Privacy Policy

1. Who we are and what this policy covers

XALLER AI, a trade name of ZPEACHY LLC ("Xaller.ai", "we", "us"), operates xaller.ai and the Xaller.ai service, an AI phone receptionist for businesses. You can contact us about privacy at [email protected].

This policy explains how we handle personal information about:

• visitors to our website and people who request a demo or contact us;
• customers: the businesses that use Xaller.ai and the people who use their accounts (owners, administrators and team members);
• callers: people who call a business that uses Xaller.ai to answer its phone.

We play two roles:

• Service provider (processor). For call recordings, transcripts, caller details and summaries, and the information a business adds to its account, we act on that business's behalf and under its instructions, as set out in our Terms of Service and Data Processing Addendum. The business decides how it uses that information. If you called a business and have a question about your information, contact that business; we will help it respond.
• Controller. We decide how we use visitor, demo-request and customer-account information. We also use a limited part of call information for our own purposes that service providers are allowed to have: protecting the Service (for example rate limits and blocking abusive callers), billing (call times and minutes used), meeting legal obligations and producing de-identified statistics. Section 4 describes these uses.

2. Our privacy commitments

• We do not sell personal information or share it for targeted advertising.
• We do not use call recordings, transcripts or caller information to train generally available AI models, and our AI providers' terms do not allow them to do so.
• Every call answered by Xaller.ai starts with a fixed notice that the caller is speaking with an AI assistant and that the call is recorded. The notice states no purpose for the recording, and the agent never claims to be human. A caller who does not want to be recorded is offered another way to reach the business, and the agent ends the call without taking their details.
• Recordings, transcripts, caller details and summaries are deleted automatically at the end of the business's retention period. Section 6 explains what is kept after that.
• We collect what we need for the purposes below and restrict access to people who need it.

3. Information we collect

Website visitors, demo requests and contact

• Demo requests: your name, business name, email address, whether your business handles healthcare data, and your contact permission. A phone number, business address and the software you use or want us to integrate with are optional.
• Permission records: the permission wording, the agreement version and its document hash, when you gave permission, and any later withdrawal. We keep a keyed, one-way representation of your email address to detect duplicate sign-ups and honor an opt-out.
• Contact inquiries and correspondence: the name, email address, business name, optional phone number and message you send through the contact form, and emails you send us. Inquiries are delivered to our team inbox.
• Technical information: when your browser connects, our hosting and network providers receive your IP address, browser and device characteristics, the pages requested and security signals. We use these to serve pages, prevent abuse and diagnose failures. Rate limits use hashed identifiers, and we do not add your IP address to your demo request record.

Please do not send patient information, payment-card details, government identification numbers or passwords through our forms. Website analytics and the invisible security check on public forms are described in section 8.

Customer accounts

• Account and profile: name, email address, business name, industry, time zone, business phone number, address, and whether the business handles healthcare information.
• Sign-in and security: password-verification data (never your readable password), two-step verification data, Google sign-in identifiers if you use Google, session and device records (including IP address and browser details), and audit records of sensitive actions.
• Team members: the names, email addresses and roles of people the owner invites.
• Notification recipients: email addresses and US mobile numbers added to receive call notifications, the consent wording shown when a number was added, when it was verified, and its STOP/START status.
• Agent configuration and knowledge: greetings, instructions, FAQs, hours, prices, documents and website content you give your agent, and information from tools you connect for that purpose.
• Billing: plan, subscription status, invoices and usage. Card details are collected and stored by our payment processor; we receive only limited details such as card brand, last four digits and expiry.
• Support and communications: messages you send us and our replies, conversations with the in-app support assistant, and your email preferences.

Callers

When a business uses Xaller.ai to answer its calls, we process on that business's behalf:

• Call details: the caller's phone number and caller ID name, the number called, date, time and duration, and call outcome.
• Recordings and transcripts: audio of the call and a written transcript.
• Information the caller gives: such as name, callback number, email, address, the reason for calling, and answers to questions the business configured.
• Summaries and analysis: an AI-generated summary, the next step, urgency flags and similar labels.

Businesses must not configure their agent to collect payment-card numbers, government identifiers or, unless healthcare mode and a Business Associate Agreement are in place, health information.

