This is an earlier version, kept as it was published. Read the current version · All versions
SHA-256 fingerprint: bc908ef60f61a4c91426a5fb28ce8869c3c6981e99b794e6e3143fa8f800bf15

Call Me Booked (“Call Me Booked”, “we”, “us”) provides an AI-powered phone answering, booking, estimating and customer-messaging service to home-improvement businesses such as roofing, siding, window, fencing and renovation companies (our “Clients”). This policy explains what personal information we handle, why, and the choices you have. It is designed to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the private-sector privacy laws of Alberta, British Columbia and Québec where they apply, and applicable US state privacy laws.

1. Two kinds of people, two roles

Our Clients and their staff. When a business signs up, we collect account and billing information. For this information we decide how it is used and we are responsible for it.

Our Clients' customers and callers. When you call, text or email a business that uses Call Me Booked, we handle your information on behalf of that business, following its instructions and our Data Processing Addendum with it. The business remains responsible for your information; we act as its service provider. Questions about how a particular business uses your information should go to that business, and we will help it respond. Where we use information for our own purposes, as described in sections 3 and 6, we are responsible for that use.

2. Information we collect

From Clients and their staff

• Name, business name, email, phone number, job role and login details.
• Business settings: hours, service area, services, price book, estimators and crews, urgent contacts, estimate-visit fee.
• Billing information. Cards are entered on, and kept by, our payment processor (Stripe); we never see or store full card numbers, only the card brand, last 4 digits and expiry date, with your invoices and payment status.
• Records of changes made to settings and records (who changed what, and when), kept in an audit log for security.
• Estimator and crew location, only if they share it. While an estimator or crew member who chose to share it is on the way to a visit, their phone's position is recorded so the customer can see how far away they are; the business itself doesn't see it. Sharing stops when they arrive or turn it off. A business can also choose to see where its crew is during working hours: this is off unless the business turns it on, each crew member must agree in the crew app, and their position is shared only after they tap “Start my day” and only during the business's working hours. Only the latest position is ever kept.
• Crew app. If staff use our Android crew app, we keep their phone's notification address (a token), the app version and when it was last used. Notifications are delivered by Google's Firebase Cloud Messaging and never contain a customer's name, address or phone number; the app loads those details over an encrypted connection. So they can work without signal, the app keeps the details of that person's visits for today and tomorrow on their phone, encrypted, and deletes them after the visit day or when they sign out.

From callers and customers of our Clients

• Phone number, name, service address, email and the details of the problem you describe. We receive the caller's phone number and, where available, the caller-ID name from the phone network.
• Call recordings and transcripts. Calls answered by the AI assistant are recorded and transcribed. Every call our system answers, including voicemail, starts with a notice that you are speaking with the business's AI assistant and that the call is recorded and transcribed by its call service, Call Me Booked; the recording starts with that notice, and transcription starts only after it. If the assistant puts your call through to someone at the business, that person first hears that the call is recorded, and the recording stops when you are connected unless the business chooses to keep recording transferred calls. If you would rather not be recorded, say so: the assistant will take only your name, number and a short message for a call back, and the recording of that call is deleted within 24 hours.
• Sensitive details you choose to share. Callers sometimes share sensitive details, such as a health or accessibility need that affects how a job should be handled. We use these only to deal with that request, share them only with the business, and never use them for marketing or to tailor offers. We do not use voice recordings to identify people by their voice.
• Text messages and emails exchanged with the business, and photos you choose to upload.
• Service history the business provides to us, such as past jobs, quotes and equipment details.
• Estimates you sign. When you accept an estimate on its private link, we keep the option you chose, the name you typed, the time, and your IP address and browser type, so the business and you have a record of what was agreed.
• Invoices and payments. Invoices and payment requests the business sends you, when you opened them, and whether and how they were paid. If you pay by card, you enter your card on Stripe's secure page, and the payment goes to the business's own Stripe account. Neither we nor the business see or store your full card number; we keep the amount, the date and the payment status.
• Your marketing-consent status, the date and basis of that consent (including, if you gave consent on a call, the short part of the call in which you gave it), and any opt-out requests.

Automatically

• Technical information needed to run and secure the service, such as IP address, browser type and error logs. We use only essential cookies (for example, to keep you signed in). We do not use advertising cookies.

