Privacy Policy

For data about your own account (your name, your business details, your billing record), Callverted is the controller. For data about your callers, you are the controller and Callverted is the processor: we capture, store, and organize that data on your behalf and act on your instructions. You decide what happens with your leads, and you are responsible for the notices and consents your jurisdiction requires from your callers.

Business account information. When you create an account we collect your business name, owner name, email address, phone number, timezone, and trade category. We also store the settings you configure: your forwarding number, your service list and pricing, the questions you have written answers to, and your notification preferences. Billing details are collected and held by Stripe. We never see or store your card number.

Caller and lead information. Callverted creates one lead record per captured contact. No profile is built across contacts. A lead record can contain:

• The caller's phone number, taken automatically from caller ID on a phone call, or typed on the intake form
• The caller's name. On a job call the AI never asks for it and only records it if the caller volunteers it. On a message call and on the web form, it is asked
• An email address, only if the caller gives one on the web form. The AI never asks for an email by phone
• The normalized intake answers: the service needed, urgency, when the issue came up, insurance/warranty/financing coverage, and the ZIP code. We ask for a ZIP rather than a street address, but we record a street address when the caller gives one anyway
• The service the caller asked for in their own words, when it does not match a configured service
• Notes: the message content or the caller's reason for calling, in their words
• Scores we compute (urgency, quality, priority) with the trace explaining them, and a backend job-value estimate range
• Status and timing fields your team drives, such as when a human first made contact, plus whether a callback reminder has gone out to your team

Call records. One record per inbound phone call, whoever answered: the caller's number, the Callverted number dialed, timings and duration, the outcome (your team answered, the AI captured it, the caller hung up, or the call was screened as a wrong number or solicitation), the turn-by-turn transcript, and a short AI-written summary that is generated with an instruction to leave out names, phone numbers, and addresses. We also keep the raw webhook payload our telephony provider sends us, for debugging and to avoid processing the same event twice. That payload can include caller-ID metadata supplied by the carrier, such as city and state.

Text messages sent to your Callverted number. That number receives texts as well as calls. We store each inbound message — the sender's number, the number they texted, the message body itself, and when it arrived — and read it the way we read a call, producing the same kind of job or message record. Several texts from one sender within a few minutes are treated as one contact rather than several. Nothing is ever sent back, not even an acknowledgement; see our SMS Policy.

AI assessment records. For job leads only, we store the plain-English reasoning that explains the already-computed scores, plus the raw model response for debugging. Messages are never scored and get no assessment record.

Prospect information. If you use the ROI calculator, request a demo, ask us to call you back, or download something from our marketing site, we store what you entered (an email address, or a name and phone number where the form asks for those), which tool you used, and the figures you typed into it. We also store how you first reached the site, which means the campaign details in the link you arrived on and the site that referred you. If you unsubscribe, we keep your address on a suppression list so we can keep honoring that.

Technical information. If you turn on push alerts, we store the push endpoint and keys your browser issues, plus a browser/device label so you can tell your devices apart. We keep server logs for security and debugging. Public endpoints (the intake form and the marketing capture form) use the requesting IP address for rate limiting when that limiter is configured. We run the Meta (Facebook) advertising pixel on our marketing pages and our own dashboard so we can tell which of our ads bring people here, and we send Meta a matching record from our servers when someone submits a form or starts a subscription. Those records carry a one-way hash of an email address, phone number, name, or account id, alongside the requesting IP address, the browser user-agent string, and Meta's own _fbp/_fbc cookie values, which Meta requires unhashed in order to match at all. What you typed into a form is never included, and nothing about your callers is ever sent.

Website reading. If you give us your website address, either during signup or from Settings, we fetch that page and up to three of its service, about and FAQ pages once, send the text to OpenAI, and hand you draft answers and services to review. We identify ourselves as CallvertedBot when we do it. Nothing is saved to your account until you accept it, and no page content is kept if you do not.

The public demo. Anyone can hold a short conversation with the assistant on our marketing site without an account. That audio streams to OpenAI for the length of the call, exactly as a live call does, and no lead, call record, or transcript is stored afterwards. We use the requesting IP address (or your account, if you happen to be signed in) to enforce a daily limit on how many demo calls one visitor may place.

Callverted does not retain call audio. There is no audio playback anywhere in the product, because there is no stored audio to play. Two different paths handle sound, and neither one ends with a saved file:

• Calls the AI answers. Audio streams live between the phone network and OpenAI's realtime API for the length of the call so the assistant can hear and speak. No recording file is created. What we keep afterward is the written transcript and the short summary.
• Calls your team answers. Recording is on by default, so a call your team picks up gets captured and turned into a lead the same way a call the AI answers does — the recording only ever runs alongside a spoken disclosure, never without one. New accounts start with a standard notice ("This call may be recorded and transcribed for quality and training purposes."). When recording is on, our telephony provider records the answered conversation, we download it once to transcribe it with OpenAI's speech-to-text model, and then we delete the recording from the provider. The audio is never copied into our database or file storage.

Deletion runs immediately after the transcript is written. If a delete call fails, the failure is logged so it can be cleared, and a repeat of the same job deletes the audio without re-processing anything.

Both parties are told. When recording is on, the disclosure is spoken to the caller before your team is dialed, and it is spoken again at the start of the AI's greeting if the AI picks up. The AI also identifies itself as an automated assistant on every call it answers, whether or not recording is on. Different wording can be put in place by contacting support, and you are responsible for making whatever wording is in place satisfy the recording and wiretapping laws of every place you and your callers are located.

