Privacy notice

1. Who we are

Smitline Cloud is provided by [LEGAL NAME], operating as Kaelor Labs (“we”, “us”), [ADDRESS], Canada. We are responsible for the personal information described here. Our privacy officer is Ankit Luthra, at [email protected].

This notice covers the people who use Smitline, and the people Smitline speaks with on their behalf. The open-source Smitline engine you run yourself sends us nothing; this notice doesn’t apply to it.

2. What we collect

From you, when you use Smitline:

• Account: your email address, the name Smitline uses for you on calls, your phone number once verified, and your settings (voice, calling hours, spending limits, notification webhook).
• Sign-in: a sign-in link, valid 15 minutes; and a session, stored only as a scrambled (hashed) value with your browser’s description so you can see where you’re signed in. API keys and connected-app tokens are also stored only hashed.
• Payments: Stripe handles your card; we never receive the full number. We keep the Stripe customer and card identifiers, the card brand and last four digits, your top-ups, receipts and charges, and your wallet history.
• Calls and meetings: the briefs you or your agent give (who to call, why, and any context), the profile and contacts you add, the numbers called and calling in, live transcripts, summaries, results, notes carried between calls, your do-not-call list, and call times, lengths and charges. Audio is recorded only when you ask for a recording on a call; meeting audio is never recorded.
• Technical: your IP address, used to limit abuse of sign-in and other actions (stored scrambled, for up to 2 days). Our hosting provider’s load balancer logs each request, including the IP address and web address.
• Messages with us: what you send to our support or privacy addresses.

If you ask for early access: your email address, your answer to “First thing I’d ask you to do” if you give one, the country your request came from (as our network provider reports it), and when you asked. We use them to send your invite, to decide whom to invite first, and to ask about your answer if we need to. We don’t add you to a newsletter.

About other people, from you: a brief, your profile or your contacts may name other people and include their phone numbers or details. Only give Smitline what the task needs.

3. If Smitline called you or joined your meeting

Smitline is an AI assistant that calls people and joins meetings for its users. When it does, it says on whose behalf it is calling, and that it is an AI assistant. During the call or meeting we process:

• your phone number;
• what you say, which is turned into a transcript and a summary for the Smitline user;
• the audio of the call, but only if the user asked for a recording. Smitline says at the start of such calls that they are recorded.

The Smitline user decides why they call you and what happens with the result. Ask them first about the call itself.

If you tell Smitline not to call again, your number goes on that user’s do-not-call list, and Smitline won’t call you for them again. To stop calls from every Smitline user, email [email protected] with your number; we’ll block it across Smitline. You can also ask us what we hold about you, and to delete it (section 8).

4. How we use it

We use personal information to:

• provide the Service: place calls, join meetings, produce transcripts and summaries, and pass results to you, your agent and your webhook;
• take payment, keep your wallet and meet tax and accounting rules;
• keep the Service and other people safe: verify accounts, apply limits and calling hours, block emergency and premium numbers, and prevent fraud and abuse. To investigate abuse, our staff may review the calls involved;
• support you when you ask, and send the emails the Service needs: sign-in links, low-balance warnings and phone-number billing notices. We don’t send marketing emails without your consent;
• comply with the law and enforce our terms.

We don’t sell or rent personal information, and we don’t use it for advertising. We don’t use the content of your calls and meetings to train AI models, and our AI provider doesn’t either (section 5).

We rely on your consent, which you give when you use the Service, and on what is needed to provide the Service and meet our legal duties. You can withdraw consent by closing your account. Some processing must continue to complete calls already started, or to meet legal duties.

5. Who we share it with

These service providers process personal information for us, under contracts that limit their use of it to providing their service to us:

• Google Cloud (United States): hosting, database, call records and logs.
• OpenAI (United States): the voice and language models. It receives call and meeting audio, briefs, profiles and transcripts. Under its terms for business API customers, OpenAI doesn’t use this data to train its models and keeps it for a limited time for abuse monitoring. [Verify the period and our settings before launch.]
• SignalWire (United States): the phone network, phone numbers, verification text messages, and call recordings when you ask for one.
• Stripe (United States and Canada): payments.
• Resend, later Amazon Web Services (United States): sending our emails.
• Cloudflare (global network; the early-access list is stored in North America): our public website, domain names, and the early-access list.
• Zoho ([country to verify]): our support and privacy mailboxes.

We also share information:

• at your direction: with the AI agent you connect (for example Claude or ChatGPT, under that company’s own privacy terms), your webhook, and the people and meetings Smitline talks to for you. Zoom, Microsoft Teams and Google Meet process meetings under the host’s arrangements with them;
• when the law requires it: for example to answer a valid court order, or to protect someone from serious harm;
• if our business is sold or merged: we’d require the buyer to protect it as this notice does.

6. Where it is processed

We are in Canada, and our main systems are in the United States (Google Cloud, Iowa). Personal information may therefore be processed in the United States, and in other countries where our providers work, and may be accessible to authorities there under local law. We choose providers that protect it to a standard comparable to Canadian law, and assess these transfers as Quebec law requires.

7. How long we keep it

• Account, settings, calls and meetings (briefs, transcripts, summaries, recordings, profile, contacts, notes): while your account is open, until you ask us to delete them. Deleted within 30 days after your account closes.
• Early-access requests: until you accept your invite and create an account, or 12 months after your last request, whichever comes first.
• Payments and wallet history: as long as tax and accounting laws require, usually 7 years.
• Do-not-call requests: as long as needed to honour them.
• Sign-in: links expire after 15 minutes; sessions end 30 days after your last visit; phone verification codes expire after 10 minutes and are deleted within 30 days.
• Abuse-prevention data: scrambled IP addresses after 2 days; request logs after 30 days.
• Backups: deleted information can stay in encrypted backups for up to 14 days.

We may keep information longer when the law requires it, or to deal with a dispute, fraud or abuse.

8. Your rights and choices

You can ask us to:

• tell you what personal information we hold about you, and give you a copy, in a structured, commonly used format where the law gives you that right;
• correct it;
• delete it;
• stop calls to your number.

You can also withdraw your consent, and, where the law gives you these rights, object to or limit some uses. You can change most account details in the dashboard. For anything else, email [email protected]. We’ll confirm who you are, then reply within 30 days. We won’t treat you differently for using your rights. Some requests we can’t fully meet, for example when the law requires us to keep billing records.

9. Security

We protect personal information with:

• encryption in transit;
• hashed credentials, keys and sessions;
• access limited to the people and systems that need it;
• logs that don’t record sign-in tokens or phone numbers in our own services.

No system is perfectly secure. If a breach creates a real risk of significant harm, we’ll tell you and the regulators as the law requires.

10. Cookies

The dashboard uses two cookies, both strictly necessary:

• one keeps you signed in, for up to 30 days;
• one protects your forms against cross-site attacks, and ends when you close the browser.

We don’t use analytics, advertising or third-party tracking cookies, and our pages load nothing from other companies.

11. Children

Smitline is for adults only. We don’t knowingly collect information from anyone under 18. If you believe a child has used Smitline, tell us, and we’ll delete their information.

12. Changes

If we change this notice in a way that matters, we’ll email you before the change takes effect and update the date at the top.

13. Contact and complaints

Write to our privacy officer, Ankit Luthra, at [email protected], or by mail to [LEGAL NAME], Attn: Privacy Officer, [ADDRESS].

If we can’t resolve a concern, you can complain to a privacy regulator:

• in Canada, the Office of the Privacy Commissioner of Canada (opens in a new tab);
• in Quebec, the Commission d’accès à l’information (opens in a new tab);
• in the United States, the regulator of your state.