3. How we use information

• To answer calls, understand what the caller needs, flag urgent messages to the business, book estimate visits and send confirmations, and, if you ask us to, tell you when an earlier time opens up.
• To recognise returning callers, unless the business turns this off: when you call from the number on your record with that business, the assistant asks for your first name and a detail such as your house number or postal code, and checks it against the record before using anything on file, so you aren't asked again for details the business already has. A phone number on its own is never treated as proof of who you are, and nothing on file is read out before the check. Only records within the business's retention period are used.
• To draft estimates and check invoices, always for review and approval by the business before anything is sent.
• To send invoices and payment links on behalf of the business, and to record the payments you make.
• To send service and, where consent allows, marketing messages on behalf of the business.
• To produce reports for the business, such as calls answered and revenue booked.
• To show each business how it compares with similar businesses nearby, using only combined figures of at least 5 businesses (for example, the typical share of calls answered). No business sees another's figures, and no caller's information is used.
• To secure the service, prevent fraud and spam, and meet legal obligations.
• To maintain and improve the service, using information about how the service is used (for example, how long calls last and which features are used), never the content of calls, messages or recordings. Before information is used for statistics shown outside a Client's own account, it is anonymized so that it can no longer be linked to any person by any reasonably foreseeable means, and we never try to re-identify anyone.

Conversation data. The recordings, transcripts, summaries and messages of a business's calls and texts are its conversation data. We process them only on that business's behalf and only to provide the service to it. We do not use conversation data to train, fine-tune or improve any AI model, we do not sell it, and we do not combine it across businesses except to produce counts that contain no message content and cannot identify anyone. We do not sell personal information, and we require our service providers not to use Client or caller data for their own purposes, including training AI models.

4. Artificial intelligence and your choices

Our AI assistant identifies itself as an AI at the start of every call. For businesses in the United States, the opening notice also says that the call is recorded and transcribed for the business by its call service, Call Me Booked. You can ask for a person at any time: during the business's opening hours you're put through to its office, and after hours the assistant takes a message for a call back (and flags urgent messages to the business). If you mention possible danger, such as a gas smell or someone being hurt, the assistant tells you to hang up and call 911 and passes your message to the business as urgent; it does not assess safety, give advice, book or send anyone on those calls. The assistant does not quote prices or discuss insurance coverage; the business covers those at your estimate. Estimates prepared with AI assistance are reviewed and approved by the business before you receive them.

Tailored offers. Offers a business sends you may be tailored using your service history and equipment — for example, a reminder that your eavestroughs are due for their fall cleaning. The business approves every campaign, and the same consent rules and opt-outs apply. If you live in Québec, offers are tailored this way only if you have agreed; otherwise you receive only general offers. Anyone can turn tailoring off by telling the business or emailing hello@callmebooked.com.

Decisions made automatically. Some outcomes are decided by the AI assistant without a person reviewing them at the time — for example, whether a message is flagged as urgent, whether and when an appointment can be booked, whether an address is inside the business's service area, which waiting customer is offered an appointment that opens up, and whether a call is blocked as spam. When a decision about you is made only by automated means, you will be told so no later than when you are told the decision. On request, you can learn what personal information was used, the reasons and main factors behind the decision, and how to correct that information, and you can ask a member of the business's staff who is able to review the decision to look at it again and consider your comments. Reply REVIEW to the text you received, ask the assistant for a person, or email hello@callmebooked.com.

5. Messages, consent and unsubscribing

Every message sent through Call Me Booked identifies the business it is sent for. Marketing messages, and service messages such as reminders and updates, include a way to unsubscribe. Reply STOP to any text, or use the unsubscribe link in any email, and you will stop receiving marketing messages from that business on every channel. You can also ask to stop all non-essential messages from it, including reminders; you will still receive replies to requests you make.

If a business asks for your consent to marketing on a call, the assistant tells you what you would receive and that you can unsubscribe at any time, and we send a text confirming your choice. We record consent and opt-outs as required by Canada's Anti-Spam Legislation (CASL) and the US Telephone Consumer Protection Act (TCPA), and we send messages only during reasonable hours in your time zone.

