Privacy Policy

1. Information We Collect

We collect information you provide when creating an account, including:

• Email address and account credentials
• If you sign in with GitHub OAuth: your GitHub username, email, and profile data shared via the OAuth scope you authorize
• API usage data and logs (including per-second consumption of the Free inbound AI voice trial)
• Billing and payment information (only collected if you add a payment method)
• Phone numbers provisioned through the Service
• AI voice call transcripts and conversation metadata
• Caller phone numbers and call audio for inbound AI calls (audio streamed in real time, not retained unless recording is explicitly enabled)
• Notification email addresses you configure to receive post-call summaries
• Optional call recordings (only when you opt in)
• Pre-call context webhook URLs you configure on a phone number (and any HTTP request and response data transmitted between AgentCall and your webhook endpoint when an inbound call connects)
• Structured Call Reports and Memory entries extracted from completed AI voice calls when the Cross-Call Memory feature is enabled (described in Section 4 below)
• Customer-provided third-party API keys, including OpenAI API keys submitted when enabling Bring Your Own Key (BYOK) AI voice billing on a phone number (described in Section 3 below)
• If you submit the Agent Startup waitlist form: the email address you enter, the timestamp of submission, and an optional referrer note

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service
• Process billing and payments
• Send service-related communications
• Monitor and improve performance and reliability
• Comply with legal obligations

3. Message and Call Data

SMS messages and call metadata processed through AgentCall are retained for the duration necessary to provide the Service and fulfill legal requirements. Message content is not sold or shared with third parties for marketing purposes.

We process SMS message content for delivery and OTP extraction. Call metadata (timestamps, duration, caller/callee numbers) is stored. AI voice call audio is processed in real time and is not stored unless recording is explicitly enabled. Transcripts of AI voice calls are stored and associated with your account for the same retention period as other call metadata.

Call Recordings: Recording is opt-in and disabled by default. When enabled, recordings are stored in AgentCall's private storage (not at the carrier level) and are accessible only via short-lived signed URLs minted on demand. Default retention is 12 months, after which a daily cron deletes the recording and nulls the corresponding field. Compliance-grade longer-term archive is on the roadmap for regulated use cases. AgentCall auto-prepends a recording disclosure to the spoken first message of AI voice calls in two-party-consent jurisdictions.

Post-Call Summary Emails: When you configure a notification email address on an inbound AI number, AgentCall summarizes the transcript using a third-party language model and emails the result to the address you specify. The email includes caller phone number, intent classification, urgency tag, and a 1-2 sentence summary of the request. We do not send these summaries to addresses you have not configured, and we do not retain a separate copy of summary email recipients beyond what is required to deliver the email and audit billing.

Free Inbound AI Trial Tracking: Free-plan accounts have a monthly counter that records how many seconds of inbound AI voice they have consumed under the trial allowance. This counter is reset to 0 implicitly on the first day of each calendar month (UTC) and is used solely to enforce the trial cap. It is not shared with third parties.

SMS Opt-Out Preferences: When a recipient replies STOP, UNSUBSCRIBE, CANCEL, END, or QUIT to a message sent through AgentCall, their opt-out preference is recorded and stored for as long as your account is active. Opted-out recipients are automatically blocked from receiving further SMS messages from your account. Recipients may opt back in by replying START. Opt-out records include the recipient's phone number, the date of the request, and the keyword used. This data is used solely to enforce messaging consent and is not shared with third parties.

Pre-Call Context Webhooks: If you configure a pre-call context webhook URL on a phone number, AgentCall will POST call metadata (caller phone number in E.164 format, the internal number ID, an opaque call ID, and an ISO 8601 timestamp) to that URL on every inbound call connect. The request is HMAC-signed using the shared secret you provide. Your endpoint may respond with a contextBlock string that AgentCall merges onto the system prompt for that specific call. You are solely responsible for the security, uptime, and privacy compliance of any webhook endpoint you configure, including PCI-DSS compliance (if your endpoint processes payment data), HIPAA compliance (if it handles protected health information), and GDPR-compliant data handling (if it processes personal data of EU residents). AgentCall is not liable for any breach, downtime, misconfiguration, or misuse of data at endpoints you control. AgentCall does not store the contextBlock content returned by your endpoint beyond the duration of the call session in which it was used; the merged system prompt is included in the per-call transcript record under your account.

Customer-Provided AI Provider Keys (BYOK): When you enable Bring Your Own Key (BYOK) AI voice billing on a phone number, you provide an OpenAI API key that AgentCall uses to make model calls on your behalf for AI voice calls on that number. The key is stored encrypted at rest in our database and is decrypted in-process only when needed to authenticate a model call. The key is never returned through any API surface: responses that include inbound configuration report only a boolean flag indicating that a key is configured, not the key value itself. The key is not logged, is not shared with any third party other than OpenAI for the purpose of authenticating the model call, and is not used for any purpose other than serving the AI voice calls you have configured to use it. You may rotate or remove the key at any time from your dashboard by switching the number off BYOK (back to the Managed billing tier) or by submitting a new key. AgentCall does not independently bill OpenAI on your behalf for BYOK model usage; charges for model usage are billed directly by OpenAI under the OpenAI account that issued the key.

