Privacy Policy

What we collect

We collect only what's needed to run your agents and bill usage:

• Account information — your name and email, and (if you sign in with Google or GitHub) the basic profile they return.
• Agent configuration — the prompts, greetings, voices, tools, workflows, and knowledge-base content you set up for your agents.
• Conversation data — transcripts and, when enabled, recordings of the calls and chats your agents handle.
• Phone numbers you buy or connect, and the contact lists you upload for outbound campaigns.
• Connected provider keys — any API keys you add in Integrations, stored encrypted (see Your own provider keys).
• Usage & billing data — metered events (LLM, voice, and tool usage) used to enforce your plan, plus billing records. Card details are handled by Stripe — we never see or store your full card number.
• Technical data — IP address, device/browser info, and request logs, used for security, abuse prevention, and rate-limiting.

How we use it

Your data is used to:

• Operate your agents — generate replies, transcribe speech, synthesize voice, and place/receive calls and chats.
• Show you analytics, history, and usage against your plan.
• Bill and meter usage, and prevent fraud and abuse.
• Provide support and keep the service secure and reliable.

We do not sell your data, and we do not use your conversations or content to train our own or third parties' models.

Your own provider keys

If you connect your own LLM, voice, or telephony keys under Integrations, they are encrypted at rest (AES-256-GCM) and used only to route your own requests. They're never exposed in the browser or shared with anyone, and you can remove them at any time.

Sub-processors

To deliver the service we share the minimum necessary data with the providers below. Each processes data only to perform its function:

• Supabase — database, authentication & file storage
• OpenAI, Anthropic — large language models (agent replies)
• Deepgram — speech-to-text
• ElevenLabs, Fish Audio, OpenAI — text-to-speech (voices)
• Telnyx, Twilio, SignalWire — phone numbers & call delivery
• Stripe — payments & billing
• Google, GitHub — optional single sign-on

Sharing & selling

We share data only with the sub-processors above, or when required by law (e.g. a valid legal request), or to protect the rights and safety of our users. We never sell your personal information or your conversation data.

Security

Data is encrypted in transit (HTTPS/HSTS) and at rest. Connected provider secrets are encrypted with AES-256-GCM. Access to your workspace's data is isolated per account with row-level security, and you can enable two-factor authentication on your account. No system is perfectly secure, but we work to protect your data and limit who can access it.

Retention

Your agents, transcripts, and recordings are kept until you delete them. You can turn off recording and/or transcript storage per agent in that agent's settings, so sensitive calls are never stored. Billing and usage records may be retained as needed to meet legal and accounting obligations.

Your rights & choices

You can access, export, or delete your data from the dashboard at any time. Depending on where you live, you may also have rights to correct your data, object to or restrict certain processing, or lodge a complaint with a data-protection authority. To exercise any of these, use the dashboard or email [email protected] and we'll help.

People your agents talk to

When you run agents that call or chat with your own customers, you are responsible for that conversation data and for having a lawful basis and any required consent — including consent to record calls where the law requires it. We process that data on your behalf as your service provider.

Cookies

We use only essential cookies needed to keep you signed in and secure your session. We don't use third-party advertising or cross-site tracking cookies.

International transfers

Our providers may process data in the United States, the EU, and other regions. Where data crosses borders, it's handled under those providers' standard safeguards and contractual protections.

Children

Callable is a business tool and isn't directed at children. We don't knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as the product evolves. When we make a material change, we'll update the “Last updated” date above and, where appropriate, notify you in the dashboard.

Contact

Privacy questions or requests? Email [email protected].