In the United States. Marketing texts, such as quote follow-ups and seasonal offers, are sent only with your own written consent: a box you tick on an estimate page, or a YES reply to an opt-in question in a text conversation you started. A note by the business's staff never counts as that consent. We send scheduled and marketing texts only between 8 a.m. and 9 p.m. in your local time (marketing: 9 a.m. to 8 p.m., Monday to Saturday, and at most one marketing text a day). Replies to a call or message you just sent may come at any time.

Clients' owners get a weekly results email about their account and emails about their billing. The weekly email has an unsubscribe link and can be switched off in Settings; billing emails are part of the service.

6. Businesses we contact about our own service

We tell trades businesses about Call Me Booked by email. To do that we collect business contact details that a business has published for business purposes: its name, trade, city, phone number, website, ratings shown on public listings such as OpenStreetMap or Google Maps, and a business email address that the business itself has published, such as on its own website or a business listing it manages. We record where we found the email address. We collect only email addresses a business has published for business enquiries, and we do not use tools that generate or guess email addresses. We may use AI to read the business's public website to understand what it does and to personalise our email.

• We send only a few short business emails. Each one identifies Call Me Booked, includes our mailing address and has an unsubscribe link.
• If you ask for a demo on our website, we use the details you give us (name, company, email, phone, trade and city) only to arrange the demo and follow up on your request.
• We don't contact a business whose website, or the page where we found its address, says it doesn't want unsolicited messages.
• If an email links to our demo video with a personal link, we record whether it was opened and how much of the video was watched.
• If you start a free missed-call check, you accept the check's terms before it starts. We answer and record the calls you forward to the check line only to answer them for you and prepare your report, and show them to you on a private page; our staff see only counts of calls, never the recordings, transcripts or callers' numbers. Callers hear that they reached an AI assistant and that the call is recorded. Recordings, transcripts and messages from the check are deleted 30 days after it ends unless you sign up.
• If you sign up for launch news on callmebooked.com, we keep your email address and the time you agreed, and send you one launch email. You can unsubscribe from it at any time.
• If you call our demo phone line, your call is answered by the AI, recorded, and shown in our demo company's records.
• If you unsubscribe or ask us to stop, we stop within minutes and keep your address on a permanent do-not-contact list so that we never email you again.
• We delete the records of businesses we're no longer talking to, including video-view records, after two years without activity. The do-not-contact list is kept so that we can honour opt-outs.

7. Who we share information with

We share personal information only as needed to provide the service:

• With the business you contacted, which uses it to serve you.
• With service providers that help us operate: Supabase (database and file storage), Vercel (hosting), Twilio or Telnyx (calls and texts, including speech recognition and voices), Anthropic (AI), Stripe (payments), Resend (email), Google (calendars and email that a business chooses to connect, our own sales email, and Firebase Cloud Messaging for crew app notifications) and Cloudflare (domain names and email forwarding). Their terms require them to protect the information and use it only to provide their services, and we require them not to use it for their own purposes, including training AI models. Our current list of subprocessors shows what each does, where, and when each confirmed this in writing.
• With OpenStreetMap's public address lookup, to estimate distances between service addresses (for example, to offer an appointment that opens up to a nearby customer who asked to be told). We send it only a street address, never a name or phone number.
• If required by law, or to protect someone's safety.
• In a merger or sale of our business, subject to this policy.

We never sell personal information.

8. Google user data

Call Me Booked's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When a business connects its Google Calendar, we access its calendar events only to find the times the owner is busy, and to create, update or cancel the estimate-visit events Call Me Booked booked (and a test event when the owner asks for one). We don't read event titles, descriptions, locations or guests: only each event's start and end times and whether it's marked busy. We also receive the email address of the Google account that was connected, to show which calendar is in use.

We don't sell this information or share it with anyone else, except the hosting providers that store it for us to run the service. We don't use it for advertising, and we don't use it to train AI models.

The owner can disconnect Google Calendar at any time in Settings → Calendar, or by removing Call Me Booked's access at myaccount.google.com/permissions. After either, we delete the stored access tokens within 24 hours.

