Privacy Policy

How we handle personal information when you use Callscribe, including the calls, recordings, transcripts and forms you track.

Last updated: 26 September 2026

1. Who this policy covers

Callscribe (“Callscribe”, “we”, “us” or “our”) is a call and form tracking service. This policy explains how we handle personal information when you visit trycallscribe.com, use the Callscribe app at app.trycallscribe.com, or use the Callscribe service (together, the “Service”).

It covers:

• our customers and their team members, who have accounts;
• visitors to our website;
• people whose information our customers handle through the Service, such as callers, people who fill in forms, and visitors to our customers’ websites.

For that last group, we process information on behalf of our customer, the business you contacted. That business decides how the information is used, so please contact it first with questions or requests. We’ll help the business respond.

2. Information we collect

Account information

Your name, email address and password (which we store only in a protected, hashed form), your workspace and business names, the team members you invite and their roles, your settings and time zone, and the messages you send us.

Call and form data

When you use the Service, we collect:

• callers’ phone numbers and the numbers they called, the time, length and outcome of each call, and the numbers calls were forwarded to;
• call recordings and voicemails, transcripts, and AI-generated summaries and suggested outcomes, only where you turn these features on;
• form submissions, including the fields your forms collect (such as name, email address, phone number and message) and any attachments;
• how a visitor found the business: the page they visited, the referring website, campaign tags and ad click identifiers (such as Google and Microsoft click IDs);
• the notes, outcomes and follow-ups your team adds to calls and forms.

Data from tools you connect

If you connect them, we receive reporting data from Google Ads and Google Analytics. Through Windsor.ai you can also connect sources such as Meta Ads, Microsoft Ads and HubSpot for your reports. If you choose to send leads to HubSpot or your own webhook, we send the lead details you choose there.

Messages you send us

When you use the contact form on our website, we collect your name, email address and message, and we use your IP address to limit how many messages can be sent. We use them only to answer you and to keep the form free of abuse.

Payment information

Payments are processed by Authorize.Net. Your card details go directly from your browser to Authorize.Net and are never stored on our servers. We keep the card type, the last four digits of the card, and records of your payments and receipts.

Usage and log information

Like most online services, we automatically collect information such as your IP address, browser and device type, the pages and features you use, the date and time of your requests, and error and security logs. So that you can see and sign out of your devices, we keep a record of your signed-in sessions, including the IP address, browser and time of last activity.

3. Cookies and similar technologies

• Our app uses essential cookies to keep you signed in and to protect your account against forged requests. The app can’t work without them.
• Our website doesn’t use advertising or analytics cookies. It loads its fonts from Google Fonts, which receives your IP address and browser information when your browser requests them.
• Our tracking code on customers’ websites uses the browser’s session storage, not cookies, to connect a visit with a call or form. It lasts only for that browser session.

4. How we use information

• To provide the Service: sign-in, workspaces, tracking numbers, call routing and recording, forms, lead alerts, reports and integrations.
• To carry out the features you turn on, such as sending leads to the tools you connect.
• To create call transcripts, summaries and suggested outcomes with AI, using the recording or information needed for each task.
• To process payments, send receipts and manage your subscription.
• To send service messages, such as account, security and billing emails, and the lead alerts you set up.
• To give you support when you ask for it.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To understand and improve the Service, using aggregated or de-identified information where we can.
• To meet our legal obligations and enforce our terms.

We don’t sell personal information. We don’t use personal information for targeted advertising, and we don’t send marketing messages to our customers’ callers, visitors or contacts.

5. Legal bases

If you’re in the European Economic Area, the United Kingdom or another place with similar laws, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent fraud, support customers and improve the Service. We balance these interests against your rights.
• Consent: where we ask for it, such as when you connect an account. You can withdraw consent at any time; this doesn’t affect what we did before.
• Legal obligation: where the law requires us to keep or share information.

For information our customers handle through the Service, the customer is responsible for its own legal basis, including any consent needed to record calls.

6. Google user data

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

• Google Ads: the Ads accounts you can access, and campaign performance such as impressions, clicks, cost and conversions, to show ad performance in your reports. We don’t create or change your ads, budgets or campaigns.
• Google Analytics (read-only): the accounts and properties you choose, and website activity such as sessions, users and page views, to show website activity in your reports.
• Your Google account’s basic profile: your email address and name, to show which Google account is connected.

How we limit its use

• We use Google user data only to provide and improve the features you use in the Service.
• We don’t sell Google user data, and we don’t use or transfer it for advertising, including retargeting and personalized or interest-based ads.
• We transfer Google user data only as needed to provide those features (for example, to our hosting service providers), to comply with the law, to protect security, or as part of a merger or acquisition with your prior consent.
• People on our team don’t read your Google user data unless you ask us to (for example, for support), it’s needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
• We don’t use Google user data to develop, improve or train generalized AI or machine-learning models.
• We don’t use Google user data to decide creditworthiness or for lending.

How we store it and how to revoke access

We store Google access tokens encrypted. For some connections, such as Google Ads, the sign-in tokens are held for us by Nango, a service provider that manages account connections. You can disconnect Google in the app’s Integrations settings, or remove our access at any time in your Google Account at myaccount.google.com/connections. After you revoke access, we can no longer get new data from Google. To have us delete Google data we still hold, send us a request with the form at the end of this page.

