Privacy Policy

This Privacy Policy describes how Callwrap (“Callwrap”, “we”, “us” or “our”) collects, uses, discloses and safeguards personal data when you visit our website, create an account, or use our applications and services (together, the “Service”). It also explains your privacy rights and how the law protects you.

For most personal data relating to your own account, Callwrap acts as a data controller. For the call audio, transcripts and related content you capture using the Service, you (or your organization) are the controller and Callwrap acts as a data processor, processing that content on your instructions to provide the Service. See Section 12 for more on your responsibilities.

By using the Service you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Service.

• Personal data — any information relating to an identified or identifiable individual.
• Processing — any operation performed on personal data, such as collection, storage, use, disclosure or deletion.
• Controller — the party that determines the purposes and means of processing.
• Processor — a party that processes personal data on behalf of a controller.
• Sub-processor — a third party engaged by a processor to help deliver the Service.

We collect the following categories of information, depending on how you use the Service:

• Account information that you provide, such as your name, email address, password (stored only in hashed form by our authentication provider), company name, profile photo and language preferences.
• Call recordings and transcripts — when you start a recording, we capture the audio you choose to share (your microphone and the audio of the browser tab you select), and we generate a transcript with speakers separated.
• AI-generated content derived from your transcripts, such as call titles, detected participant names, follow-up emails, action items, objections, sentiment and other insights.
• Content you create — templates, dictionary terms, tasks, and feature requests.
• Usage and device data — basic analytics such as call counts, feature usage, log data, approximate location derived from IP, browser type and similar technical information used to operate and secure the Service.
• Billing information — your subscription status and a customer identifier from our payment processor. Card details are entered directly with the processor; we never receive or store full card numbers.

We use personal data to:

• Provide, maintain, secure and improve the Service.
• Transcribe your calls and generate follow-up emails, tasks and insights at your request.
• Authenticate you, manage your account and remember your settings.
• Process payments, manage subscriptions and prevent fraud.
• Send you service and transactional messages, respond to support requests, and notify you of important changes.
• Monitor usage to understand product performance and fix problems.
• Comply with legal obligations and enforce our terms.

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:

• Contract — to provide the Service you have signed up for.
• Legitimate interests — to secure, analyze and improve the Service, where not overridden by your rights.
• Consent — where required, for example certain optional communications; you can withdraw consent at any time.
• Legal obligation — to comply with applicable laws.

Transcription and AI generation are carried out by trusted sub-processors acting on our instructions. When Privacy Mode is enabled, your call data is not used to train or improve any AI models, whether by us or by our providers. We do not sell your personal data, and we do not use the content of your calls for advertising.

We share personal data only as described below, and we require our providers to protect it under written agreements:

• Sub-processors who power core features: Supabase (authentication, database and file storage), Deepgram (speech-to-text transcription), Anthropic (AI generation), and Stripe (subscription billing and payments).
• Professional advisers such as auditors and lawyers, where necessary.
• Legal and safety reasons — to comply with law, respond to lawful requests, or protect the rights, property or safety of Callwrap, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

We never sell your personal data to third parties.

Our providers may process data in countries other than your own, including the United States. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.

We retain your personal data for as long as your account is active or as needed to provide the Service. You can delete individual calls, follow-ups, tasks, templates and dictionary terms at any time, and you can delete all of your data from Settings. When you delete data it is removed from our active systems; residual copies in routine backups are overwritten on a rolling schedule. We may retain limited information where required to comply with legal obligations, resolve disputes or enforce our agreements.

We implement technical and organizational measures designed to protect personal data, including encryption in transit, row-level access controls so that each user can only access their own data, restricted and least-privilege access for our team, and regular review of our providers. No system can be guaranteed completely secure, but we work continuously to protect your information and will notify you and the relevant authorities of a data breach where required by law.

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

You can exercise most of these directly in the app, or by contacting us. We will respond within the time required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have rights under the CCPA/CPRA, including to know, delete and opt out of any “sale” or “sharing” of personal information — note that we do not sell or share personal information as those terms are defined.

When you record and transcribe calls, the other participants' personal data is processed on your behalf, and you act as the controller of that data. You are solely responsible for having a lawful basis to record and for obtaining any consent or providing any notice required in the relevant jurisdictions. Callwrap processes that content only to provide the Service to you.

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences (such as language and recording settings), and operate the Service. We do not use cookies for third-party advertising. You can control cookies through your browser settings, though some features may not work without them.

The Service is intended for business users and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

The Service may link to third-party websites or services that we do not control. This policy does not apply to those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the “last updated” date above, and for material changes we will provide additional notice through the app or by email. Your continued use of the Service after an update means you accept the revised policy.

If you have questions about this policy or wish to exercise your rights, contact us at privacy@callwrap.app.