Privacy Notice
Effective October 23, 2026 · version 2026-10-23
This notice covers account holders, visitors and people contacted through Open Calls. We publish the effective date and keep prior versions. We will notify account holders through an account notice or email before a material change takes effect; changes requiring permission will be offered separately before the new use begins. Contact privacy@opencalls.dev about this notice.
Your account and calls
Holy Coders, LLC operates Open Calls. We use your email, profile and authentication records to manage your account. Passwords are stored as one-way hashes. Social sign-in processes identity claims from the provider you select; Open Calls does not need access to your mail to sign you in.
When you submit feedback, we send the topic, message, your account email and any call reference you provide through our email provider to our support inbox. We do not automatically attach a transcript or recording. We use support messages to investigate issues, respond and improve the service; our retention policy calls for deletion within 12 months after the issue is resolved, unless an ongoing dispute, security investigation or legal hold requires longer. Mailbox cleanup is handled through our privacy-request process. Avoid sharing unnecessary sensitive information. Contact privacy@opencalls.dev for access or deletion requests, subject to records we must retain by law.
We process recipient numbers, objectives, the context you choose to share, call audio and transcripts to carry out calls and provide evidence for results. We may retain private audio recordings from all call modes, including incoming calls, hold, translation and human connections, to debug faults and improve service reliability. Your recording toggle controls only recordings saved to your account; it does not disable these private debugging recordings. Authorized staff may review private recordings through restricted, logged access. These recordings are not available through customer accounts or connected agents. We do not ask account holders or call participants for a separate recording opt-in and do not play a recording announcement or beep. Saving a recording to your account remains your choice for the call or through your saved default. Recordings are retained for up to 30 days and follow the deletion process below. Your authenticated account controls access to your call history. A recipient’s statement is not permission to expand a task or share private information.
Open Calls does not offer medical advice, diagnosis, treatment, access to protected patient records or a service for healthcare organizations to process patient information on their behalf. Do not submit patient records, highly sensitive health details, government identification numbers, full payment credentials or biometric identification data. Routine administrative calls, such as asking a clinic for its public hours, remain supported when they do not require sensitive personal information. We do not create voiceprints for identification. Accounts are for adults 18 and older; do not use the service to collect information directly from children under 13.
We may use bounded portions of retained call content with our AI provider to check whether the assistant followed your instructions, supported its result and respected its authority and language. We combine these findings with technical events and content-free audio measurements to investigate recurring failures and verify repairs. These reviews can be incomplete or wrong; they do not prove what a recipient heard. We retain bounded findings and evidence references with the call and remove call content and content-derived findings through the call deletion and retention process. Repair workflows receive sanitized technical incident information, not customer transcripts or recordings. Quality reviews do not automatically grant credit or authorize new calls, commitments or access.
If you choose a welcome call and separately agree to verify a callback number, we use the number, account and call identifiers, a short-lived challenge and attempt records to check control of that number. The challenge is shown only in your authenticated account or connected-assistant session and entered with the phone keypad on the corresponding call; it is not spoken to whoever answers. Answering, caller ID and spoken agreement do not verify a number. Successful verification proves control of the number at that time, not legal ownership. Verification and anti-abuse records operate the service separately from optional diagnostics.
Service providers
Beta access requests store your email so we can review the request and send an invitation if approved. We retain the request and approval history to prevent duplicate promotional credit and operate the beta. Access codes are protected; they are never sent to analytics. Beta progress is linked to your account after signup. Contact privacy@opencalls.dev to request removal.
We use Fly.io, Cloudflare and PlanetScale for hosting, database services, security and transactional email, Telnyx and Twilio for telephony, OpenAI for calling models and bounded call judgments, and Stripe for payments. Our engine streams normal English outbound call audio directly to OpenAI for voice, reasoning and tools; the phone carrier carries those calls. Explicitly requested administrator voice tests may instead send the controlled test call's audio, task context and tool results to xAI for Grok voice processing. This administrator test does not change the model used for ordinary calls. Specialized managed voice routes may also use Telnyx voice processing and Deepgram transcription. Support mail is handled through our company email forwarding and inbox providers. Optional diagnostics use PostHog and native pseudonymous session identifiers. OpenAI API input/output sharing for training is disabled in our organization. This does not remove separate provider security, retention or carrier data-processing terms. Providers receive the information needed for their role. Stripe processes payment credentials; Open Calls does not store card numbers. Provider processing may take place outside your country under their applicable service and data-processing terms; we do not promise exclusive data residency. For directory search, Google Places receives the search text, including any location you enter. If you connect Google Calendar or Google Sheets, Google processes the connection authorization and selected event or spreadsheet requests; we retrieve selected data and send event details to Google for calendar changes you approve. Slack receives the title and text of messages you approve for your connected destination. Where available and enabled, Twilio and WhatsApp (Meta) process phone numbers, inbound text, opt-out signals and delivery information for linked SMS or WhatsApp channels. Result notices require your separate approval and contain a sign-in link, rather than the call transcript or task details. For Google Maps features and content, this notice incorporates the Google Privacy Policy at https://policies.google.com/privacy, which describes Google’s processing.
Call requests, results, transcripts and exact engine instructions stored in the app are retained indefinitely for call history, support and debugging, until you delete the call content or close your account. There is no automatic age-based expiry for this content. Authorized staff can read engine instructions only through restricted, logged access. Audio recordings follow their separate retention period of up to 30 days. You can delete call content in the app after the call and billing have finished. Deletion also queues cleanup of identified provider-held conversations and recordings, including private debugging recordings, where the provider supports it; provider cleanup can be delayed or fail and may require support follow-up. Carrier usage records, required financial and agreement records, and protected backups are separate and subject to their applicable retention requirements. The production calling assistant has conversation-history retention disabled; this does not remove carrier billing records or establish zero retention across every provider.
