1. Who this covers
Two groups: subscribers (the businesses that sign up for CallFlow) and callers (members of the public whose missed calls are answered by the service). Both are covered here.
CallFlow is operated from the United States. Data questions, deletion requests, and complaints all go to atul@callflow.biz.
2. What we collect from subscribers
- Account details: business name, your name, email address, phone number, and your business's location and opening hours.
- Setup details: the number you forward from, the dedicated number we provision for you, and the message/FAQ content you ask the AI to use.
- A mobile push token for your device, so we can notify you when a call ends.
- Billing metadata: plan, trial start date, invoice and payment status. Card numbers are handled by our payment provider — we never see or store full card details.
- Support correspondence you send us by email.
3. What we collect about callers
For each call forwarded to CallFlow we process the caller's phone number, the time and duration of the call, the audio of the conversation as answered by the AI receptionist, and the resulting written transcript and any appointment or message details the caller volunteers.
We do not ask callers for personal information beyond what is needed to take a message or book an appointment, and we do not build marketing profiles of people who call a business.
4. How we use it
- To answer your missed calls and produce transcripts and booking records.
- To send you notifications, the call log, and billing invoices.
- To keep the service running: abuse prevention, troubleshooting, and error diagnosis.
- To respond to you when you contact support.
- To meet legal and accounting obligations (tax records, lawful requests).
We do not sell personal information, and we do not use your call content to train third-party foundation models.
5. The providers who process data for us
CallFlow is built on specialist providers, each of which handles a slice of the data under written processing terms:
- Plivo — provisions your dedicated number and carries the call audio and call-detail records.
- Dograh — runs the AI voice agent, including speech recognition and transcript generation.
- Google Firebase Cloud Messaging — delivers push notifications to your device.
- Dodo Payments — hosts checkout and processes card payments, and is the merchant of record for subscription billing.
- Render — hosts our application and stores your account data and call history in our database.
Where a provider may transfer data outside your region, we rely on their standard contractual safeguards.
6. Cookies and local storage
Our marketing and policy pages do not set advertising or tracking cookies, and they run no third-party analytics scripts. Inside the signed-in product, a small amount of information is stored in your browser's local storage so the app can remember your device and restore your session preferences. You can clear it at any time through your browser settings; doing so will simply ask you to reconnect.
7. How long we keep things
- Account and call data: kept while your subscription is active. Call history and transcripts are available for 12 months of rolling history; you can delete individual call records yourself at any time.
- On cancellation or closure: we delete your account contents within 30 days, except billing records we are required to keep for tax and audit purposes (7 years).
- Call audio used to produce a transcript: retained only as long as needed to deliver and debug the transcript, then removed.
- Support email: kept for as long as it is relevant to your account.
8. How we protect it
All traffic is served over HTTPS. Access to production data is limited to named operators using credentials that are not shared, and secrets for our providers are held in environment variables rather than in the codebase. Backups of the database are taken on a regular schedule. No system is perfectly secure, so we also keep collection minimal — the least we need to answer your calls is the most we take.
9. Your rights
Depending on where you live, you can ask us to: access the personal information we hold about you; correct it; delete it; give you a copy in a portable format; restrict or object to particular processing; or honor a do-not-sell / do-not-share request under state privacy laws such as the CCPA/CPRA. Because we do not sell personal information, there is nothing to opt out of on that front.
To make a request — including on behalf of someone whose call you are asking about — email atul@callflow.biz and we will respond within 30 days. We may need to verify who you are before answering. You also have the right to complain to a data protection authority.
10. Children
CallFlow is a business tool for adult-owned local businesses and is not directed to children. We do not knowingly collect information from anyone under 16. If you believe a child's information reached us through a forwarded call, email us and we will remove it.
11. Changes to this policy
If we change this policy materially we will update the date above and, where the change affects how your data is handled, email you before it takes effect. The current version is always the one published at callflow.biz/privacy.
12. Contact
Data protection and privacy questions: atul@callflow.biz. Related documents: Terms of Service, Refund Policy, Pricing.