Introduction

This Privacy Policy explains how Callshift ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our Service. It also informs you of your rights regarding your personal data and how to exercise them.

Data Collected

1. Personal Data

We may ask you to provide certain personally identifiable information ("Personal Data") that can be used to contact or identify you. This may include but is not limited to:

• First and Last Name
• Email Address
• Phone Number
• Company Name

2. Third-Party Integrations

When you connect third-party services (e.g., Google, Twilio, Salesforce, Hubspot, Shopify) through Callshift, we may collect information related to these integrations, such as:

• Credentialing information to facilitate the connection
• Data transferred as part of the service (e.g., calendar bookings, phone call information, SMS notifications)

3. Usage Data

We may collect technical information about your interaction with our Service, such as:

• IP Address
• Device IDs or other unique identifiers
• Browser and device type
• Cookie information
• Pages or features accessed

4. Telephony Data

When using telephony services via Callshift, we may collect call records, including:

• Call times and durations
• Phone numbers involved
• Audio recordings of the call, where recording is enabled
• Transcriptions of the conversation generated by automated speech recognition
• Information provided by the caller during the conversation, as required by the business process being handled

Where Callshift operates a voice service on behalf of a business customer, that customer is the data controller for the call data described above, and Callshift acts as a data processor on their documented instructions. Informing callers that the call is handled by an AI system and, where required, obtaining their consent to recording, is the responsibility of that customer.

How We Use Your Data

We may use the data we collect for various purposes, including but not limited to:

• Providing and maintaining our Service
• Notifying you of changes to our Service
• Providing customer support
• Monitoring and analyzing Service usage
• Detecting and resolving technical issues
• Offering services like calendar bookings, notifications, and telephony features
• Fulfilling any other purpose for which you provide the data
• Other uses with your consent

Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Typically, this period does not exceed 24 months unless legal obligations dictate otherwise.

Audio recordings of calls are retained for 90 days and then deleted automatically. Business customers may configure a shorter retention period for their own account.

Data Use and AI Training

Callshift's use of information received from Google APIs adheres to Google's API Services User Data Policy, including Limited Use requirements. We do not use your data for the development or training of artificial intelligence (AI) or machine learning (ML) models, nor do we share data with third-party AI models for these purposes.

This commitment is contractually imposed on the providers in our processing chain, which are not permitted to use data transmitted through the Service to train their own models. Only anonymized and aggregated technical data, such as latency and error rates, is used to measure platform performance. Should we ever consider processing customer data for AI development, it would be the subject of a separate and formal request, and would not take place without prior agreement.

Data Sharing and Disclosure

• Service Providers: We may engage third-party service providers to assist in delivering our Service. These providers have access to your Personal Data only to perform tasks on our behalf and are obligated not to use it for other purposes.
• Infrastructure and Voice Processing: Our hosting, storage, database and real-time voice processing providers are located within the European Union, in France and Germany. The AI models used during calls are orchestrated through our voice processing provider within the European Union.
• Payment Processing: Callshift is a paid service, and we use Stripe for payment processing. We do not store your payment card information. Stripe's Privacy Policy is available at: Stripe Privacy Policy.
• Authentication Processing: We use Clerk for secure authentication services. Clerk's Privacy Policy can be found here: Clerk Privacy Policy.
• No Sale of Data: We do not sell or license your Personal Data to third parties.
• Meeting Scheduling: We do not share attendee email addresses with third parties except as necessary to schedule meetings.

Data Security

We implement robust security measures to protect your data:

• Encryption of sensitive data in transit and at rest
• Restricted access to Personal Data, limited to authorized personnel only
• Adherence to industry-standard security practices

International Data Transfers

Call data, including audio recordings, transcriptions and call metadata, is hosted and processed exclusively within the European Union and is not transferred outside the European Economic Area.

We may transfer your Personal Data to countries outside your own for processing. When transferring data out of the EEA, UK, or other jurisdictions with data transfer restrictions, we ensure compliance with applicable laws, such as incorporating EU Standard Contractual Clauses in signed Data Processing Agreement or equivalent safeguards. Such transfers concern account, authentication and billing data only, and do not concern call data.

Your Data Protection Rights (GDPR)

If you are a resident of the EU/EEA, under the General Data Protection Regulation (GDPR), you have the following rights:

• Right to Access: Request a copy of the data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your Personal Data, subject to certain exceptions.
• Right to Restrict Processing: Request limitation on how we process your data.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw consent where it forms the basis of our data processing.

To exercise these rights, contact us at dpo@callshift.ai. We may require identity verification before fulfilling requests.

If your request concerns a call handled by Callshift on behalf of a business customer, we will forward it without delay to that customer, who is the data controller for that call.

If you have concerns about our data practices, you have the right to lodge a complaint with a Data Protection Authority in your region.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will notify you by posting the updated policy on this page and informing you via email or through a notice on our Service, where appropriate. We encourage you to review this policy periodically for the latest information.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact our Data Protection Officer (DPO) at dpo@callshift.ai.

‍