4. How we use information

• To provide the Service: answering calls, recording and transcribing them, producing summaries, sending notifications, routing transfers and messages, and syncing with connected tools.
• To run accounts: creating and securing accounts, managing team access and roles, onboarding, and providing support.
• For billing: charging subscriptions and usage, applying trials and discounts, and handling refunds and disputes.
• To keep the Service safe and reliable: detecting abuse, spam and fraud, rate-limiting and blocking unwanted callers, investigating incidents, monitoring quality and diagnosing errors.
• To improve the Service: for example, reviewing a call a customer flags, or measuring performance with aggregated or de-identified data. Staff access to call content is limited to supporting the customer or securing the Service and is logged.
• To communicate with customers: service, billing, security and product emails. You can unsubscribe from product and marketing emails; essential service and billing messages continue while you have an account.
• To meet legal obligations and to establish or defend legal claims.

We use caller information to provide the Service to the business that received the call. Our own uses are limited to protecting the Service (for example a keyed hash of the caller's number for rate limits and blocklists), billing from call times and minutes, legal compliance, and de-identified statistics that do not identify callers or businesses. We do not use caller information to market to callers or build profiles of them.

AI processing. Speech recognition, conversation, summaries and analysis are performed by AI models operated by our providers under agreements that restrict how they may use the data. The AI can make mistakes; customers review summaries before acting on them. We do not make decisions about callers that produce legal or similarly significant effects; the business decides how to respond to each call.

5. When information is disclosed

• To the business that received a call: caller information is delivered to the customer's account and to the destinations it sets up: email, text message and Slack notifications, signed webhooks to its own systems, and connected tools such as a calendar or CRM.
• To service providers (subprocessors) that host the Service, carry calls, run the AI models, deliver email and text messages, process payments and protect the website. They process the information to provide their services to us under contracts with data-protection terms. Some also process limited information for their own purposes allowed by those terms, such as security, fraud and abuse prevention, billing and legal compliance. Our subprocessor list names them and describes these purposes.
• To integrations a customer connects: when a customer connects third-party software, we send it the information that integration needs. The customer's agreement with that provider governs it.
• For legal reasons: when required by law or valid legal process, or when reasonably necessary to protect people, investigate abuse, enforce our agreements or defend legal claims. Where permitted, we tell the affected customer before disclosing its data.
• In a business transfer: if the business is reorganized or acquired, information can transfer under protections consistent with this policy, with notice of material changes.

None of these disclosures includes sharing mobile numbers or text-message opt-in data and consent for anyone's marketing; section 10 describes how they are handled.

6. How long we keep information

Information	Retention
Call recordings, transcripts, captured caller details (such as name, number and reason), AI summaries and analysis, and call-quality notes	Deleted automatically after the customer's plan retention period: 30, 90 or 365 days after each call (at most 90 days in healthcare mode). Customers cannot yet delete individual calls in the app; the account owner can ask us to delete specific calls sooner (section 9).
Call record kept after that deletion	A record without caller details or content: when the call happened, how long it lasted, the number it reached, its outcome category and AI-assigned labels (urgency, sentiment, language and how the call ended), whether follow-up was handled and by whom, and the minutes used. Kept for the life of the account for billing and usage history, then deleted 3 years after the account is closed, or 7 years where it forms part of billing records.
Copies outside our systems	Notifications already delivered (email, text messages, Slack) and data sent to webhooks or connected tools are held by the customer and those providers under their own retention. Our deletion does not reach them.
Knowledge documents and agent configuration	While the account is open. Uploaded knowledge documents are deleted 30 days after the account is closed; agent configuration is kept with the account records.
Notification recipients and text-message consent records	While the recipient is on the account; then kept with the account records (deleted or de-identified 3 years after closure) to show consent and honor opt-outs. Notification delivery logs are deleted after 30 days.
Support-assistant conversations and in-app support requests	Deleted 90 days after they start.
Account, profile and team-member records	While the account is open. After closure, the agent stops at once and call content and knowledge documents are deleted after 30 days; the account and user records are kept, without that content, for billing, security and legal purposes, and deleted or de-identified 3 years after closure.
Data exports	The account owner can request one export a day. We email a download link that works for 24 hours, and delete the export file after 7 days.
Billing records and invoices	7 years, for tax and accounting.
Security and audit records	2 years, or longer while a legal hold applies.
Demo request and contact information	Active demo request contact details are removed after 12 months without an interaction you start, or sooner when you withdraw. Limited consent evidence and a suppression identifier are kept only as needed to honor an opt-out or defend a legal claim, and reviewed yearly. Inquiry correspondence is kept for 12 months.
Encrypted backups	Expire on a rolling schedule within about 30 days; deletion from the live service reaches backups when they expire.

