Privacy Policy

1. Scope, and whose data this covers

This policy covers two kinds of people: (a) our direct customers -- the mortgage companies, branches, and staff who sign up for and use CallFlowHQ ("you," "account users") -- and (b) the callers who reach a phone number provisioned through a customer's CallFlowHQ account ("callers"). For account and billing information, we act as the party responsible for that data. For call recordings, transcripts, and the information a caller provides on a call, we act on behalf of, and at the direction of, the CallFlowHQ customer whose number the caller dialed -- that customer, not CallFlowHQ, decides what a call is used for and is responsible for its own privacy notices to callers.

2. Information we collect

We collect:

• Account information: name, email, company, role, and phone number, provided when you or your team sign up, accept an invite, or update your profile.
• Call data: call metadata (numbers, timestamps, duration, routing and transfer outcome), audio recordings, and two-sided transcripts of calls placed to a phone number provisioned under a customer's account.
• Lead data: the information a caller provides during a call -- name, callback phone number, credit range, income band, loan purpose, timeline, and property details -- based on the qualifying questions the receiving account's agent is configured to ask. Our agent is designed to never ask for, and to flag if a caller volunteers, a Social Security number or date of birth; see Section 7.
• Usage and billing data: phone numbers, call minutes, storage, and transcription minutes used, and payment and invoicing details processed through our payment processor.
• Device and log data: IP address, browser type, and similar technical information generated automatically when you use our website or dashboard, for security and diagnostic purposes.

3. How we use it

To operate the Service -- answering and routing calls, generating recordings and transcripts, resolving routing and warm transfers, and running the account dashboard; to bill for usage; to monitor for and flag compliance issues (such as a caller being quoted a rate, or the agent being asked for restricted information, both of which our system is designed to block or flag); to secure accounts and detect abuse; to provide customer support; and to maintain and improve the Service, including using aggregated or de-identified data that doesn't identify any person or account.

4. Cookies and similar technologies

We use cookies necessary to keep you signed in and to secure your session. On our public marketing pages -- not inside your logged-in dashboard -- we also use advertising and analytics cookies and similar identifiers from Google (Google Analytics and Google Ads), Meta, and LinkedIn, to measure which ads and campaigns led to a signup. See Section 11 for the choices available to California and other state residents in connection with this advertising use.

5. How we share information

We share information with the vendors that power the Service, each acting on our behalf and bound by confidentiality and data-protection terms: our telephony carrier, our AI voice and speech-transcription providers, our database, authentication, and file-storage provider, our application and voice-server hosting providers, our rate-limiting infrastructure, our payment processor, our transactional-email provider, and our error-monitoring provider. We also share information within your own account -- with your team members who have access under your account's roles and permissions -- and with law enforcement or regulators when required by law. We do not sell caller or lead data, and we do not sell personal information as that term is used in U.S. state privacy laws. See Section 4 for the separate advertising technologies (Google, Meta, and LinkedIn) used on our public marketing pages, which is a different kind of sharing than the vendor relationships above.

6. Call recording, transcription, and consent

Calls placed to a number provisioned through CallFlowHQ are recorded and transcribed so the receiving account can review them and so our compliance safeguards can run. Depending on the caller's and account's location, recording-consent laws may require a specific disclosure -- our agent's AI-disclosure greeting is designed to support this, but the CallFlowHQ customer receiving the call is responsible for confirming it meets the requirements of the jurisdictions they operate in.

7. Financial privacy note

CallFlowHQ is a screening and communications tool, not a lender, broker, or loan originator, and the AI agent is built to never ask for a caller's Social Security number, date of birth, or other information that would cross from screening into taking a loan application. If a caller volunteers that kind of information unprompted, our system is designed to flag it and redirect the caller to a licensed loan officer rather than process it further. Any nonpublic personal information a caller shares with a customer's licensed staff after transfer is that customer's responsibility under the Gramm-Leach-Bliley Act and other applicable financial-privacy law, not ours.

8. Data retention

Call recordings (the audio itself) are available for playback and download in your dashboard for 7 days after the call. After that period, recordings are moved out of active access and retained in secure archival storage rather than deleted, for as long as needed to comply with legal, tax, or regulatory recordkeeping obligations. Transcripts and lead data are retained for as long as the receiving account is active, or as needed to comply with legal, tax, or regulatory recordkeeping obligations, whichever is longer. We retain account and billing information for as long as needed to operate the Service and satisfy those same obligations. A released phone number and its associated data can be restored within 7 days of release from your dashboard; after that window it is permanently purged.

9. Data security

We use industry-standard safeguards to protect information, including encryption in transit, database-level row security that isolates each account's data, and optional (or account-wide, at an Owner's election) multi-factor authentication. No system is completely secure, and we can't guarantee absolute security.

10. Your rights and choices

Account users can access and update most account information directly from the dashboard. You, or a caller, can request access to, a copy of, or deletion of personal information associated with an account by contacting us at the email below; we may need to verify your identity and may retain information we're required to keep by law. If you're a caller, we'll generally direct your request to the CallFlowHQ customer whose number you called, since they control what that call was used for.

11. California privacy rights

If you're a California resident, the California Consumer Privacy Act (as amended) gives you the right to know what personal information we've collected about you, to request deletion or correction of it, and to not be discriminated against for exercising those rights. We do not sell personal information. We do use advertising cookies from Google, Meta, and LinkedIn on our public marketing pages to measure ad performance, which these laws treat as sharing personal information for cross-context behavioral advertising -- you can opt out of this at any time through each platform's own advertising controls (Google's Ads Settings, Meta's Ad Preferences, and LinkedIn's Advertising preferences), or by submitting a request using the contact information below.

12. Other U.S. state privacy rights

Residents of certain other states (such as Virginia, Colorado, Connecticut, and Utah) have similar rights to know, access, correct, or delete personal information, and to appeal a denied request. You can exercise these rights using the contact information below.

13. Children's privacy

The Service is intended for business use by adults and is not directed to children. We don't knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we'll delete it.

14. Where data is processed

The Service is operated from, and data is processed and stored in, the United States by us and the vendors listed in Section 5.

15. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll notify you (for example, by email or an in-app notice) before it takes effect.

16. Contact

Questions about this policy, or a privacy request? Email us at privacy@callflowhq.com.