls handled by your AI receptionist. The AI receptionist includes a mandatory disclosure at the beginning of each call informing the caller that they are speaking with an AI and that the call may be recorded. This disclosure cannot be disabled.

By using the Service, you agree to:

1. Comply with all applicable call recording laws in your jurisdiction.
2. Implement any additional caller disclosures required by your jurisdiction beyond the default AI disclosure.
3. Use call recordings and transcripts only for lawful business purposes.

Retention:

• Starter and Standard plans: Call recordings retained for 90 days.
• Pro plan: Call recordings retained for up to 12 months.
• Enterprise: Custom retention available.
• You may delete individual recordings from your dashboard at any time.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide services. After account termination:

• You may request a data export within 30 days of termination.
• We will delete or anonymize your data within 60 days of termination, except where retention is required by law or to resolve disputes.

Retention by data type:

• Account information: Duration of account plus 60 days.
• Call recordings: Per plan limits (see Section 5).
• Call transcripts and summaries: Same as call recordings.
• Payment records: 7 years (tax and regulatory requirements).
• Server logs: 90 days.

7. Your Rights and Choices

7.1 All Users

You have the right to:

1. Access: Request a copy of the data we hold about you.
2. Correction: Request that we correct inaccurate or incomplete data.
3. Deletion: Request that we delete your personal data, subject to legal retention obligations.
4. Portability: Request an export of your data in a machine-readable format.
5. Opt-out: Opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us directly.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

1. Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
2. Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
3. Right to Correct: You may request correction of inaccurate personal information.
4. Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
5. Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service.
6. Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

7.3 Virginia, Colorado, Connecticut, and Utah Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have similar rights to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of targeted advertising. We do not engage in targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

7.4 How to Exercise Your Rights

To exercise any of these rights, you may:

1. Email us at privacy@callwaiting.ai.
2. Submit a request through our data rights form at callwaiting.ai/data-request.

We will respond to verified requests within 45 days. If we need additional time, we will notify you of the extension (up to 90 days total).

If your request is denied, you may appeal by contacting privacy@callwaiting.ai with the subject line "Privacy Rights Appeal."

8. Cookies and Tracking

We use cookies and similar technologies to operate the Service.

8.1 Strictly Necessary Cookies

These cookies are required for the Service to function and cannot be disabled. They include session cookies, authentication cookies, and security cookies.

8.2 Analytics Cookies

We use Google Analytics to understand how visitors interact with our website. These cookies collect information about your visit, including pages viewed, time spent, and referring sources. For more information on how Google uses this information, visit google.com/policies/privacy/partners.

You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

8.3 Do Not Track

Our website does not currently respond to "Do Not Track" browser signals. We will update this policy if our practices change in the future.

8.4 Managing Cookies

You can control cookie preferences through your browser settings. Disabling cookies may limit certain dashboard functionality.

9. Data Security

We implement industry-standard security measures to protect your information, including:

1. Encryption in transit using TLS.
2. Encryption at rest using AES-256.
3. Access controls and authentication for dashboard access.
4. Regular security reviews of our infrastructure.

No system is completely secure. You are responsible for maintaining the confidentiality of your account credentials. If you become aware of any unauthorized access, contact us immediately at hello@callwaiting.ai.

9.1 Breach Notification

In the event of a data breach affecting your personal information, we will notify you via email within 72 hours of becoming aware of the breach, or as otherwise required by applicable law.

10. Children's Privacy

CallWaiting.ai is a business service not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at privacy@callwaiting.ai.

11. International Data Transfers

CallWaiting.ai is operated from the United States. If you are accessing our service from outside the U.S., your data may be transferred to, stored, and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission as our legal mechanism for international data transfers. To request a copy, contact privacy@callwaiting.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in your dashboard at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Questions about this document? Contact us at privacy@callwaiting.ai or write to:

Click Refresh Inc.

Los Angeles, CA

United States