Privacy policy

Last updated:

  1. INTRODUCTION

Callin.io is a service provided by Replacing Humans LLC ("we," "us," or "our"),
a company based in the United States. We have developed Callin.io, a SaaS
platform that offers AI phone agent services for organizations.

This Privacy Policy explains how we collect, use, disclose, and protect your
personal information when you use our website (www.callin.io) and our AI phone
agent services (collectively, the "Services"). We are committed to protecting
your privacy and complying with applicable data protection laws, including:

  • The General Data Protection Regulation (GDPR)

  • The German Federal Data Protection Act (BDSG) and Telemedia Act (TMG)

  • The Spanish Organic Law on Data Protection and Guarantee of Digital Rights
    (LOPDGDD)

  • The Italian Personal Data Protection Code

  • The UK Data Protection Act 2018 and UK GDPR

  • The French Data Protection Act and CNIL guidelines

  • Applicable US privacy laws, including the CCPA and CPRA

  • Other jurisdictions' regulations


  1. DATA CONTROLLER AND CONTACT INFORMATION

Data Controller:
Replacing Humans LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States

Data Protection Officer: gdpr@callin.io
General Support: support@callin.io


  1. TECHNICAL INFRASTRUCTURE

We utilize the following platforms and tools to provide our Services:

AI / GenAI Services:

  • OpenAI chat completions, Azure OpenAI, OpenAI embeddings, Langchain

  • Cartesia, ElevenLabs, PlayHT (Text-to-Speech Synthesis)

  • Deepgram (Speech Recognition / Speech-to-Text)

Other:

  • Redis Cache

  • Twilio Telephony Platform


  1. PERSONAL DATA WE COLLECT
We collect and process the following types of personal data:

  • Account Information: name, email address, phone number, company name, and
    website URL.

  • Usage Data: IP address, browser type, device information, and interaction
    with our website and AI phone agents.

  • Google Calendar Data: with your explicit consent, email addresses, names,
    dates of birth, phone numbers, notes, and event descriptions.

  • Call Recordings: with your explicit consent, conversations between our AI
    phone agents and your customers may be recorded for quality assurance and
    service improvement purposes.

  • Analytics Data: anonymized usage data collected via Google Analytics. We do
    not use advertising pixels from Facebook, Instagram, or TikTok.


  1. HOW WE USE YOUR PERSONAL DATA
We use your personal data for the following purposes:

  • Service Provision: managing user accounts and providing AI phone agent
    functionality.

  • Compliance and Legal Obligations: to comply with applicable laws and
    regulations, including tax laws.

  • Marketing and Communications: to promote our services and communicate with
    potential and existing customers.

  • Website Operation and Security: to manage and secure our website.

  • AI Call Management: to facilitate callback requests from an AI agent.

  • Google Calendar Integration: to allow AI phone agents to schedule
    appointments on behalf of our clients.

  • Service Improvement: to analyze usage patterns and improve our Services.

  • Technical Issue Resolution: to detect, prevent, and address technical issues.


  1. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases:

  • Performance of a Contract: when processing is necessary to fulfill our
    contractual obligations to you.

  • Compliance with Legal Obligations: when processing is required by applicable
    laws and regulations.

  • Legitimate Interests: when processing serves our legitimate interests (e.g.,
    improving Services or marketing), provided these do not override your rights.

  • Consent: when you have given explicit consent for specific activities, such
    as call recordings or Google Calendar access.


  1. DATA SHARING AND DISCLOSURE

We may share your personal data with:

  • Service Providers and Subprocessors: cloud providers (AWS, GCP, Azure), AI
    providers (OpenAI, Azure OpenAI), and other necessary technology partners.

  • Legal and Regulatory Authorities: when required by law or to protect our
    rights and interests.

  • Potential Buyers or Investors: in the event of a sale, merger, or investment.

We do not sell your personal data to third parties. Google user data is not
shared with third parties except as specified above for necessary service
provision and development.


  1. INTERNATIONAL DATA TRANSFERS

As a US-based company, we may transfer your personal data to countries outside
the European Economic Area (EEA). When we do so, we ensure appropriate
safeguards are in place, such as:

  • Standard Contractual Clauses approved by the European Commission

  • Adequacy decisions for countries deemed to provide adequate protection

  • Binding Corporate Rules for intra-group transfers, where applicable


  1. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the
purposes for which it was collected, or as required by applicable law:

  • Account Information: retained for the duration of your use of our Services
    and for a reasonable period thereafter for legal and operational purposes.