Government and third-party requests
We assess requests for customer data case by case, verify the requester and legal basis, and limit any disclosure to what is required. We seek clarification or legal advice and challenge overbroad requests where appropriate. We notify affected users when legally permitted, record the request and response, and do not provide informal third parties with access to your account. Send requests to privacy@opencalls.dev.
Diagnostics
Native and PostHog diagnostics run by default and include page views, bounded interface actions, browser performance, redacted errors, optional survey responses and masked interface replay for eligible sessions. Local optional diagnostics expire after 90 days. Our hosted retention targets are 30 days for interface replay and 90 days for other optional diagnostics; hosted copies also require the provider’s deletion processing. Contact us for the current status of a specific deletion request. Signed-in activity uses a stable pseudonymous identifier and your verified account email so our team can understand account activity in PostHog. Model diagnostics include model identity, measured usage where available and call-control metadata; customer call objectives, prompts and conversation text are not exported to PostHog. Only explicitly controlled operator test calls may include bounded transcript text, with contact details and credentials scrubbed. When diagnostics are enabled, we retain your IP address and use PostHog to estimate approximate country, region and city, not GPS location. Replay masks sensitive fields and call content, and excludes authentication, billing and credential panels. Browser diagnostics do not record your microphone or phone calls. Saved call recordings use separate recording preferences; private debugging capture does not require a separate recording opt-in. No recording announcement or beep is played.
Optional onboarding diagnostics measure whether an invitation was shown, the confirmed call-now, schedule-later or skip choice, a welcome-call schedule and answer, a keypad challenge outcome, explicitly saved language, voice or pace preference categories, actual free-allowance seconds used and a first useful call supported by a completed result. These events use account or opaque identifiers, fixed categories and bounded counts. They do not send phone numbers or phone hashes, verification codes, secrets, call objectives, transcripts, preference values or tool arguments to PostHog. The existing signed-in diagnostics choice applies to the website, connected assistants and background processing, and is checked again before export. Facts recorded while diagnostics are off are not backfilled after you turn diagnostics on. Onboarding diagnostic receipt details are removed after 90 days or on an erasure request. Minimal receipt identifiers, event names and timestamps remain to prevent duplicate reporting; erasure tombstones prevent those receipts from creating new hosted events. Core verification, billing and security evidence follows its separate retention purpose. This measurement does not authorize a phone verification, settings change or call.
Google Analytics is a separate, optional service for measuring visits to selected public pages and connection-button clicks. It stays off until you enable Google Analytics in Privacy choices. After opt-in, Google receives public page paths, fixed button-action and discovery-source categories, browser and IP information, and analytics cookie and session identifiers. We exclude account and authentication pages, call information, account identifiers, URL query strings, fragments and full referrer URLs. Advertising personalization and Google signals are disabled. Analytics cookies are configured to expire after 90 days without renewal on each visit. Google Analytics event and user data are configured for two-month retention. Google’s scheduled deletion processing can take additional time, and standard aggregated reports are outside that retention period. You can turn it off in Privacy choices. Turning off diagnostics, Do Not Track and Global Privacy Control also disable Google Analytics and remove its browser cookies. Withdrawal stops future measurement; it does not itself erase information already held by Google. Google may process this information outside your country. Contact privacy@opencalls.dev about existing data.
We retain recognized campaign tags and advertising click identifiers for first and latest campaign attribution. Other query parameters and full referrer URLs are excluded. Surveys collect bounded choices and ratings, not open-ended call content. Privacy choices, Do Not Track and Global Privacy Control disable optional diagnostics and campaign attribution. A signed-in opt-out is saved for the account and also stops background profiles and connected-assistant diagnostics. Core call, billing, security and support records continue because they operate the service. Turning diagnostics off stops future collection; requests to erase existing hosted data are tracked separately until the provider’s processing is confirmed. Visitor recognition and shared learning through Doorman have been retired. These optional diagnostics choices do not disable private call recordings used for service debugging. The account recording toggle controls saved playback, and private debugging capture is disclosed separately above.
Your choices
You can revoke assistant access, turn off optional diagnostics, download account data and close your account in Privacy & data settings. Email privacy@opencalls.dev to request access, correction, deletion, a processing opt-out or an appeal. Recipients and other people without an account can use the same address; an account is not required. Tell us what you want and enough context to locate the information, such as an approximate call date. Do not email identity documents, payment credentials or unnecessary sensitive information. We verify identity and any authorized agent proportionately before disclosing or deleting another person’s data.
We acknowledge requests, record their applicable legal deadline, and aim to respond within 30 days. If a law permits an extension, we explain the reason and revised deadline before the original deadline. We explain any retained records, legal exception or denial and how to appeal by replying to privacy@opencalls.dev. We do not penalize you for exercising privacy rights. Account downloads cover application records; our privacy workflow also searches hosted diagnostics, relevant support mail and applicable providers.
Our retention policy keeps account information while the account is open. Closure removes your name, authentication secrets and call content; your email and identifiers can remain with billing, agreement, fraud-prevention and privacy-request evidence. The policy calls for financial and agreement evidence to be retained for seven years after account closure or the last relevant transaction, and privacy-request evidence for three years after resolution, with longer retention only for a documented legal requirement, dispute or hold. Minimal contact-suppression evidence is retained while needed to honor an opt-out. Hosted providers may have separate legally required carrier, security or financial records.
Protected database backup archives in our GitHub backup channel expire after seven days. Other provider snapshots and support-mail backups are subject to their own verified schedules. Deleted data in restricted backups is not used for ordinary service operation; recovery must reapply later deletion and closure records before the service is reopened. A legal hold can delay scheduled deletion, and our response will explain any applicable exception.