This is an earlier version, kept as it was published. Read the current version · All versions
SHA-256 fingerprint: 62543f54d0ce90d1b544c1aa22ac6c6034d89cfa7aaa5f0d2e3d2adff812f08b

1001801092 ONTARIO INC., operating as Call Me Booked (“Call Me Booked”, “we”, “us”), provides an AI-powered phone answering, booking, estimating and customer-messaging service to home-improvement businesses such as roofing, siding, window, fencing and renovation companies (our “Clients”). This policy explains what personal information we handle, why, and the choices you have. It is designed to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the private-sector privacy laws of Alberta, British Columbia and Québec where they apply, and applicable US state privacy laws.

1. Two kinds of people, two roles

Our Clients and their staff. When a business signs up, we collect account and billing information. For this information we decide how it is used and we are responsible for it.

Our Clients' customers and callers. When you call, text or email a business that uses Call Me Booked, we handle your information on behalf of that business, following its instructions and our Data Processing Addendum with it. The business remains responsible for your information; we act as its service provider. Questions about how a particular business uses your information should go to that business, and we will help it respond. We do not use your information to market Call Me Booked to you. Where we use information for our own purposes, as described in sections 3 and 6, we are responsible for that use.

2. Information we collect

From Clients and their staff

• Name, business name, email, phone number, job role and login details.
• Business settings: hours, service area, services, price book, estimators and crews, urgent contacts, estimate-visit fee.
• Billing information. Cards are entered on, and kept by, our payment processor (Stripe); we never see or store full card numbers, only the card brand, last 4 digits and expiry date, with your invoices and payment status. If you pay by pre-authorized debit, your bank account details are also entered on and kept by Stripe; we keep only the bank's name, the last 4 digits of the account and the payment status.
• Records of changes made to settings and records (who changed what, and when), kept in an audit log for security.
• If a business signs up through another business's referral link, which business referred it, so that we can give referral rewards and check that they meet our conditions.
• Estimator and crew location, only if they share it. While an estimator or crew member who chose to share it is on the way to a visit, their phone's position is recorded so the customer can see how far away they are; the business itself doesn't see it. Sharing stops when they arrive or turn it off. A business on a plan that includes it can also choose to see where its crew is during work hours: this is off unless the business turns it on, and each crew member must agree, in the crew app or on our website, before anything is collected from them. Their position is then collected only after they tap “Start my day”, only during their own scheduled hours on days they have visits or jobs, and it stops when they tap “End my day”, when their last visit or job of the day is marked done, or when their hours end. In the crew app it's shared in the background with a notice on their phone where the phone and app store allow it, and otherwise only while the app is open; on the website, only while the page is open. Only the business's owners and office staff see it. Under our Terms, a business must not use crew location data, including location history and visit times, for discipline or performance ranking. If the business keeps location history, each position is kept for 7 days so it can check when visits started and ended; otherwise only the latest position is kept. See section 10.
• Crew app. If staff use our Android crew app, we keep their phone's notification address (a token), the app version and when it was last used. Notifications are delivered by Google's Firebase Cloud Messaging and never contain a customer's name, address or phone number; the app loads those details over an encrypted connection. So they can work without signal, the app keeps the details of that person's visits for today and tomorrow on their phone, encrypted, and deletes them after the visit day or when they sign out.

