Privacy Policy

1. Information We Collect

1.1 Account Information

• Full name, email address, and phone number
• Company name, business type, and industry
• Billing address and payment information (processed via Stripe)
• Account credentials and authentication data

1.2 Phone Number & Telecommunications Data

• Phone numbers you provision through our service
• Caller ID information from inbound and outbound calls
• Call duration, timestamp, and routing information
• E911 emergency service addresses associated with phone numbers
• SMS/MMS message content and metadata

1.3 AI Service Data

• Voice recordings and audio files processed by AI agents
• Transcriptions generated from voice interactions
• Chat message history and conversation logs
• AI agent configuration and training data
• Video call metadata and recordings (when enabled)

1.4 Public Profile Information

• Profile photos, banners, and branding assets
• Bio, tagline, and public-facing business information
• Social media links and contact preferences
• Availability schedules and working hours
• Contact form submissions from profile visitors

1.5 Usage & Technical Data

• IP addresses, device types, and browser information
• Pages visited, features used, and interaction patterns
• Performance metrics and error logs
• Cookies and similar tracking technologies

2. How We Use Your Information

We use collected information for the following purposes:

2.1 Service Delivery

• Provide, operate, and maintain Kestrel Voice platform and services
• Process phone calls through AI agents and human operators
• Route calls based on your configuration and business rules
• Generate transcriptions and call summaries
• Deliver SMS notifications about missed calls and inquiries
• Enable chat functionality between you and your contacts
• Display your public profile to visitors

2.2 Communication

• Send transactional emails (receipts, notifications, alerts)
• Send SMS notifications (only if you explicitly opt-in)
• Provide customer support and respond to inquiries
• Send important service updates and security alerts

2.3 Improvement & Analytics

• Analyze usage patterns to improve our services
• Train and improve AI models (using anonymized data)
• Debug technical issues and optimize performance
• Conduct internal research and development

2.4 Legal & Safety

• Comply with legal obligations and government requests
• Enforce our Terms of Service and protect against fraud
• Maintain E911 emergency service compliance
• Investigate security incidents and prevent abuse

3.1 Program Description

Kestrel Voice offers an optional SMS notification service that sends transactional text messages to registered account holders (business owners and authorized users) about their account activity. This is NOT a marketing program.

3.2 Types of Messages You May Receive

If you opt-in to SMS notifications, you may receive:

• Missed Call Alerts: Notifications when your AI agent handles a call while you're unavailable
• Contact Inquiries: Alerts when someone submits a contact form on your public profile
• Account Notifications: Critical account updates, billing reminders, and security alerts
• System Status: Service interruptions or scheduled maintenance notifications

3.3 How to Opt-In

SMS notifications are disabled by default. To receive text messages, you must:

1. Log in to your Kestrel Voice dashboard
2. Navigate to Settings → Notifications
3. Toggle "Enable SMS Notifications" to ON
4. Enter your mobile phone number
5. Check the consent box confirming you agree to receive SMS notifications
6. Click "Save" to activate SMS notifications

By completing this process, you explicitly consent to receive transactional text messages from Kestrel Voice at the phone number you provided.

3.4 Message Frequency

Message frequency varies based on your account activity. On average:

• You may receive 1-10 messages per week depending on call volume
• High-traffic periods may result in more frequent notifications
• You will never receive more than necessary for service delivery

3.5 Message & Data Rates

Message and data rates may apply. Kestrel Voice does not charge for SMS notifications, but your mobile carrier may charge you for incoming text messages according to your cellular plan. Contact your carrier for pricing details.

3.6 How to Opt-Out (STOP)

You can opt-out of SMS notifications at any time using either method:

• Text STOP: Reply with the word "STOP" to any message from Kestrel Voice. You will receive a confirmation that you've been unsubscribed.
• Dashboard: Log in to your account and toggle off "Enable SMS Notifications" in Settings.

After opting out, you will no longer receive SMS notifications. You may still receive critical account-related emails and in-app notifications.