• It is not a CRM. There are no deal stages, no pipeline, and no customer profile assembled from a caller's activity over time. Each captured contact is its own record. Earlier contacts from the same phone number are shown together when you are about to call that number back, and that is as far as it goes: the grouping is worked out from the number when the page is loaded, not stored as an identity.
• No cross-business sharing. Your callers' data belongs to your account. It is never pooled with, matched against, or shown to another business on the platform.
• No sale of data, ever, and no advertising use of your callers' data. Nothing a caller tells Callverted, and nothing in a lead, a transcript, or a report, is sold or handed to an advertising platform. Our own marketing pages carry an advertising pixel that measures our ads, described in sections 3 and 10, and it never sees your callers.
• No model training on your data. We do not train AI models, and we do not hand caller or lead data to anyone for that purpose.
• No SMS is ever sent. Callverted does not text your callers and does not text you — not even an acknowledgement to someone who has just texted you. Receiving is different from sending: texts to your Callverted number are captured, as described in section 2. See our SMS Policy.
• Test calls and demo calls store nothing. A test call you make from the dashboard, and a demo call anyone places on our marketing site, both create no lead and no call record.

• To answer, route, and capture inbound calls, and to run the public intake form and website widget
• To turn what the caller said into a structured lead: extracting their answers, classifying the contact as a job, a message, or junk, and writing the call summary
• To compute urgency, quality, and priority scores and a backend job-value estimate, and to write the reasoning that explains them
• To alert you by web push and email when a job or a message comes in, to nudge your team again by push and then email if a qualified job still has not been acted on, and to send weekly and monthly performance recaps you can turn off
• To run your account: authentication, billing, receipts, trial reminders, and support
• To keep the service secure and working, including logging, rate limiting, and debugging

Callverted uses OpenAI models to hold the spoken conversation, transcribe audio, extract answers, classify the contact, and write summaries and score explanations. Call audio and transcript text are therefore processed by that third-party AI provider under its API data policies.

The model's authority is deliberately narrow, and this matters for what can be said to your callers:

• It chooses its own wording, but not its own agenda. Our code decides what the call still needs and when the call is over; the model puts that into a sentence, and classifies what the caller said into a fixed set of options. It is not free to decide what to ask for or to act on its own
• It never quotes a price you have not approved. If you have not approved wording for that service, the caller is told the team will review the details first
• It does not book appointments and does not commit you to anything
• It never bridges a call to a human. Warm transfer was removed from the product entirely. A caller who wants a person gets a callback message taken instead
• Scores are computed by code, not by the model. The model only explains a number that was already decided

Scores, summaries, transcripts, and value estimates are approximations meant to help you triage. They are not guarantees, and machine transcription can misread what was said.

We do not sell personal information. We share data with these providers only to run the platform:

• Twilio: phone numbers, inbound call handling, inbound text delivery, and the recording of a team-answered call (deleted after transcription)
• OpenAI: the realtime voice conversation, speech-to-text transcription, answer extraction, classification, summaries, and score explanations
• Clerk: sign-in, sessions, and account identity
• Supabase: the PostgreSQL database where account, lead, and call data is stored
• Stripe: subscription billing and payment processing
• Resend: transactional and account email delivery
• Vercel: application hosting and platform logs
• Inngest: background job processing, such as post-call transcription and scheduled emails
• Upstash: rate limiting on public endpoints, when configured
• Meta (Facebook): advertising measurement for our own marketing only, receiving the hashed identifiers and technical fields described in section 2. Never any caller or lead data

Push alerts are delivered through the push service run by your browser or device vendor, such as Google, Apple, or Mozilla. The alert content is encrypted to your device.

We may disclose information if required by law, or to protect the rights, property, or safety of Callverted, our users, or others. If Callverted is ever acquired, account and lead data may transfer as part of that transaction, and we will say so before it happens.

Inside Callverted, access to production data is limited to the people who need it to operate and support the service.

Traffic is encrypted in transit over HTTPS. Accounts are authenticated through Clerk, application queries are scoped to a single business, and inbound telephony webhooks are signature-verified before we act on them. Card numbers never touch our servers, and call audio is never stored.

We describe our practices here rather than claim a certification. Callverted holds no security or privacy certification, and no system is completely secure. If you believe your account has been compromised, contact us immediately at hello@callverted.com.

• Call audio: not retained. See section 3
• Leads, calls, transcripts, summaries, and received text messages: kept while your account is active, so your history and reports stay intact
• After cancellation: your data is kept for at least 90 days so you can request an export. We do not run an automatic purge on a fixed schedule, so if you want it gone sooner or want confirmation that it is gone, email us and we will delete it
• On request: we delete an account and its associated lead, call, and assessment data within 30 days of a verified request, except where we must keep something to meet a legal or tax obligation
• Unsubscribe records: kept indefinitely, because that is what lets us keep honoring the opt-out

We use cookies to keep you signed in and to remember your preferences. Sign-in cookies are set by Clerk. We also use advertising cookies. The Meta (Facebook) pixel sets its own cookies (_fbp and_fbc) to measure whether our ads work, governed by Meta's privacy policy, and we set one of our own (cv_attr) that records which campaign first brought you here. You can control cookies in your browser or block the pixel with any tracker blocker, and the site will work normally, though blocking sign-in cookies will stop the dashboard from working.

If you are a Callverted customer, you can access your account data at any time in the dashboard, export your leads, calls, and reports to CSV, correct your settings yourself, and ask us to delete your account and its data.

If you are a caller whose information a business captured through Callverted, that business controls your data. Contact the business you called first. If you contact us, we will help route your request to them and will act on their instruction, and we can confirm what categories of data Callverted holds.

Depending on where you live, you may have additional rights over your personal information under local law. To make any request, email hello@callverted.com.

Callverted is a business tool and is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy. Material changes will be announced by email or by a notice in the dashboard, and the date at the top of this page will change. Continued use of the service after an update takes effect means you accept it.

For privacy questions, contact us at hello@callverted.com.