  • Google Calendar Data: retained only as long as needed to provide the
    requested services, then securely deleted or anonymized.

  • Call Recordings: retained for a limited period (typically 30 days) unless a
    longer retention period is required for legal or operational reasons.


  1. YOUR RIGHTS

Depending on your location, you may have the following rights regarding your
personal data:

  • Right to Access: request a copy of the personal data we hold about you.

  • Right to Rectification: ask us to correct inaccurate or incomplete data.

  • Right to Erasure: request deletion of your personal data in certain
    circumstances.

  • Right to Restrict Processing: ask us to restrict processing in certain
    situations.

  • Right to Data Portability: request your data in a machine-readable format.

  • Right to Object: object to processing, particularly for direct marketing.

  • Right to Withdraw Consent: withdraw consent at any time where processing is
    based on consent.

  • Right to Lodge a Complaint: file a complaint with a supervisory authority if
    you believe your rights have been violated.

To exercise these rights, please contact us using the information in Section 2.


  1. SECURITY MEASURES

We implement appropriate technical and organizational measures to protect your
personal data, including:

  • Encryption of data in transit and at rest

  • Access controls and authentication mechanisms

  • Regular security audits and vulnerability assessments

  • Employee training on data protection and security best practices

  • Incident response and data breach notification procedures


  1. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to enhance your experience on our
website. Our cookie categories include:

  • Essential Cookies: necessary for the website to function properly.

  • Analytical Cookies: used to analyze website usage (e.g., Google Analytics).

  • Functional Cookies: enhance the functionality of the website.

  • Advertising Cookies: we do not currently use advertising pixels, but may use
    cookies for marketing purposes.

Users can control cookies through their browser settings. Opting out of
non-essential cookies may affect website functionality.


  1. GOOGLE ANALYTICS

We use Google Analytics to analyze the use of our website. Data is processed in
a way that does not directly identify individuals. You can opt out by installing
the Google Analytics Opt-out Browser Add-on.


  1. INTEGRATION WITH GOOGLE CALENDAR

Our software integrates with Google Calendar solely to allow our AI phone agents
to schedule appointments on behalf of our clients. We access this data with your
explicit consent and use it only for appointment scheduling. We do not transfer
or process this data using large language models.


  1. AI PHONE AGENTS AND CALL RECORDINGS

With your explicit consent, conversations between our AI phone agents and your
customers may be recorded for quality assurance and service improvement. These
recordings are stored securely and accessed only by authorized personnel.

You may withdraw your consent for call recording at any time. Note that doing so
may limit certain software features, such as actions based on conversation data
analysis.

Connections with AI assistants (Claude, ChatGPT and other MCP clients). You can connect your Callin account to an AI assistant such as Claude (Anthropic) through our connector at claude-mcp.callin.io. You start the connection yourself, from the assistant, and approve it on a Callin consent page that lists what the assistant may do.

What the assistant can access. Only the data of your own Callin account or of the team you belong to: the list of your voice agents (name, direction, language, phone number; never prompts, webhooks, API keys or billing), your call records (date, duration, direction, status, contact and caller numbers, outcome, summary) and call transcripts. The assistant receives this data only when you ask a question that needs it.

Calls placed at your request. If you allow phone calls, the assistant can ask Callin to call a number you approve, with a goal you give. Callin places the call with your own outbound agent and phone number. At the start of each call the agent states that it is an AI assistant calling on behalf of a customer. The call is recorded and transcribed like any other Callin call, appears in your call history and uses your minutes. The person called is the subject of that data; you are responsible for having a legitimate reason to call them, and Callin processes the call as your processor.

What we store for the connection. A record of the connection (your user id, the assistant's client id, the permissions you approved, hashed tokens and timestamps), so that we can keep it working and let you revoke it. We do not store the content of your conversations with the assistant.

How the assistant provider uses the data. Data returned to the assistant is processed by its provider (for Claude: Anthropic) under that provider's terms and privacy policy.