From callers and customers of our Clients

• Phone number, name, service address, email and the details of the problem you describe. We receive the caller's phone number and, where available, the caller-ID name from the phone network.
• Call recordings and transcripts. Calls answered by the AI assistant are recorded and transcribed. Every call our system answers, including voicemail, starts with a notice that you are speaking with the business's AI assistant and that the call is recorded and transcribed by its call service, Call Me Booked; the recording starts with that notice, and transcription starts only after it. If the assistant puts your call through to someone at the business, that person first hears that the call is recorded, and the recording stops when you are connected unless the business chooses to keep recording transferred calls. If you would rather not be recorded, say so: the assistant will take only your name, number and a short message for a call back, and the recording of that call is deleted within 24 hours.
• Sensitive details you choose to share. Callers sometimes share sensitive details, such as a health or accessibility need that affects how a job should be handled. We use these only to deal with that request, share them only with the business, and never use them for marketing or to tailor offers. We do not use voice recordings to identify people by their voice.
• Text messages and emails exchanged with the business, and photos you choose to upload.
• Reviews shown on a business's website. If a business copies a review you left on a review site onto its Call Me Booked website, we store and show the review text, the name shown on the review and its date, as the business gives them to us. Ask the business, or email hello@callmebooked.com, to have it taken down.
• Requests from lead sites and website forms. If the business forwards enquiries from lead sites or its own website form to its private Call Me Booked lead address, we receive the details in each enquiry (such as your name, phone number, email, service address and what you need) and use them to contact you about that request on the business's behalf. If you reply asking for a call, we keep your request (the number, the time and your reply) as the record of your consent for 3 years, and the call is recorded and transcribed like other calls.
• Service history the business provides to us, such as past jobs, quotes and equipment details.
• Estimates you sign. When you accept an estimate on its private link, we keep the option you chose, the name you typed, the time, and your IP address and browser type, so the business and you have a record of what was agreed.
• Invoices and payments. Invoices and payment requests the business sends you, when you opened them, and whether and how they were paid. If you pay by card, you enter your card on Stripe's secure page, and the payment goes to the business's own Stripe account. Neither we nor the business see or store your full card number; we keep the amount, the date and the payment status.
• Your marketing-consent status, the date and basis of that consent (including, if you gave consent on a call, the short part of the call in which you gave it), and any opt-out requests.

Automatically

• Technical information needed to run and secure the service, such as IP address, browser type and error logs. We use only essential cookies (for example, to keep you signed in). We do not use advertising cookies.

3. How we use information

• To answer calls, understand what the caller needs, flag urgent messages to the business, book estimate visits and send confirmations, and, if you ask us to, tell you when an earlier time opens up.
• To recognise returning callers, unless the business turns this off: when you call from the number on your record with that business, the assistant asks for your first name and a detail such as your house number or postal code, and checks it against the record before using anything on file, so you aren't asked again for details the business already has. A phone number on its own is never treated as proof of who you are, and nothing on file is read out before the check. Only records within the business's retention period are used.
• To draft estimates and check invoices, always for review and approval by the business before anything is sent.
• To send invoices and payment links on behalf of the business, and to record the payments you make.
• To send service and, where consent allows, marketing messages on behalf of the business, including requests for a review after a completed job and, after a severe weather warning, a message offering a roof check to the business's recent customers in the area.
• To produce reports for the business, such as calls answered and revenue booked.
• To show each business how it compares with similar businesses nearby, using only combined figures of at least 5 businesses (for example, the typical share of calls answered). No business sees another's figures, and no caller's information is used.
• To secure the service, prevent fraud and spam, and meet legal obligations.
• To maintain and improve the service, using information about how the service is used (for example, how long calls last and which features are used), never the content of calls, messages or recordings. Before information is used for statistics shown outside a Client's own account, it is anonymized so that it can no longer be linked to any person by any reasonably foreseeable means, and we never try to re-identify anyone.

Conversation data. The recordings, transcripts, summaries and messages of a business's calls and texts are its conversation data. We process them only on that business's behalf and only to provide the service to it. We do not use conversation data to train, fine-tune or improve any AI model, we do not sell it, and we do not combine it across businesses except to produce counts that contain no message content and cannot identify anyone. We do not sell personal information. We require our service providers not to use Client or caller data to train AI models, and to use it only to provide their services to us, except that Twilio may use some information for its own purposes as described in section 9.

4. Artificial intelligence and your choices

Our AI assistant identifies itself as an AI at the start of every call. For businesses in the United States, the opening notice also says that the call is recorded and transcribed for the business by its call service, Call Me Booked. You can ask for a person at any time: during the business's opening hours you're put through to its office, and after hours the assistant takes a message for a call back (and flags urgent messages to the business). If you mention possible danger, such as a gas smell or someone being hurt, the assistant tells you to hang up and call 911 and passes your message to the business as urgent; it does not assess safety, give advice, book or send anyone on those calls. The assistant does not quote prices or discuss insurance coverage; the business covers those at your estimate. Estimates prepared with AI assistance are reviewed and approved by the business before you receive them.

Tailored offers. Offers a business sends you may be tailored using your service history and equipment — for example, a reminder that your eavestroughs are due for their fall cleaning. The business approves every campaign, and the same consent rules and opt-outs apply. If you live in Québec, offers are tailored this way only if you have agreed; otherwise you receive only general offers. Anyone can turn tailoring off by telling the business or emailing hello@callmebooked.com.