3.7 Help & Support

For help with SMS notifications:

• Text HELP: Reply "HELP" to any message for assistance
• Contact: Use our contact form for SMS support
• Phone: Available in your account dashboard

3.8 SMS Data Handling

3.9 Supported Carriers

Our SMS service works with all major U.S. carriers including AT&T, T-Mobile, Verizon, Sprint, and most regional carriers.

3.10 Consent Record Keeping

When you opt-in to SMS notifications, we store:

• Date and time of consent
• IP address from which consent was given
• Exact text of the consent checkbox you agreed to
• Version of this Privacy Policy in effect at time of consent

4. AI Services & Data Processing

4.1 AI Voice Agents

Our AI voice agents process phone calls on your behalf. This involves:

• Recording and transcribing voice conversations
• Analyzing caller intent and sentiment
• Generating automated responses based on your business rules
• Routing calls to appropriate destinations
• Creating call summaries and action items

4.2 Data Used for AI Training

We may use anonymized and aggregated data to improve our AI models. This data:

• Is stripped of all personally identifiable information
• Cannot be traced back to individual users or businesses
• Helps improve accuracy and response quality
• You can opt-out of AI training data usage in your settings

4.3 Third-Party AI Services

We use industry-leading AI providers (OpenAI, Google, Anthropic) to power our services. These providers process data according to their own privacy policies and our data processing agreements.

5. Voice & Call Recording

5.1 Recording Practices

Calls handled by Kestrel Voice may be recorded for:

• Quality assurance and training purposes
• Generating transcriptions and summaries
• Legal compliance and dispute resolution
• Improving AI agent performance

5.2 Recording Consent

Recording laws vary by state. You are responsible for:

• Complying with applicable recording laws in your jurisdiction
• Providing appropriate recording disclosures to callers
• Obtaining consent where required by law

5.3 User Responsibility for Consent

You acknowledge and agree that:

• You are solely responsible for obtaining recording consent from all call participants
• You represent that you have the legal authority to consent to recording on behalf of all parties
• Kestrel Voice provides disclosure tools but does not verify consent
• You agree to comply with one-party and two-party consent state laws
• You indemnify Kestrel Voice against claims arising from unauthorized recordings
• Kestrel Voice does not monitor or enforce compliance with recording laws

5.4 Recording Storage & Retention

Call recordings are stored securely and retained according to your plan:

• Starter Plan: 30 days
• Business Plan: 90 days
• Business Plus Plan: 1 year
• Enterprise Plan: Custom retention periods available

6. Chat Services & Messaging

Our chat services allow real-time communication between you and your contacts. We collect:

• Chat message content and timestamps
• File attachments and media shared in conversations
• Read receipts and typing indicators
• Conversation metadata (participants, duration, etc.)

Chat data is encrypted in transit and at rest. Messages are retained for the duration of your account unless you delete them manually.

7. Public Profiles & Shareable Data

7.1 Public Profile Information

If you enable a public profile, the following information becomes publicly accessible:

• Display name, tagline, and bio
• Profile photo and banner image
• Business hours and availability
• Social media links you choose to display
• Services, portfolio items, and testimonials you publish

7.2 Contact Form Submissions

When visitors submit contact forms on your public profile, we collect their:

• Name, email, and phone number (if provided)
• Message content and inquiry details
• IP address and timestamp of submission

This data is shared with you (the profile owner) and stored in your account.

8. Data Security & Protection

8.1 Security Measures

We implement industry-standard security measures including:

• End-to-end encryption for voice and video calls
• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA) support
• Regular security audits and penetration testing
• SOC 2 Type II compliance

8.2 Infrastructure

Our infrastructure is hosted on enterprise-grade cloud providers:

• AWS (Amazon Web Services) for primary hosting
• Supabase for database and authentication
• Twilio for telecommunications services
• All providers maintain SOC 2, ISO 27001, and other certifications

8.3 Access Controls

Access to your data is strictly controlled:

• Role-based access control (RBAC) for team members
• Minimal employee access on a need-to-know basis
• All access is logged and audited
• Background checks for employees with data access

9. Data Retention & Deletion

9.1 Retention Periods

We retain different types of data for varying periods:

• Account Data: Retained while your account is active
• Call Recordings: 30 days to 1 year (based on plan)
• Transcriptions: Retained indefinitely unless deleted
• Billing Records: 7 years (legal requirement)
• Support Tickets: 3 years
• Analytics Data: Aggregated data retained indefinitely

9.2 Account Deletion

When you delete your account:

• Your account data is permanently deleted within 30 days
• Call recordings and transcriptions are deleted immediately
• Billing records are retained for legal compliance
• Anonymized analytics data may be retained
• Public profile is immediately removed from search and access

9.3 Data Portability

You can export your data at any time:

• Download call recordings and transcriptions
• Export contact lists and conversation history
• Request a complete data export via support
• Data provided in standard formats (JSON, CSV, MP3)

10. Your Privacy Rights

10.1 Access & Correction

You have the right to:

• Access all personal data we hold about you
• Correct inaccurate or incomplete information
• Update your account settings and preferences
• Request a copy of your data

10.2 Deletion & Restriction

You can:

• Delete your account and all associated data
• Request deletion of specific data (call recordings, messages, etc.)
• Restrict processing of your data for specific purposes
• Object to automated decision-making

10.3 California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt-out of sale of personal information
• Right to non-discrimination for exercising privacy rights

We do NOT sell your personal information.

10.4 European Privacy Rights (GDPR)

EU/EEA residents have rights under GDPR:

• Right to access, rectification, and erasure
• Right to data portability
• Right to restrict or object to processing
• Right to withdraw consent
• Right to lodge a complaint with supervisory authority

11. Compliance & Regulatory

11.1 Telecommunications Compliance

• TCPA: Telephone Consumer Protection Act compliance for SMS and calls
• CALEA: Communications Assistance for Law Enforcement Act
• E911: Enhanced 911 emergency services compliance
• STIR/SHAKEN: Caller ID authentication protocols

11.2 Healthcare Compliance (HIPAA)

Kestrel Voice can be configured for HIPAA compliance:

• Business Associate Agreements (BAA) available for healthcare customers
• PHI data encryption and access controls
• Audit logging and compliance reporting
• Contact sales for HIPAA-compliant configuration

11.3 Payment Card Industry (PCI)

Payment processing is handled by Stripe (PCI DSS Level 1 certified). We do not store credit card numbers.

11.4 International Data Transfers

Your data may be processed in the United States and other countries. We use Standard Contractual Clauses and other approved mechanisms for international transfers.

12. Google Integrations (Drive & Calendar)

12.1 Data Collection

When you connect your Google Drive or Calendar account, we collect:

• OAuth access tokens and refresh tokens
• Token metadata (expiration time, token type, and granted scopes)
• We do NOT store your Google email address or profile information
• We do NOT store Google Drive files or Calendar events - these are accessed via API using your tokens

12.2 Data Usage

We use your Google data to:

• Google Drive: Read and write files you explicitly open through our application (per-file access only)
• Google Calendar: Create, read, and modify calendar events as you authorize
• Tokens are used to authenticate API requests to Google services on your behalf

12.3 Data Sharing

We do NOT share your Google data with:

• Third parties for marketing purposes
• Advertisers or data brokers
• Any party other than necessary service providers

12.4 Data Protection

• OAuth tokens are encrypted using AES-256-GCM before storage in our database
• Access to integration credentials is limited to authenticated users of your tenant
• Tokens are transmitted securely via HTTPS
• Row-level security ensures tenants can only access their own integration credentials

12.5 Data Retention & Deletion

• OAuth tokens are stored until you revoke access or disconnect the integration
• We do not permanently store Google Drive files or Calendar events
• You can revoke Google access at any time from your account settings or through Google's security settings
• Upon account closure, all OAuth tokens are deleted within 30 days

12.6 Purpose Limitation

We use your Google data ONLY to provide the features you explicitly request. We do NOT:

• Use Google data for marketing or advertising
• Sell Google data to third parties
• Use Google data for purposes unrelated to providing our services

13. Contact Information

For privacy-related questions, concerns, or to exercise your rights:

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via email or in-app notification.

Effective Date

This Privacy Policy is effective as of May 5, 2026.