Retention. Connection records are deleted when you disconnect or after 30 days without use. Call recordings are kept for about 30 days; transcripts and summaries are kept for as long as the call stays in your Callin history, or until you delete them or close your account.

Your control. You can disconnect at any time from the assistant or in Callin (Actions → Claude → Disconnect Claude), which immediately invalidates all tokens. Questions about this section: gdpr@callin.io.

Callin assistant on WhatsApp. You can link your WhatsApp number to your Callin account and ask the Callin assistant, by message, to place or schedule calls, set phone reminders, find businesses and manage your contacts. You link it yourself by sending a one-time code generated in your Callin account (Actions → Claude → Link WhatsApp), and you can unlink at any time by sending UNLINK (or SCOLLEGA).

What we process on WhatsApp. Your WhatsApp number and the profile data Meta sends with each message, the text of your messages and of the assistant’s replies, and the actions you confirm. Voice notes are converted to text by ElevenLabs and then handled like a written message; we do not keep the audio. Photos you send are passed to the assistant’s model for that message only; we keep a note that a photo was sent, not the photo. The assistant never places, schedules or cancels a call, starts a website task that submits something, or sends an email without your explicit yes. Calls follow the rules above (AI disclosure, recording, use of your minutes).

Assistant memory. To help you over time, the assistant keeps up to 50 short facts you share that are useful later (for example your name, city or usual businesses) and a 2–3 line summary of each finished conversation (the last 20). It never stores payment card numbers, bank account details, PINs or passwords, and it is instructed not to keep identity document numbers or health information. Send WHAT DO YOU REMEMBER? (or COSA RICORDI?) to see what it keeps and FORGET EVERYTHING (or DIMENTICA TUTTO) to delete it; unlinking deletes it too.

Web search. To find a business’s phone number, address or opening hours, the assistant may run web searches through Anthropic’s web search tool, localized to your country. Searches contain what is needed to find the business you asked about; we do not add your phone number or contact details.

Calendar. When you confirm a booking or ask for it, the assistant adds the event to your calendar. If you connected Google Calendar in your Callin account, the event is written there with the access you gave Callin. Otherwise you receive a link to a calendar file (kept on our server at a private, random address for 60 days) and an "Add to Google Calendar" link.

Website tasks. For tasks such as an online check-in or a booking form, the assistant can fill the website for you in a cloud browser run by Browserbase in the EU, using only the details you give for that task. The browser is closed when the task ends; when the website needs you (a login, a verification code, a captcha or a payment) you receive a private link to do that step yourself in the same browser. At key moments (results found, a step that needs you, the final confirmation) you may receive a screenshot of the page in the chat; screenshots are not taken when the page shows password or card fields and are not kept on our servers. The assistant never asks for, types or stores your passwords or card details. The website you use processes your data under its own terms.

Assistant email. Your assistant has its own email address at agent.callin.io. With your yes it can send single emails tied to a task you asked for (for example a request to a hotel), sent through SendGrid without tracking of opens or links; it never sends newsletters or the same email to many people. Emails sent to that address (replies, confirmations, codes) are passed to the assistant, which tells you what they say; the latest 20 are kept for up to 30 days.

Contacts you share. When you share contact cards or send an exported address book (.vcf file) in the chat, the assistant reads only names and phone numbers and, after your yes, saves them to your Callin contacts so it can call people by name. It does not read your phone’s address book on its own. You can delete saved contacts from the Callin Contacts page.

Usage statistics. To run and improve the service we keep usage statistics: counts of messages and actions, their outcome, estimated costs, and the kind of requests made, as short generic categories (for example "finding cheap flights") produced automatically when a conversation ends, without names, numbers or message text. They are linked to a pseudonymous code, not to your number, kept for up to 13 months and seen only by Callin administrators (legitimate interest in running and improving the service, Art. 6(1)(f) GDPR).

Providers, retention and legal basis. Messages travel through the WhatsApp Business Platform of Meta Platforms under Meta’s terms; replies are generated by Anthropic (Claude) through its API; voice notes are transcribed by ElevenLabs; website tasks run on Browserbase; assistant emails are sent and received by SendGrid (Twilio); each under its commercial terms. The current conversation is kept for up to 7 days and summarized after 24 hours of silence. Memory and the link between your number and your account are kept until you delete them or unlink, and for at most 12 months. We process this data to provide the service you request (Art. 6(1)(b) GDPR). Questions: gdpr@callin.io.

