Privacy Policy

Effective date: August 8, 2026 · Last updated: August 8, 2026

This Privacy Policy explains how [LEGAL ENTITY NAME] ("NexCall," "we," "us") collects, uses, discloses, and protects information when you use the NexCall website, dashboard, and AI phone-receptionist service (the "Service").

1. Who we are

NexCall provides an AI-powered phone receptionist that answers and places calls, books appointments, takes messages, and sends summaries on behalf of business customers ("Customers"). When a Customer's callers interact with the Service, we process information on the Customer's behalf as a service provider / processor (see Section 9).

Controller / operator: [LEGAL ENTITY NAME], [MAILING ADDRESS]. Contact: [email protected].

2. Information we collect

Information you give us (Customers)

• Account data: name, business name, email, password (stored hashed by our auth provider), and optional two-factor secrets (encrypted).
• Business configuration: assistant name and voice, greeting, price list, discount limits, business hours, notification email, and owner phone number.
• Billing data: subscription plan and status. Card payments are processed by Stripe; we never receive or store full card numbers.
• Connected accounts: if you connect Google Calendar, OAuth tokens (encrypted) so the Service can check availability and book events.

Information from calls (Customers and their callers)

• Call metadata: phone numbers, timestamps, direction, and duration.
• Call recordings and transcripts, where recording is enabled and lawful (see Section 4).
• Contacts, messages, appointments, and caller profiles/notes created through the Service.
• AI-generated summaries and memory of prior interactions to personalize future calls.

Information collected automatically

• Device/log data: IP address, browser type, pages viewed, and timestamps, used for security, rate-limiting, and debugging.
• Cookies / local storage: strictly necessary items to keep you signed in. We do not use third-party advertising cookies.

3. How we use information

• To provide, operate, and improve the Service (answer/place calls, book, message, summarize).
• To authenticate you, secure accounts, and prevent fraud, abuse, and brute-force attacks.
• To process payments and manage subscriptions and trials.
• To send service and transactional communications (summaries, alerts, security notices).
• To comply with legal obligations and enforce our Terms and Acceptable Use Policy.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

4. Call recording & AI voice disclosure

The Service may record and transcribe calls to provide summaries, memory, and quality assurance. Recording laws vary: some U.S. states require that all parties consent before a call is recorded. The Service is configured to disclose at the start of a call that the call may be recorded and that callers are speaking with an automated AI assistant.

Customer responsibility: Customers are responsible for ensuring recording and automated-calling are lawful for the jurisdictions they and their callers are in, and for obtaining any required consent. See the Acceptable Use Policy.

5. AI processing & subprocessors

We use trusted vendors to run the Service. They process data only to perform services for us:

A current list is available on request at [email protected].

6. How we protect information

• Encryption in transit (HTTPS/TLS) and encryption at rest for sensitive fields such as OAuth tokens and 2FA secrets.
• Tenant isolation enforced in application code and at the database level (row-level security).
• Access controls, rate limiting, account lockout, optional two-factor authentication, and security logging.

No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify affected users and regulators as required by applicable law.

7. Data retention

We retain account and call data for as long as your account is active and as needed to provide the Service, then for a limited period to comply with legal, tax, and security obligations. You may request deletion as described in Section 8. Recordings and transcripts are retained per your settings and are deleted after 90 days unless you delete them sooner.

8. Your rights & choices

Depending on where you live (e.g., California/CCPA-CPRA, Virginia, Colorado, and other U.S. state laws; or the EU/UK GDPR), you may have the right to access, correct, delete, or port your personal information, to opt out of sale/sharing (we do neither), and to appeal a decision. To exercise a right, email [email protected]; we will verify your identity and respond within the time required by law. You will not be discriminated against for exercising these rights.

If you are a caller who interacted with a NexCall Customer's assistant, direct requests to that business; we will assist them as their service provider.

9. Our role: processor / service provider

For call content, contacts, and caller data processed on behalf of a Customer, the Customer is the controller/business and NexCall is the processor/service provider. We process such data only on the Customer's documented instructions and per our Terms of Service and Data Processing Addendum, available on request.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

11. International transfers

We operate in the United States. If you access the Service from outside the U.S., your information may be transferred to and processed in the U.S. under appropriate safeguards where required.

12. Changes

We may update this policy. Material changes will be posted here with a new "Last updated" date and, where required, notified to you.

13. Contact

[LEGAL ENTITY NAME] · [email protected] · [MAILING ADDRESS]