Privacy policy

1. Who this policy covers

Xpykerz (“Xpykerz,” “we,” “us,” or “our”) operates teleCaller. This policy applies to the public website, the authenticated dashboard, support interactions, and the service infrastructure used to deliver teleCaller.

When a customer decides whose information to upload, whom to call, why to call, and what the agent should say, that customer controls those purposes. Xpykerz processes that customer content to provide the service. The customer is responsible for giving callers and contacts its own privacy notice and for having a lawful basis to use their data.

2. Data we process

We process the following categories when they are provided or generated:

• Account data: name, work email address, organization name, role, permissions, activation status, password hash, and account timestamps. We do not store the plaintext password.
• Customer content: agent names, descriptions, voices and system prompts; caller-list schemas; uploaded or manually entered contact records; and custom fields selected by the customer. Customer content can include phone numbers, email addresses, names, and other information the customer chooses to upload.
• Call data: destination and originating numbers, assignment and session identifiers, status, timestamps, duration-related fields, hang-up information, technical errors, and recording identifiers and locations.
• Call audio: live call audio is routed through the telephony service and processed by the AI voice service. When calling is enabled, calls are currently configured for whole-call recording by the telephony provider. See the recording and retention policy.
• Device and usage data: IP address and request identifiers used for access controls and troubleshooting, dashboard usage and performance telemetry, browser and device information made available by analytics tools, and security events such as failed sign-in attempts.
• Browser storage: the dashboard uses local storage for the access token and theme preference, and a functional cookie for the sidebar preference. These support sign-in and interface behavior, not interest-based advertising.
• Support data: messages, attachments, account identifiers, and troubleshooting details sent to us.

teleCaller does not currently create or store a transcript of call conversations in its application database. The live AI provider may process audio and transient conversation context to provide the real-time interaction.

3. How we use data

We use data to:

• create and secure accounts;
• provide agent configuration, caller lists, outbound assignments, call-session review, and authenticated recording access;
• route live audio and generate the AI voice response requested by the customer;
• send activation, password-reset, and service messages;
• prevent abuse, investigate failures, maintain reliability, and protect users;
• provide support and respond to account-data requests;
• measure service performance and improve the dashboard; and
• comply with law, enforce our terms, and establish or defend legal claims.

Where a law requires a legal basis, our bases may include performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. A customer must establish its own basis for contact records, calls, AI-generated voice interactions, and recordings.

4. How data is shared

We share data only as needed for the service or another purpose described here:

• Vobiz supports call routing, call control, and provider-hosted recordings.
• OpenAI processes live audio and instructions to provide the real-time AI voice interaction.
• Vercel supports application hosting, product analytics, and performance measurement.
• Email, database, hosting, monitoring, and support providers process limited data for their assigned service.
• Authorized members of the same customer organization can access data according to their role and permissions.
• Authorities, advisers, or counterparties may receive information when required by law, needed to protect rights and safety, or necessary for a corporate transaction.

These providers may process data in countries other than the customer’s or called party’s country. We use contractual, technical, and organizational measures appropriate to the service and applicable law.

We do not sell customer contact lists or call recordings, and we do not use them for interest-based advertising.

5. Retention

We keep account and customer content while the account is active and as reasonably needed to operate the service, resolve disputes, meet legal obligations, or protect the service. teleCaller does not currently offer a customer-configurable or automatic application-level retention schedule. Recording files are hosted by the telephony provider and are subject to provider availability and retention controls; teleCaller stores recording references and call metadata in its database.

Customers should request deletion when information is no longer needed. Details and current limitations are in the recording and retention policy and account deletion and export guide.

6. Security

We use access controls, organization-scoped permissions, encrypted network connections, password hashing, expiring activation and reset tokens, sign-in protections, and authenticated recording proxying. No online service is perfectly secure. Customers must protect account credentials, limit roles and caller-list access, and notify us promptly of suspected compromise.

7. Your choices and rights

Depending on location and circumstances, an individual may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent where processing relies on consent. Rights can be limited by law and by the role in which Xpykerz processes the data.

Authenticated customers can update their display name and password in the dashboard. For export, deletion, or another privacy request, follow the account-data request process or email hello@xpykerz.com from the account email address. We may need to verify identity and authority.

If the request concerns a call placed by a teleCaller customer, contact the organization identified during the call because that organization decides why the call was made. If it cannot be identified, contact us with the receiving phone number and approximate call time; do not include passwords, one-time codes, or unrelated sensitive information.

8. Children

teleCaller is a business service for adults and is not directed to children. Customers must not use the service to target children or upload children’s personal data unless they have confirmed a lawful, age-appropriate basis and all required guardian permissions. Uses that exploit or endanger children are prohibited.

9. Changes and contact

We may update this policy as the service or law changes. Material changes will be posted with a new effective date and, when appropriate, communicated through the service.

Questions and privacy requests can be sent to hello@xpykerz.com.