9. Where information is stored

Our primary database, including call records, customer records and recordings, is hosted in Canada. To provide the service, some providers process information outside Canada: in the United States, Twilio and/or Telnyx (calls, texts and speech recognition), Anthropic (AI), Vercel (hosting), Resend (email), Stripe (payments), Google (connected calendars and email, and crew app notifications) and Cloudflare (domain and email routing); and OpenStreetMap's address lookup (street addresses only), run by the OpenStreetMap Foundation, whose servers may be in the United Kingdom or the European Union. We do this to answer calls, run the AI assistant, deliver messages and take payments.

Information processed outside Canada, including outside Québec, may be accessible to courts, law enforcement and national security authorities there. Before information leaves Québec, we assess the privacy risks and protect it by written agreement. For written information about our use of service providers outside Canada, or questions about it, contact our Privacy Officer at hello@callmebooked.com.

10. How long we keep information

• Call recordings: 12 months by default. A business can choose a shorter period, or up to 36 months if it needs recordings for quality, warranty or legal reasons. For businesses in the United States: 90 days by default, and up to 2 years.
• Transcripts: up to 36 months, unless the business deletes them sooner or a specific transcript is needed for a legal claim. For businesses in the United States, transcripts and call summaries are kept 3 years by default, and a business can choose up to 10 years to match its workmanship warranty.
• Job, customer and invoice records: for as long as the business is our Client, because they are its business records.
• Records of automated decisions: at least 1 year, then deleted with the related transcript.
• Consent records, including the short part of a call in which you gave consent: for as long as the consent is relied on, and 3 years after.
• Opt-out records: kept for as long as needed to honour your request.
• Estimator or crew location on the way to a visit: deleted when they arrive, finish or stop sharing, and in any case within 2 hours. Work-hours location: only the latest position, deleted at the end of the working day and in any case within 12 hours.
• Visit details kept on a crew member's phone: deleted after the visit day, or when they sign out. Crew app notification history: 30 days.
• Help chat conversations: 90 days.
• Free missed-call check: 30 days after the check ends, unless the business signs up.
• Early-access sign-ups: until you unsubscribe.

When a Client leaves, we return or delete its data within 90 days, except where the law requires us to keep it longer.

11. How we protect information

• Encryption in transit and at rest.
• Strict separation between businesses: each Client can see only its own data, enforced inside the database.
• Role-based access for owners, office staff, estimators and crews, and an audit log of who did what.
• Two-step sign-in on our own administrative accounts. Our staff can see a business's calls, messages and customer records only when the business allows support access (for up to 24 hours, and it can end it at any time) or, in a security emergency, with the reason recorded and the business told by email. Every access is logged and shown to the business.
• If a security breach or confidentiality incident affects personal information, we act immediately to limit harm, notify the affected business without undue delay and, where the law requires, notify affected individuals and the relevant regulators, including the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta and Québec's Commission d'accès à l'information. We keep a record of every incident.

12. Your rights

You can ask to access or correct your personal information, or withdraw consent to its use (which may limit the service we can provide). If you are a caller or customer of one of our Clients, you can contact that business directly or email us at hello@callmebooked.com and we will help. We respond within 30 days.

Québec residents can also ask for computerized personal information they provided to be given to them, or to someone they choose, in a structured, commonly used format. Residents of US states with privacy laws may have additional rights, which we will honour.

If you are not satisfied with our response, depending on where you live you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or Québec's Commission d'accès à l'information.

13. Children

The service is intended for businesses and adults. If a caller appears to be a child (under 14 in Québec, under 13 elsewhere), we collect only what is needed for the business to call a parent or guardian back, and we never use it for marketing.

14. Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will notify Clients by email before it takes effect.

15. How we govern personal information

• Our Privacy Officer is responsible for our compliance with privacy law, approves this policy and our retention schedule (section 10), and oversees how we handle incidents and requests.
• Everyone who works on Call Me Booked is bound by confidentiality and can access personal information only as their role requires.
• Before we launch a new system or add a new service provider that handles personal information, we assess its privacy risks.
• Complaints and requests go to hello@callmebooked.com. We acknowledge them within 5 business days and respond within 30 days, and we tell you how to take the matter to a regulator if you are not satisfied.

16. Contact our Privacy Officer

Our Privacy Officer, the Founder and Chief Executive Officer, is responsible for our compliance with privacy law.

Call Me Booked · Attn: Privacy Officer · hello@callmebooked.com