Privacy Policy

The first is you: the business that signs up, whose data we hold as the controller.

The second is your caller: a member of the public who rings your number. For that data you are the controller and we are your processor — we handle it on your instructions, under the Data Processing Addendum, and we do not decide what it is used for.

Account details: name, email address, and the business details you enter — trading name, telephone numbers, service area, hours, services and rates. Your password is stored only as a hash, and if you sign in with Google or Apple we never see a password at all.

Billing details: handled by Stripe. We store a customer reference, the plan, and the counts the plan is billed on. We never see or store your card number.

Usage and diagnostics: which pages you opened, error reports, and the counts used to bill and to run the service.

The telephone number the call came from, an audio recording of the call, a transcript of it, and the fields the agent was configured to capture — typically a name, an address, and a description of the problem.

The agent is configured never to ask for payment card numbers, and no card details are taken on a call.

We process this to provide the service to you: to book the appointment, to send the confirmation, and to give you a record you can read afterwards. We do not sell it, we do not share it with advertisers, and we do not use it to train general-purpose models.

Every call is recorded and transcribed, because the record is the product: it is how you find out what was said and how a wrong booking is corrected.

Recording law differs by state and eleven US states require the consent of every party. The Call Recording Notice sets out how the agent handles that and what you as the line's owner remain responsible for.

Call recordings, transcripts and the records made from them are kept while your account is open, because they are your business records.

When an account closes, data is available for export for 30 days and is then deleted from live systems within a further 30 days, and from backups within 90 days.

You can delete an individual recording or an individual customer at any time from the console, and we will action a caller's deletion request forwarded by you.

Running a telephone service means other companies necessarily touch the data — a carrier to receive the call, a voice provider to hold the conversation, a host to run the software. Each of them is listed by name, with what they do and where they are, on the Subprocessors page.

We do not add a subprocessor that touches call content without updating that page.

You may ask for a copy of your data, correction of it, or its deletion, and you may object to processing or ask us to restrict it. Write to [email protected] and we will respond within 30 days.

If you are a California resident: we do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA as amended. You have the rights to know, to delete, to correct, and not to be discriminated against for exercising them.

A caller who wants their recording deleted should contact the business they called. That business is the controller of the recording, and we will act on their instruction.

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it. Each business's data is separated by tenant, and call records are keyed to the number the call arrived on.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay and give you what you need to meet your own notification duties.

The service is not offered to children and we do not knowingly collect their data.

We operate from the United States and data is processed there. Where a subprocessor moves data across a border, that transfer is covered by the terms listed on the Subprocessors page.

We will post changes here and update the date at the top. For anything in this policy, write to [email protected] or to Spotbo, Inc., 1111B S Governors Ave STE 29027, Dover, DE 19904, United States.