Decisions made automatically. Some outcomes are decided by the AI assistant without a person reviewing them at the time — for example, whether a message is flagged as urgent, whether and when an appointment can be booked, whether an address is inside the business's service area, which waiting customer is offered an appointment that opens up, and whether a call is blocked as spam. When a decision about you is made only by automated means, you will be told so no later than when you are told the decision. On request, you can learn what personal information was used, the reasons and main factors behind the decision, and how to correct that information, and you can ask a member of the business's staff who is able to review the decision to look at it again and consider your comments. Reply REVIEW to the text you received, ask the assistant for a person, or email hello@callmebooked.com.

5. Messages, consent and unsubscribing

Every message sent through Call Me Booked identifies the business it is sent for. Marketing messages, and service messages such as reminders and updates, include a way to unsubscribe. Reply STOP to any text, or use the unsubscribe link in any email, and you will stop receiving marketing messages from that business on every channel. You can also ask to stop all non-essential messages from it, including reminders; you will still receive replies to requests you make.

If a business asks for your consent to marketing on a call, the assistant tells you what you would receive and that you can unsubscribe at any time, and we send a text confirming your choice. We record consent and opt-outs as required by Canada's Anti-Spam Legislation (CASL) and the US Telephone Consumer Protection Act (TCPA), and we send messages only during reasonable hours in your time zone.

In the United States. Marketing texts, such as quote follow-ups and seasonal offers, are sent only with your own written consent: a box you tick on an estimate page, or a YES reply to an opt-in question in a text conversation you started. A note by the business's staff never counts as that consent. We send scheduled and marketing texts only between 8 a.m. and 9 p.m. in your local time (marketing: 9 a.m. to 8 p.m., Monday to Saturday, and at most one marketing text a day). Replies to a call or message you just sent may come at any time.

Clients' owners get a weekly results email about their account and emails about their billing. The weekly email has an unsubscribe link and can be switched off in Settings; billing emails are part of the service. Owners who switch it on in Settings also get a weekly text with last week's numbers; replying STOP turns it off.

6. Businesses we contact about our own service

We tell trades businesses about Call Me Booked by email. To do that we collect business contact details that a business has published for business purposes: its name, trade, city, phone number, website, ratings shown on public listings such as OpenStreetMap or Google Maps, and a business email address that the business itself has published, such as on its own website or a business listing it manages. We record where we found the email address. We collect only email addresses a business has published for business enquiries, and we do not use tools that generate or guess email addresses. We may use AI to read the business's public website to understand what it does and to personalise our email.

• We send only a few short business emails. Each one identifies Call Me Booked, includes our mailing address and has an unsubscribe link.
• If you ask for a demo on our website, we use the details you give us (name, company, email, phone, trade and city) only to arrange the demo and follow up on your request.
• We don't contact a business whose website, or the page where we found its address, says it doesn't want unsolicited messages.
• If an email links to our demo video with a personal link, we record whether it was opened and how much of the video was watched.
• If you start a free missed-call check, you accept the check's terms before it starts. We answer and record the calls you forward to the check line only to answer them for you and prepare your report, and show them to you on a private page; our staff see only counts of calls, never the recordings, transcripts or callers' numbers. Callers hear that they reached an AI assistant and that the call is recorded. When the check ends, we send you one email with your results. Unless you sign up, recordings, transcripts, messages and callers' details from the check are deleted 30 days after it ends, and call summaries (what each call was about, without who called) 90 days after it ends.
• If you sign up for launch news on callmebooked.com, we keep your email address and the time you agreed, and send you one launch email. You can unsubscribe from it at any time.
• If you call our demo phone line, your call is answered by the AI, recorded, and shown in our demo company's records.
• If you unsubscribe or ask us to stop, we stop within minutes and keep your address on a permanent do-not-contact list so that we never email you again.
• We delete the records of businesses we're no longer talking to, including video-view records, after two years without activity. We keep a short record of each email we sent (the address, why we were allowed to send it, where we found the address, and the dates and versions of the messages) for three years after the last one, only to show that we followed anti-spam law, and then delete it. The do-not-contact list is kept permanently so that we can honour opt-outs.

