Privacy Policy

Callably ("we," "us," or "our") is operated by Code Discoveries. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Callably platform at callably.co (the "Service"). Please read this policy carefully. By using the Service, you consent to the data practices described in this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored as a secure bcrypt hash; we never store plaintext passwords)
• Account preferences and settings

1.2 Phone and Communication Data

When you connect your phone provider, the Service processes:

• Call metadata: phone numbers (caller and recipient), call direction (inbound/outbound), call duration, timestamps
• Call recordings: audio files received from your phone provider (RingCentral, Twilio, Plivo, CallRail, smrtPhone, or ClickSend)
• Call transcripts: text generated from call recordings via AI transcription
• AI-generated summaries: call summaries, extracted contact information, lead scores, and action items produced by AI analysis
• SMS messages: text message content, sender/recipient phone numbers, timestamps

1.3 Lead and Contact Information

The Service creates and stores lead records including:

• Phone numbers
• Names, email addresses, and company names (extracted from calls or entered manually)
• Lead scores and status classifications
• Activity history (calls, SMS, notes)

1.4 Usage and Technical Data

• IP addresses and browser user-agent strings
• Pages visited and features used
• API call logs and webhook delivery records
• Error logs for debugging purposes

1.5 Billing Information

Payment processing is handled entirely by Razorpay. We do not store credit card numbers, CVVs, or full payment card details on our servers. Razorpay may store your billing name, email, and payment method details in accordance with their privacy policy.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and deliver call transcriptions and AI summaries
• Create and manage lead records and activity histories
• Forward structured data to your configured webhook/CRM endpoints
• Manage your account, authentication, and access control
• Process billing and subscriptions through Razorpay
• Send transactional emails (account verification, password resets)
• Monitor service health, detect errors, and improve reliability
• Prevent fraud, abuse, and unauthorized access
• Comply with legal obligations

3. Data Storage and Security

3.1 Storage

Your data is stored in PostgreSQL databases hosted on secure servers. Call recordings are temporarily stored for processing and are not retained permanently on our servers after transcription is complete.

3.2 Encryption

• In transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• At rest: Sensitive credentials (API keys, tokens) are stored encrypted. Passwords are hashed using bcrypt with appropriate cost factors
• Sessions: Session cookies are configured with Secure, HttpOnly, and SameSite attributes

3.3 Security Measures

• Security headers (X-Frame-Options, Content-Security-Policy, HSTS, etc.)
• Input validation and parameterized database queries to prevent injection attacks
• Rate limiting on authentication endpoints
• Audit logging of administrative actions
• Access restricted by role-based authentication

4. Third-Party Services and Data Sharing

We share data with third parties only as necessary to provide the Service:

4.1 OpenAI

Call recordings are sent to OpenAI's Whisper API for transcription, and transcripts are processed by OpenAI's GPT models for summarization, contact extraction, and lead scoring. OpenAI's data usage policies apply to this processing. Per OpenAI's API terms, data sent via the API is not used to train their models.

4.2 Razorpay

Billing information, subscription details, and payment data are processed by Razorpay. Razorpay acts as our payment processor and stores payment methods securely in compliance with PCI DSS standards. See Razorpay's Privacy Policy.

4.3 Phone Providers

We connect to your phone provider (RingCentral, Twilio, Plivo, CallRail, smrtPhone, or ClickSend) using API credentials you provide. We access call data, recordings, and SMS through these providers' APIs. Each provider has its own privacy policy governing how they handle your communications data.

4.4 Your Configured Webhooks

When you configure a webhook URL, structured data (call details, transcripts, lead information) is sent via HTTP POST to the endpoint you specify. You are responsible for the privacy practices of any system that receives this data.

4.5 Email Service

We use email services to send transactional messages such as account verification and password reset emails. Only your email address and the message content are shared with our email provider.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Your Rights

5.1 Access

You have the right to access the personal data we hold about you. You can view your leads, activity history, and account settings through the Service dashboard at any time.

5.2 Data Export

You can export your data (leads, activities, settings) in JSON format from your account dashboard. This allows you to obtain a portable copy of all data associated with your account.

5.3 Deletion

You can request deletion of your account and all associated data from your account settings. Upon account deletion:

• All leads, activities, notes, and settings are permanently deleted
• Your Razorpay subscription is cancelled if active
• Team member records are removed
• Authentication records are deactivated and personal data is cleared

Some data may be retained in encrypted backups for a limited period as required for legal or operational purposes, after which it is permanently destroyed.

5.4 Correction

You can update your account information, lead records, and settings at any time through the Service interface.

5.5 Withdraw Consent

You may stop using the Service and delete your account at any time. Disconnecting your phone provider credentials stops all new data collection from that provider.

6. Data Retention

• Account data: Retained while your account is active, deleted upon account deletion
• Call recordings: Temporarily stored for processing (transcription), not retained permanently
• Transcripts and summaries: Retained while your account is active
• Lead data: Retained while your account is active
• Webhook logs: Retained for up to 90 days for debugging and retry purposes
• Audit logs: Retained for up to 12 months for security purposes
• Billing records: Retained as required by tax and accounting regulations

7. Cookies

Callably uses the following cookies:

• Session cookie (PHPSESSID): Essential for authentication and maintaining your logged-in state. This is a strictly necessary cookie and does not require consent. It expires when you close your browser or after session timeout.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not use cookies for cross-site tracking or behavioral advertising.

8. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), the following applies:

• Legal basis for processing: We process your data based on contractual necessity (providing the Service you signed up for), legitimate interests (security, fraud prevention), and consent (where applicable)
• Data controller: Code Discoveries is the data controller for personal data collected through the Service
• Rights: You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data
• Data transfers: Your data may be transferred to and processed in the United States where our servers and third-party services are located. We rely on standard contractual clauses and the data processing agreements of our service providers for such transfers
• DPO: For privacy-related inquiries, contact us at the email address listed below

9. CCPA Compliance (California Users)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to delete: You may request deletion of personal information we have collected, subject to certain exceptions
• Right to opt out of sale: We do not sell personal information. No opt-out is necessary
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your privacy rights, please contact us:

• Website: codediscoveries.com
• Service: callably.co