Privacy Policy
This policy covers three separate things: our own website, the accounts and client portal behind sign-in, and the phone service we run for the businesses that hire us. It is written in plain English. If anything here is unclear, email privacy@callwright.ai and we will explain it.
1. Who We Are
Callwright sells AI phone-answering and follow-up systems to local service businesses — plumbers, electricians, HVAC contractors and trades like them — in Arizona, in the United States. Our products are called Install (we switch on and configure the answering feature in the software a business already uses), Answer (our own AI assistant picks up the calls a business misses) and Follow-up (outbound follow-up, which we do not offer yet).
Callwright is an Arizona business run by its founders. It is not yet a limited liability company; that happens when we take on our first paying client. For our website and for the accounts on it, we decide what is collected and why. For the calls we handle on a client's phone line, the client decides and we act on their instructions — see section 4 and our Data Processing Addendum.
2. Our Website
The contact form is the only place this website asks you for anything. It collects your name, your email address, your message, and — if you choose to fill them in — your business name and your phone number.
We use it to answer you, and for nothing else. Your enquiry is stored in our database, which is hosted by Neon (serverless Postgres) in the United States. A copy is emailed to the founders through Resend, our email provider, also in the United States. We send you an acknowledgement email so you know it arrived.
We keep an enquiry until we have answered it, and for as long as we still need it to follow up on the conversation it started. Ask us to delete it and we will.
We use no analytics, no advertising, no tracking pixels and no third-party scripts. The site does not follow you anywhere. It is hosted by Vercel in the United States. The only cookies it sets are the ones sign-in and form security need, listed in our Cookie Policy.
3. Accounts and the Client Portal
Staff and clients can sign in, either with Google or with an email address and a password. If you sign in with Google, Google sends us your name, email address and profile picture. If you use a password, we store only a hash of it (bcrypt) — we never see or keep the password itself. Your role on the account decides what you are allowed to see.
The portal holds messages between us and a client, and any files attached to them. Attachments are stored in Vercel Blob, in the United States. Session cookies keep you signed in; the Cookie Policy names each one.
4. The Phone Service
This section has two readers. Read the part that applies to you.
If you are a business using Callwright
We hold your business details, the settings you give us (how calls should be handled, your numbers, who to reach in an emergency, the email address that receives call summaries) and, where you connect your scheduling software, the credentials for that connection, which are stored encrypted.
For each call we store:
- the caller's phone number;
- the transcript of the conversation;
- what the call was about, and what was booked or requested; and
- a link to the recording — only if you have turned recording on. The recording itself is held by Retell, the voice platform we run on.
Recordings and transcripts are deleted after 90 days by default. Ask and we will keep them for less time, or not record at all.
After a call that needs a person — a booking, an emergency, or a caller who asks for a human — we email you a summary. Where you have connected your scheduling software, a booking can also be pushed into your account there.
You decide whether your line records. Arizona allows a call to be recorded with one party's consent, and the assistant says in its first sentence that it is an AI assistant and, where recording is on, that the call is recorded. We do not remove either sentence.
If you called a business that uses Callwright
You called that business, not us. The business decides what is collected and how long it is kept; in data protection terms it is the controller and we are its processor. Ask that business for a copy of your data, or to have it deleted. You can also email privacy@callwright.ai; we will pass the request to them and act on their instruction.
Your call may be answered by an AI assistant, which says so in its first sentence and tells you if the call is recorded. The audio is handled by Retell AI in the United States, which runs the conversation using a large language model from a third-party provider selected through Retell — today that is OpenAI's GPT-4.1, and it may change. Test calls made from a web browser use LiveKit, in the United States, to carry the audio.
We store your phone number, the transcript, what the call was about and what was booked or requested, plus a link to the recording if that business records its calls.
5. The Companies That Handle Data for Us
A small number of providers process data on our behalf: hosting, database, email delivery, the voice platform and the model behind it, sign-in, and a client's own scheduling software where they have connected it. Each one is named, with its role and location, in our Data Processing Addendum. All of them are in the United States.
6. Your Rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, and ask us to delete it. Email privacy@callwright.ai and we will reply.
We are a United States business and we do not claim to comply with the GDPR. We honour requests to see, correct or delete personal data from anyone who asks, wherever they are. Where the data belongs to a call we handled for a client, contact that business first — the request is theirs to decide.
7. Security
Traffic to our site and our systems is encrypted in transit (TLS). Passwords are stored as bcrypt hashes. Credentials for a client's connected software are encrypted with AES-256-GCM before they are stored. Access is limited by role. Requests from the voice platform are checked against a signature before we accept them.
We take no payments online and never hold card details. No system is perfectly secure, and we do not claim ours is.
8. Children
We sell to businesses. Our website and our services are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe we have, tell us at privacy@callwright.ai and we will delete it.
9. Changes to This Policy
We will update this page when what we do changes, and change the "Last updated" date at the top. The version on this page is always the current one.
10. Contact Us
General enquiries: hello@callwright.ai. Anything about privacy or your data: privacy@callwright.ai.