7. Who we share information with

We share personal information only as needed to provide the service:

• With the business you contacted, which uses it to serve you.
• With service providers that help us operate: Supabase (database and file storage), Vercel (hosting), Twilio or Telnyx (calls and texts, including speech recognition and voices), Anthropic (AI), Stripe (payments), Resend (email), Google (calendars and email that a business chooses to connect, our own sales email, Firebase Cloud Messaging for crew app notifications, and Google Maps for address suggestions and postal code lookups, using only the street address) and Cloudflare (domain names and email forwarding). Their terms require them to protect the information and use it only to provide their services, except as described in section 9 for Twilio, and we require them not to use it to train AI models. Our current list of subprocessors shows what each does, where, and when each confirmed this in writing.
• With other software that a business chooses to connect to its own account, such as Jobber, CompanyCam or QuickBooks Online: we send that software only what the connection needs (for CompanyCam, the customer's name, service address and the photos they sent; for QuickBooks Online, invoices and payments with the customer's name and contact details), and receive from it what the business asks us to bring in (for Jobber, its clients, requests and upcoming visits), under the business's own agreement with that provider.
• With OpenStreetMap's public address lookup and building search, to estimate distances between service addresses (for example, to offer an appointment that opens up to a nearby customer who asked to be told) to find a house's outline for a rough roof size before a roofing estimate visit (on some plans), and to place a business's past customers on a map once, so that after a severe weather warning the business can see which of them are in the warning area (on plans with storm mode's warning-area list; the position is kept until the address changes or the customer record is deleted). We send them only a street address or its map position, never a name or phone number.
• Financing links. If a business shows a financing partner's link on your quote, opening it takes you to that partner's site. We don't send the partner any of your information, and the partner's own privacy policy applies to what you give them.
• If required by law, or to protect someone's safety.
• With an affiliate or a new company that takes over the Call Me Booked business, or in a merger, amalgamation, sale or financing of our business (including when one is being considered), only as needed for that transaction and subject to this policy. The company that takes over will use the information only for the purposes in this policy.

We never sell personal information.

8. Google user data

Call Me Booked's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When a business connects its Google Calendar, we access its calendar events only to find the times the owner is busy, and to create, update or cancel the estimate-visit events Call Me Booked booked (and a test event when the owner asks for one). We don't read event titles, descriptions, locations or guests: only each event's start and end times and whether it's marked busy. We also receive the email address of the Google account that was connected, to show which calendar is in use.

We don't sell this information or share it with anyone else, except the hosting providers that store it for us to run the service. We don't use it for advertising, and we don't use it to train AI models.

The owner can disconnect Google Calendar at any time in Settings → Calendar, or by removing Call Me Booked's access at myaccount.google.com/permissions. After either, we delete the stored access tokens within 24 hours.

9. Where information is stored

We use service providers to run the Service, and they store and process personal information in Canada, the United States and, for some services, other countries. Our main database and file storage, including call records, customer records and recordings, are hosted by Supabase in Canada (Montréal region), though Supabase may access or process some of it from other countries to support and secure its service. Twilio and/or Telnyx handle phone calls, text messages, call recordings and speech recognition in the United States. Anthropic provides AI processing of call content (to answer, summarize and route calls) in the United States; it does not use that content to train its models. Vercel hosts our web application in Canada and the United States, with a global content delivery network. Resend (email), Stripe (payments), Google (connected calendars and email, crew app notifications, and address lookups) and Cloudflare (domain and email routing) process information in the United States. The OpenStreetMap Foundation and the Overpass API service look up street addresses and building outlines (street addresses or map positions only) in the United Kingdom or the European Union. We do this to answer calls, run the AI assistant, deliver messages and take payments.

Information stored or processed outside Canada, including outside Québec, is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities. Our contracts with these providers include data protection terms that require them to protect your information and use it only to provide their services to us. Twilio may also use some information for its own purposes, such as preventing fraud and spam and improving its services, as described in its privacy notice. Before information leaves Québec, we assess the privacy risks and protect it by written agreement. To get written information about our policies and practices for service providers outside Canada, including the countries involved and the purposes, or if you have questions about how those providers collect, use, disclose or store personal information, contact our Privacy Officer at hello@callmebooked.com.