7. How we share information

• With your team. Members of your workspace can see its information according to their roles. For client workspaces, the agency and the client team members it invites can see the workspace.
• With people you share reports with. Anyone who has a report link you share can view that report until the link expires or you turn it off. You can also protect a link with a password.
• With the tools you connect, when you direct us. For example, we send lead details to HubSpot or your webhooks, if you set that up.
• With our service providers, who help us run the Service and may use information only to provide their services to us. They’re listed in the next section.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, property or safety of our customers, the public or us.
• In a business transfer, such as a merger, acquisition or sale of assets. We’ll tell you before your information becomes subject to a different privacy policy.
• With your consent or at your direction.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.

8. Our service providers

We use these service providers to run the Service:

• DigitalOcean: cloud hosting for our servers and databases, in the United States.
• Twilio: tracking phone numbers, call routing and recording, and voicemail.
• OpenAI: call transcription, call summaries and suggested outcomes.
• Authorize.Net: payment processing.
• Brevo: delivery of the emails we send.
• Nango: secure management of connections to some of the tools you connect.
• Windsor.ai: retrieving reporting data from the marketing platforms you connect through it.
• Google Fonts: the fonts on our website.

Integrations you choose to connect, such as HubSpot, receive information under your own agreement with them.

9. How long we keep information

• Account and workspace data: for as long as your account is active. Cancelling a plan doesn’t delete your data, so you can reactivate later.
• Deleted workspaces: when an owner deletes a workspace, it’s removed from view, and the owner can restore it for 30 days. Deleting a workspace in the app doesn’t erase its data. To have your data permanently deleted, send us a request with the form at the end of this page.
• Call recordings, voicemails, transcripts and AI summaries: deleted at the end of the recording retention period for the location, which is never more than 90 days.
• Lead details: caller numbers and form entries are kept for the retention period set for each location, from 7 to 365 days (90 days unless you change it). After that, we remove the contact details and keep only anonymous counts.
• Notifications and emails: notifications in the app are deleted after 90 days, and our records of the emails we send you after 180 days. Downloaded report files (PDFs) are deleted after 30 days.
• Payment and billing records: as long as we need them for tax, accounting and legal purposes.
• Server logs: kept for a limited period and then automatically deleted or overwritten.
• Backups: copies of deleted information may remain in our backups until those backups are deleted.

We may keep information for longer where the law requires it, or to resolve disputes and enforce our agreements.

10. Security

We use safeguards designed to protect your information, including:

• encryption in transit (HTTPS) for our website and app;
• passwords stored only as secure hashes, and access tokens for connected accounts stored encrypted;
• call recordings copied to our own encrypted, private storage and then deleted from our phone provider;
• role-based access within workspaces, and a list of your active sessions that lets you sign out other devices;
• card details handled by Authorize.Net rather than our servers.

No online service is completely secure. Please use a strong, unique password, and tell us with the form at the end of this page if you suspect a problem. If a security incident affects your personal information, we’ll notify you as the law requires.

11. Your rights and choices

• Access: ask for a copy of the personal information we hold about you.
• Correction: update most account details in the app, or ask us to correct information.
• Deletion: ask us to delete your account and personal information. We’ll delete it unless we need to keep it for a legal reason, such as billing records.
• Connections: disconnect Google or other connected tools at any time.
• Emails: we send service emails about your account, security and billing, which you can’t turn off while you have an account. We don’t send marketing emails without giving you a way to unsubscribe.

To make a request, use the form at the end of this page and give the email address on your account. We may need to verify your identity before we act, and we’ll respond within the time the law requires.

If you called or filled in a form for one of our customers, please contact that business, because it controls that information. We’ll help it respond.

If you’re in the EEA, the UK or a place with similar laws, you also have the right to restrict or object to our use of your information, to data portability, and to complain to your local data protection authority.

12. US state privacy rights

Depending on where you live, for example in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a privacy law, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling;
• limit the use of sensitive personal information.

We don’t sell or share personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects. We use sensitive information, such as account sign-in details and the contents of calls and forms you track, only to provide the Service.

In the last 12 months we collected the categories of information described in “Information we collect”: identifiers (such as names, email addresses, phone numbers and IP addresses), commercial information (such as purchase history), internet activity (such as use of the Service), audio recordings (where call recording is on) and business information. We collected it from you, from your devices, from the tools you connect and from the people who contact our customers, and we used and disclosed it for the purposes described in this policy.

To use these rights, send us a request with the form at the end of this page. You can use an authorized agent, and we may ask for proof that the agent acts for you. We won’t treat you differently for using your rights. If we decline your request, you can appeal by replying to our decision. If you’re not satisfied with the result of an appeal, you can contact your state attorney general.

13. Children

The Service is for businesses and isn’t directed to children. We don’t knowingly collect personal information from children under 16. If you think a child has given us personal information, tell us with the form at the end of this page and we’ll delete it.

14. International transfers

We’re based in the United States, and our servers are in the United States. Some of our service providers may process information in other countries. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where the law requires, we use appropriate safeguards for these transfers, such as standard contractual clauses.

15. Changes to this policy

We may update this policy from time to time. When we do, we’ll post the new version on this page and change the “Last updated” date. If a change is significant, we’ll tell you by email or in the app before it takes effect.

16. Contact us

Questions or requests about privacy? Send them with this form, and we’ll reply by email. For a request about your account, give the email address on your account so we can find it.