We keep limited information longer when a law requires it or to resolve disputes, and never use it for unrelated purposes.

7. Security

We encrypt connections, encrypt recordings, transcripts and caller details at rest, keep production access restricted and audited, require two-step verification for staff, and separate customer accounts so one business cannot see another's calls. Every user can turn on two-step verification for their own sign-in. No system is perfectly secure; if an incident affects personal information, we will investigate and notify affected customers and individuals as the law requires. Read more on our security page.

8. Cookies and similar technologies

We use only what the website and app need: session and anti-forgery cookies for sign-in, browser storage for preferences such as pricing answers, and an invisible security check (Cloudflare Turnstile) on public forms. If we use website analytics, they are cookieless, count page views without identifying you and do not track you across sites; our early-access website currently uses none. We do not use advertising pixels or session-replay tools, and the signed-in app loads no analytics. We do not change essential processing for Do Not Track signals, and because we do not sell or share personal information for advertising, browser opt-out signals such as Global Privacy Control have nothing further to opt out of.

9. Your choices and rights

Customers and team members can see and update account information and notification settings in the app, and unsubscribe from product emails. The account owner can export the account's data and close the account. To have specific calls deleted before the end of the retention period, the owner can email [email protected] and we will delete them within 10 business days.

People who request a demo can withdraw their request at any time by replying to a team email, telling a team member during a call, or emailing [email protected]. We stop outreach, remove the contact details and keep only what we need to honor the request. Requesting a demo does not permit marketing texts or automated marketing calls.

Anyone can ask to access, correct or delete personal information we hold as a controller, or ask for a portable copy, where applicable law provides those rights. Email [email protected]. We verify requests proportionately, respond within legal deadlines, explain any refusal and offer an appeal where the law provides one. We do not discriminate against anyone for exercising privacy rights.

Callers should contact the business they called. When a business asks us to help with a caller's request, we assist as its service provider.

State privacy rights. Depending on where you live, state law (for example in California, Colorado, Connecticut, Texas, Virginia and other states) may give you the right to know what personal information we hold and how we use it, to access, correct or delete it, to obtain a portable copy, and to opt out of sale, targeted advertising and certain profiling. We do not sell personal information, share it for targeted advertising or use it for profiling with legal or similarly significant effects. We do not use sensitive personal information to infer characteristics about you. You or an authorized agent can make a request at [email protected]; if we deny it, you can appeal by replying to our decision, and if the appeal is denied you can contact your state attorney general.

California notice. In the past 12 months we collected these categories of personal information: identifiers (such as name, email address, phone number, IP address and account identifiers); customer records and commercial information (business details, plan, billing and usage); internet or network activity (technical and security information); audio and electronic information (call recordings and transcripts, processed for our customers); and professional information (business name and role). We collect them from you, your business and team, callers to our customers, your browser or device, and service providers. We use them for the purposes in section 4, disclose them for business purposes to the recipients in section 5, and keep them as described in section 6. The only sensitive personal information we collect for our own purposes is account sign-in credentials, used only to authenticate you. We have not sold or shared personal information, and we do not knowingly sell or share the personal information of anyone under 16.

10. Text messages

If a business using Xaller.ai adds your mobile number to receive call notification texts, you confirm the number with a one-time code and agree to receive those texts. We use the number and your consent only to send those notifications and to honor STOP, START and HELP requests. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third parties, except the mobile carriers and the text-message provider that deliver the messages (currently Twilio), which may also use them for their own fraud-prevention and legal-compliance purposes. Message frequency depends on call volume; message and data rates may apply. Reply STOP to opt out, START to resume or HELP for help, or contact [email protected].

11. Children

The Service is for businesses and is not directed to children. Account holders must be 18 or older. Businesses that receive calls from children are responsible for handling those calls lawfully. If you believe a child has given us information through our website, contact us and we will delete it.

12. Location of processing

The Service is intended for businesses in the United States, and we store customer data in the United States. Our team mailbox, which holds correspondence you send us, is hosted in Switzerland. Some providers can process data in other countries for their services; where the law requires safeguards for those transfers, we put them in place.

13. Changes to this policy

We will post updates with a new version number and effective date, keep earlier versions available, and give customers advance notice of material changes by email or in the app.

14. Contact

XALLER AI, a trade name of ZPEACHY LLC - 5900 Balcones Drive STE 100, Austin, TX 78731, USA - [email protected]