10. How long we keep information

• Call recordings: 12 months by default. A business can choose a shorter period, or up to 36 months if it needs recordings for quality, warranty or legal reasons. For businesses in the United States: 90 days by default, and up to 2 years.
• Transcripts: up to 36 months, unless the business deletes them sooner or a specific transcript is needed for a legal claim. For businesses in the United States, transcripts and call summaries are kept 3 years by default, and a business can choose up to 10 years to match its workmanship warranty.
• Job, customer and invoice records: for as long as the business is our Client, because they are its business records.
• Records of automated decisions: at least 1 year, then deleted with the related transcript.
• Consent records, including the short part of a call in which you gave consent: for as long as the consent is relied on, and 3 years after.
• Opt-out records: kept for as long as needed to honour your request.
• Estimator or crew location on the way to a visit: deleted when they arrive, finish or stop sharing, and in any case within 2 hours. Work-hours location: if the business keeps location history, each position is kept for 7 days, then deleted automatically; otherwise only the latest position is kept, deleted at the end of the working day and in any case within 12 hours. All of a crew member's positions are deleted at once if they withdraw their agreement or leave the business, if the business turns work-hours location off, and when the business's account is deleted.
• Visit details kept on a crew member's phone: deleted after the visit day, or when they sign out. Crew app notification history: 30 days.
• Help chat conversations: 90 days.
• Free missed-call check: recordings, transcripts, messages and callers' details 30 days after the check ends, and call summaries 90 days after it ends, unless the business signs up.
• Early-access sign-ups: until you unsubscribe.
• Records of what a business accepted (the documents and boxes, the version, who accepted, when and from where): kept for 3 years after its agreement with us ends, then deleted, unless they are needed for a legal claim.
• Records of the emails we sent to businesses about our own service: see section 6.

When a Client leaves, we return or delete its data within 90 days, except where the law requires us to keep it longer.

11. How we protect information

• Encryption in transit and at rest.
• Strict separation between businesses: each Client can see only its own data, enforced inside the database.
• Role-based access for owners, office staff, estimators and crews, and an audit log of who did what.
• Two-step sign-in on our own administrative accounts. Our staff can see a business's calls, messages and customer records only when the business allows support access (for up to 24 hours, and it can end it at any time) or, in a security emergency, with the reason recorded and the business told by email. Every access is logged and shown to the business.
• If a security breach or confidentiality incident affects personal information, we act immediately to limit harm, notify the affected business without undue delay and, where the law requires, notify affected individuals and the relevant regulators, including the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta and Québec's Commission d'accès à l'information. We keep a record of every incident.

12. Your rights

You can ask to access or correct your personal information, or withdraw consent to its use (which may limit the service we can provide). If you are a caller or customer of one of our Clients, you can contact that business directly or email us at hello@callmebooked.com and we will help. We respond within 30 days.

Québec residents can also ask for computerized personal information they provided to be given to them, or to someone they choose, in a structured, commonly used format. Residents of US states with privacy laws may have additional rights, which we will honour.

If you are not satisfied with our response, depending on where you live you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or Québec's Commission d'accès à l'information.

13. Children

The service is intended for businesses and adults. If a caller appears to be a child (under 14 in Québec, under 13 elsewhere), we collect only what is needed for the business to call a parent or guardian back, and we never use it for marketing.

14. Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will notify Clients by email before it takes effect.

15. How we govern personal information

• Our Privacy Officer is responsible for our compliance with privacy law, approves this policy and our retention schedule (section 10), and oversees how we handle incidents and requests.
• Everyone who works on Call Me Booked is bound by confidentiality and can access personal information only as their role requires.
• Before we launch a new system or add a new service provider that handles personal information, we assess its privacy risks.
• Complaints and requests go to hello@callmebooked.com. We acknowledge them within 5 business days and respond within 30 days, and we tell you how to take the matter to a regulator if you are not satisfied.

16. Contact our Privacy Officer

Our Privacy Officer, the Founder and Chief Executive Officer, is responsible for our compliance with privacy law. Contact the Privacy Officer at hello@callmebooked.com.

1001801092 ONTARIO INC., operating as Call Me Booked · Attn: Privacy Officer · 6-2160 Highway 7, Suite 746, Vaughan, ON L4K 1W6 · hello@callmebooked.com