Agent Startup Waitlist: If you submit the Agent Startup tier waitlist form at agentcall.co/waitlist, AgentCall stores the email address you enter, the timestamp, and an optional referrer note. This data is used solely to notify you when the Agent Startup tier launches and to gauge interest while we scope the offering. It is not shared with third parties for marketing purposes. You can request removal from the waitlist at any time by emailing contact@agentcall.co.

4. Call Reports and Cross-Call Memory

When the Cross-Call Memory feature is enabled on your account, AgentCall extracts structured Call Reports and Memory entries from the transcripts of completed AI voice calls on your numbers.

What we capture. A Call Report may include the caller's phone number, stated name (if the caller provides it), call intent, urgency, mentioned entities (such as companies, products, and dates), facts, decisions, commitments, tasks, preferences, unresolved items, and an owner brief. Each Memory entry is tied to the Call Report that produced it and preserves a verbatim quote from the transcript line that supports the entry, so the account owner can audit accuracy against the original conversation.

Customer-controlled. Cross-Call Memory is on by default for both Free and Pro accounts and can be turned off at any time from your dashboard. When it is off, AgentCall does not extract Call Reports, does not write new Memory entries, and does not read prior Memory entries on subsequent calls. Changes take effect immediately.

Per-account isolation. Call Reports and Memory entries are scoped to the AgentCall account that owns the phone number on which the call occurred. Other AgentCall customers cannot see your Memory.

Auditable, editable, deletable. Account owners can view, edit, and delete individual Memory entries and Call Reports from the dashboard at /contacts and /inbox. Each Memory entry links back to the source Call Report and the verbatim transcript quote that produced it, so accuracy can be independently verified.

Retention. Call Reports and Memory entries persist for as long as your account is active and you have not deleted them. Account owners can set an optional expiresAt on a Memory entry to schedule automatic expiry. AgentCall does not currently operate a fixed automatic-purge timeline for Memory entries beyond what the account owner configures and the account-deletion retention described in Section 7 below.

Roles for caller data. When a third party calls a phone number owned by your AgentCall account, you are the controller of any personal data that caller provides during the conversation, and AgentCall acts as a processor on your behalf. You are responsible for any disclosures, notices, or consents required under applicable law before transcribing and structuring caller speech into persistent Memory.

No training on customer data. AgentCall does not use your call transcripts, Call Reports, or Memory entries to train, fine-tune, or otherwise improve our own models, and we do not authorize third-party AI providers used to deliver the Service to train their models on this data.

5. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest. API keys are hashed and stored securely.

6. Third-Party Services

We use third-party services for payment processing, authentication, telecommunications infrastructure, AI voice processing, and post-call summarization. AI voice calls are processed using third-party AI services for speech recognition and generation. Audio is streamed in real time and not retained by the AI provider beyond the duration of the call. Post-call summaries, Call Reports, and Memory entries are generated by a third-party language model from the call transcript stored in your account. These providers have their own privacy policies governing data they process on our behalf. AgentCall does not authorize third-party AI providers to use your call transcripts, Call Reports, or Memory entries to train or improve their models.

BYOK provider relationship. When a phone number is configured for Bring Your Own Key (BYOK) AI voice billing, the model calls for AI voice on that number are authenticated with your OpenAI API key and are billed by OpenAI directly under your OpenAI account. In that case, OpenAI processes your data under the terms of your OpenAI account, not under AgentCall's commercial relationship with OpenAI. You are responsible for your relationship with OpenAI, including any data-processing addendum, retention preferences, and zero-retention options available on the OpenAI side. AgentCall continues to act as a processor for caller data on your behalf with respect to call transcripts, recordings, Call Reports, and Memory entries stored in your AgentCall account, regardless of which AI voice billing tier you select.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. You may request deletion of your data by contacting us at contact@agentcall.co.

Following account deletion, we retain your data for up to 30 days before permanent removal. Call and message metadata may be retained for up to 12 months to comply with telecommunications regulations. Call recordings are auto-purged after 12 months even on active accounts. Free-trial usage counters are reset monthly and contain no personal data beyond the agent identifier.

8. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date.

10. Cookies and Tracking Technologies

We use essential cookies for authentication and session management. These cookies are required for the dashboard to function properly. We do not use advertising cookies or third-party tracking cookies.

11. Children's Privacy

AgentCall is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information promptly.

12. International Data Transfers

Your data may be processed in the United States. By using the Service, you consent to the transfer of your data to the United States, where data protection laws may differ from those in your jurisdiction.

13. Specific Regulatory Rights

European Economic Area (EEA) Users

• Right to lodge a complaint with a supervisory authority
• Right to object to processing of your personal data

California Residents

• Right to know what personal information is collected
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)

Data subject access requests will be responded to within 30 days.

14. Contact

Data Controller: AgentCall

For any questions or concerns about this Privacy Policy or our data practices, please contact us at contact@agentcall.co.

This Privacy Policy is part of our Terms of Service.