Using the assistant without a Callin account (guest mode). If your Italian or Spanish number has no Callin account, you can use the assistant as a guest after accepting these terms with one tap. Your calls are placed through a Callin account operated by us, from a Callin Italian or Spanish number, and are recorded and transcribed like any other Callin call. Guests get 30 free minutes, then 30 minutes each month (unused minutes do not carry over), with daily and weekly call limits; premium-rate and foreign numbers cannot be called. Your contacts, the list of your calls and your memory are kept separately for each guest and are never shown to other users. Sending UNLINK (or SCOLLEGA) deletes your contacts, memory and conversation; we keep only your minute counters, for up to 12 months, so that the free allowance cannot be claimed again (legitimate interest, Art. 6(1)(f) GDPR).


CHILDREN'S PRIVACY

Our Services are not intended for use by children under the age of 16. We do not
knowingly collect personal data from children under 16. If we become aware that
we have collected such data, we will take steps to delete it unless we have a
legal obligation to retain it.


  1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our
practices, technologies, legal requirements, or other factors. We will notify
you of any significant changes by posting the updated policy on this page and
updating the "Last Updated" date. We encourage you to review this policy
periodically.


  1. SPECIFIC PROVISIONS FOR DIFFERENT JURISDICTIONS

18.1 European Union (GDPR)

For users in the EU, the GDPR applies to the processing of your personal data.
We will respond to requests to exercise your rights within one month, with the
possibility of a two-month extension where necessary. You have the right to lodge
a complaint with your local data protection authority.

18.2 Germany (DSGVO and TMG)

We comply with the BDSG, TMG, and DSGVO. We have appointed a Data Protection
Officer reachable at gdpr@callin.io. You have the right to object to direct
marketing processing at any time, free of charge. For minors under 16, consent
must be given or authorized by a parent or guardian.

18.3 Spain (LOPDGDD)

We comply with specific requirements regarding data collection forms and consent
under the LOPDGDD, and adhere to the guidelines of the Spanish Data Protection
Agency (AEPD) regarding cookie usage and online tracking.

18.4 Italy (GPDP)

You have the right to lodge a complaint with the Italian Data Protection
Authority (Garante). We comply with the Italian Personal Data Protection Code
and the Garante's guidelines on cookies and online tracking.

18.5 United Kingdom (ICO)

References to GDPR in this policy should be understood as references to the UK
GDPR and the Data Protection Act 2018. You have the right to lodge a complaint
with the Information Commissioner's Office (ICO).

18.6 France (CNIL)

You have the right to define guidelines regarding the fate of your personal data
after your death, in accordance with French law. We comply with CNIL requirements
on cookie consent and data retention. You may lodge a complaint with the CNIL.

18.7 United States

California residents have additional rights under the CCPA and CPRA, including
the right to opt out of the sale of personal information and the right to request
deletion. To exercise these rights, contact us at ccpa@callin.io.

Nevada residents may opt out of the sale of certain personal information by
contacting us at nevada-privacy@callin.io.

Additional US provisions:

  • We comply with the CAN-SPAM Act; all marketing emails include an unsubscribe
    option and are processed within 10 business days.

  • We honor Do Not Track signals.

  • Our services are not directed to children under 13; we do not knowingly
    collect data from children under 13.

  • We implement reasonable security measures as required by applicable state law.

  • In the event of a data breach, we will notify affected individuals and
    relevant authorities as required by applicable state law.

18.8 The Netherlands

We comply with the Dutch GDPR Implementation Act (UAVG). You have the right to
lodge a complaint with the Autoriteit Persoonsgegevens. We will respond to
rights requests within one month, extendable by two additional months.

18.9 Portugal

We comply with Law No. 58/2019 implementing the GDPR in Portugal. You have the
right to lodge a complaint with the CNPD. Responses to rights requests are
provided free of charge, unless manifestly unfounded or excessive. In the event
of a high-risk data breach, we will notify you without undue delay.

By using our Services, you acknowledge that you have read and understood this
Privacy Policy. If you do not agree with this policy, please do not use our
Services.

For any questions or concerns, contact us at: support@callin.io