Privacy Policy

1. Our role and this policy

We handle personal information in two capacities:

• Account holders and website visitors. We determine how account, billing, support, and website information is used to operate our business. This policy explains that handling.
• Customer contacts and call recipients. Our customers decide which contacts to upload or connect, which communications to initiate, and how to configure their campaigns. We process that information on their behalf under the data processing agreement in our Terms of Use.

If a business contacted you using BigPhone.ai, contact that business to request access, correction, deletion, or an opt-out. We assist our customers with these requests. If you need help identifying the responsible business, contact our privacy contact below.

2. Information we collect

• Account information: your name, email address, business information, phone number, account settings, and organization membership.
• Sign-in information: credentials or authentication identifiers. When you sign in with Google, we receive information made available for that sign-in, such as your name, email address, profile picture, and account identifier.
• Billing and usage information: your plan, billing details, payment and transaction information, and use of the service.
• Technical information: IP address, browser and device information, logs, cookies, and similar identifiers used to operate and secure the service.
• Support and communications: messages, attachments, and other information you provide when you contact us.

On behalf of customers, we may also process contact names and phone numbers, email addresses, CRM records, consent and opt-out information, call metadata, recordings, transcripts, messages, appointment details, campaign instructions, uploaded knowledge-base material, and information collected during conversations. The information depends on the features and integrations the customer uses.

3. How we use information

We use account-holder and website information to:

• Create accounts, authenticate users, and provide the service.
• Manage subscriptions, measure usage, process payments, and maintain business records.
• Respond to support requests and send account, service, and policy notices.
• Detect fraud, investigate abuse, troubleshoot problems, and protect the service.
• Understand and improve how the service works.
• Meet legal obligations and enforce our terms.

We obtain consent where required and use other lawful grounds where permitted. Customer contact information is processed on the customer's instructions to provide the service, subject to our data processing agreement and applicable law.

4. When we share information

We share information with service providers as needed to operate the service, including providers of hosting, authentication, storage, payments, telecommunications, AI voice, transcription, and support. Providers processing information on our behalf are subject to contractual obligations appropriate to their role.

Customer-configured integrations may send information to CRM systems, calendar services, email providers, or webhook destinations chosen by the customer. Information shared with a provider through the customer's own account is also subject to the customer's agreement with that provider.

We may disclose information when required by law, to respond to lawful requests, or to protect the rights and safety of our company, customers, and others.

We do not sell personal information.

5. How long we keep information

We retain personal information only as long as necessary for the purposes described in this policy, including providing the service, maintaining required business records, resolving disputes, and meeting legal obligations. We then delete or anonymize it.

Retention depends on the type of information, the customer's instructions, and applicable legal requirements. Customer data is returned or deleted on termination as described in our data processing agreement, except where the law requires retention. You may contact us about retention or deletion of specific information.

6. How we protect information

We use technical and organizational safeguards appropriate to the information we handle. These include access controls, confidentiality obligations, and measures intended to prevent unauthorized access, use, or disclosure.

No system is completely secure. We notify affected customers, individuals, and authorities about confidentiality incidents or breaches as required by applicable law and our contractual obligations.

7. Your privacy rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information. You may withdraw consent where processing relies on consent, request portability where available, and request information about automated processing.

Send requests to sattari@planconversion.com. We may need to verify your identity and clarify your request before responding. Some information must be retained to meet legal obligations. Withdrawing consent may affect features that require that information.

For information controlled by one of our customers, direct your request to that customer. We provide reasonable assistance so the customer can respond.

You may also raise a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

8. Processing outside Quebec or Canada

We and our service providers may process or store personal information outside Quebec or Canada. Information processed in another jurisdiction may be subject to that jurisdiction's laws and lawful access by its authorities.

Where required, we assess the privacy implications of these transfers and apply contractual and other protections required by applicable law. Contact our privacy contact for information about the providers and processing locations relevant to your use of the service.

9. Cookies and local storage

We use cookies and similar browser storage to support authentication, maintain sessions, remember preferences, and operate service features.

You can manage or delete cookies and local storage through your browser settings. Blocking them may prevent sign-in or cause some features and saved preferences to stop working. Where optional technologies require consent, we will obtain it before using them.

10. AI and automated processing

The service uses AI and automated processing to conduct customer-configured conversations and support features such as transcription, summaries, and follow-up workflows. Customers are responsible for the decisions they make using these outputs and for disclosures required for their use.

Where we make a decision about you based solely on automated processing, we will provide the notice, information, and opportunities to exercise your rights required by applicable law. Requests about decisions made by a customer should be sent to that customer.

11. Changes to this policy

We may update this policy and will post the revised version with a new last-updated date. We will communicate material changes and obtain additional consent where required by law.

12. Privacy contact

For privacy questions, requests, or complaints, contact the person responsible for the protection of personal information: