PRIVACY POLICY
What we hold,
and why.
1. Two kinds of people
Customers are the businesses that subscribe and the people who use their workspace. We decide how their account data is handled. Callers are the people who phone a customer's number. We process caller data on the customer's instructions, as their service provider; the business you called is responsible for how that data is used, and you can contact it directly about your call.
2. What we collect
| Data | Source | Why |
|---|---|---|
| Name, email and sign-in identity of workspace users | You, on sign-up and invitation | Run your account, authenticate you, send service notices |
| Which button on this site you used to sign up, such as "home-hero" (no page history) | The sign-up link, kept in your browser until setup, then saved with your workspace | Learn which pages bring new workspaces |
| Business details, assistant configuration, greetings, rules and fallback numbers | You, in the workspace | Answer calls the way you configured |
| Carrier account credentials for Telnyx or Twilio | You, in the workspace | Answer and transfer calls on your number and send the codes that verify test numbers; stored encrypted |
| Phone numbers your team registers for test calls | You, in the workspace | Keep test calls unbilled. A number a member adds for themselves is verified by a one-time code, sent from a number on your own carrier account |
| Caller phone number, call time and duration, the call recording, the conversation transcript, and a summary with the caller's request, location and callback number | The call | Deliver the call outcome to you by workspace and email, meter usage and, unless you switch it off, tell the assistant about the caller's earlier calls to your business |
| If you connect Cal.com: your Cal.com API key (stored encrypted), your event types and open times, and the appointments the assistant creates in your account, with the caller's name, phone number and the service | You, in the workspace, and Cal.com | Offer callers the open times in your Cal.com account and create their appointment there, on your instruction |
| Plan, subscription status and your PayPal payer ID | PayPal | Bill you. To start checkout we give PayPal your workspace email address. PayPal collects your name, email address and payment details; we never see or store card numbers |
| Support emails | You | Answer your question and keep a record of it |
During a call, the caller's audio is streamed to Deepgram to be transcribed. The transcript goes to a language model through OpenRouter to write each reply, and Deepgram turns the reply into speech. After the call, Google Cloud's Vertex AI reads the transcript to write the summary and the job sheet. When a customer has connected Cal.com, the open times (dates and times only) are also given to the language model so the assistant can offer them to the caller.
Our default greeting tells callers they are speaking with an AI assistant and that the call may be recorded. Call recording is on by default and customers can switch it off for each assistant. Customers can change the greeting, and the business is responsible for any notice or consent the law requires. When enabled, we save call audio in private, encrypted storage. Recordings are available to that workspace for 90 days, then expire and are scheduled for deletion.
We do not use your data, or your callers' data, to train AI models; our speech provider is opted out of model training and our language-model router excludes hosts that keep or train on prompts.
3. Who processes it for us
We use these providers, each under its own contract and security commitments, and each only for the purpose listed:
- netcup (Manassas, Virginia, United States): the server that runs live calls
- Google Cloud (United States): the workspace and its API, the standby server for live calls, and Vertex AI, which writes the post-call summary and job sheet
- Deepgram (United States): speech recognition and speech synthesis
- OpenRouter: routes each turn of the conversation to the language model, at model hosts that do not keep or train on prompts
- Supabase (United States): the customer database
- Google Firebase: sign-in for the workspace
- Cloudflare: serving this website, counting its page views without cookies, and storing and delivering call recordings
- Grafana Cloud (United States): health metrics for the call server, with no call content or personal data
- PayPal Pte. Ltd. (Singapore): checkout and payment. PayPal receives your name, email address and payment details; we receive your subscription status and PayPal payer ID
- Cal.com, only if the customer connects it: receives the caller's name and phone number to create the appointment in the customer's own Cal.com account. We call it with the customer's API key, and we do not use it for healthcare workspaces
- Telnyx or Twilio: the phone call itself. Today it runs on the carrier account you connect, under your account
Our servers and most providers are in the United States. Some data may be processed outside the United States: OpenRouter may route a turn to a model host in another country, email is sent through a mail server in Germany, and we operate the service from the Philippines. Where a transfer needs a safeguard, we rely on the provider's contractual safeguards. We do not sell personal data and we do not share it with advertisers.
4. How long we keep it
- Call transcripts and summaries: 90 days, then deleted.
- Call recordings: 90 days, then they expire and are deleted.
- Caller name and number on appointment records: 90 days, then cleared.
- Account, configuration and usage records: for the life of the subscription and up to 90 days after it ends, unless the law requires longer for accounting.
- Support emails: two years.
- Website contact enquiries: until answered, then up to one year.
5. This website
This site, onanswer247.com, sets no analytics or advertising cookies and stores nothing in your browser. When you follow a sign-up button, the workspace app at app.onanswer247.com keeps that button's name in your browser for up to seven days, until you finish setup (section 2). Cloudflare Web Analytics counts page views, which page, where the visit came from, and the visitor's country and device type, without cookies and without identifying you. Fonts are loaded from Google Fonts, so your browser requests them from Google. The contact form opens an email in your own mail application addressed to us; nothing is sent until you send it. The site is served by Cloudflare, which may record ordinary request logs (IP address, page, time) for security.
6. Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, or object to a use of it, by emailing support@onanswer247.com. We answer within 30 days. Customers can also delete workspace users and configuration themselves. If you are a caller, we will pass your request to the business you called and help it respond, because it controls that data.
We comply with the Philippine Data Privacy Act of 2012 and, for our US customers and their callers, act as a service provider under state privacy laws such as the California Consumer Privacy Act. You can complain to the National Privacy Commission of the Philippines or to the privacy regulator where you live.
7. Security
Data is encrypted in transit and at rest, access is limited to what each service needs, and carrier credentials are stored encrypted. If a breach affects your data we will tell you without undue delay.
8. Healthcare workspaces
Standard plans are not for protected health information, and we do not run healthcare workspaces yet. We will not process protected health information until a Business Associate Agreement with the customer is signed and the covered setup it describes exists. We will update this section before that happens.
9. Children
The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18 as a customer.
10. Changes
We will post changes here with a new effective date and email workspace owners about material ones at least 30 days before they apply.
Read the terms of service →