Privacy Policy

• Account & business info: your name, email, business name, phone number, and configuration you enter (persona, knowledge base, calendar/CRM connections).
• Call data: the caller's phone number, the call recording (where recording is disclosed and permitted in that jurisdiction), a full transcript, and the AI's summary and outcome of the call.
• Voice/face samples: if you opt into voice cloning or a video meeting avatar, the audio or image sample you provide to create it.
• Usage & billing data: minutes used, plan, and payment details (card details are handled entirely by our payment processor: we never see or store full card numbers).

• To operate the Service: answering/placing calls, booking appointments, pushing outcomes to your CRM, and billing you correctly.
• Recording disclosure, do-not-call scrubbing, and safety-event logging: these exist because they're required by telemarketing and recording-consent law, and because they're how we investigate misuse reports (see our Acceptable Use Policy).
• To improve the AI's accuracy on your account specifically (we do not train shared/foundation models on your call data).

We use a small set of infrastructure providers (sub-processors) to run the Service. Each only receives the data it needs to do its job:

• Telnyx: carrier/telephony (call routing, SMS).
• Supabase: database and file storage.
• Groq, Cerebras: the language model that generates the AI's responses during a call (receives the live transcript only).
• Cartesia, ElevenLabs, Deepgram: speech synthesis and transcription (receives call audio to generate/transcribe speech).
• RunPod: self-hosted GPU compute for tenants using the free voice-clone engine.
• Cloudflare R2: encrypted storage for call recordings.
• PayPal: billing and payment processing.
• Vercel: application hosting.
• Any calendar, CRM, or webhook endpoint you connect (e.g. Cal.com, Google Calendar, HubSpot, or your own Zapier/Make webhook): we send call and booking data there because you configured that connection; we don't control what that third party does with it once received.

We do not sell personal data. We disclose data to law enforcement or regulators only where legally required, or to investigate a suspected violation of our Acceptable Use Policy.

Call recordings are retained for the number of days configured on your plan (visible in your console) and then deleted. Transcripts and call metadata are retained for as long as your account is active, for your own historical reporting, unless you request earlier deletion. Account and billing records are kept as long as required by tax and accounting law after account closure.

If an Acuvo AI answered or placed a call to you, the business that owns that number is the tenant: they control the content of the call and, in most cases, are the right contact for a data request about it. If you'd like a recording or transcript deleted and can't reach the business directly, email us at privacy@xxiautomate.com and we'll action it on our side and notify the tenant.

Saying "don't record me" or "take me off your list" mid-call is honored immediately: the AI stops recording or adds your number to the do-not-call suppression list on the spot.

Recordings are stored encrypted at rest. Access to tenant data is scoped per-tenant with row-level security in our database, and administrative access is logged. No system is perfectly secure, and we can't guarantee against every possible breach, but we design for least-privilege access throughout.

Several of our sub-processors operate infrastructure in the United States. By using the Service you consent to your data being processed there, under the safeguards those providers make available to us.

We may update this policy from time to time; material changes will be notified via the console or email.

Questions about this policy, or a data request: privacy@xxiautomate.com