Privacy Policy

1. About this policy

This policy explains what personal information Angry Pixie Electronics LLC, doing business as Callingual (“Callingual”, “we”, “us”), collects through the Callingual website and web app (the “Service”), what we do with it and whom we share it with. It covers account holders and the people they call (“guests”).

2. Summary

• Conversations are not recorded. We do not store audio, or transcripts or translations of what the two people say to each other. Speech is processed while the call is live and then discarded. What you say to Callingual itself before the two people are connected, such as menu answers, is kept as text for one year to find and fix faults (section 3).
• We keep what we need to run your account, charge for calls and prevent misuse.
• We do not sell personal information, show ads, or use advertising trackers or third-party analytics.
• Card payments are processed by Stripe, and earlier purchases of credit by Paddle. We never receive your full card number.

3. What we store

Your account

• Your email address, name and language.
• Your phone number, once you have verified it, and when you verified it.
• When the account was created and when you accepted the terms.
• Your billing: the card you saved as Stripe describes it (brand, last four digits and issuing country) and whether it passed the check that it is a US card; your unbilled calls and each charge to the card (amount, tax, the Stripe invoice, and whether it was paid, failed or needs confirmation); refunds and payment disputes; credit bought earlier (each purchase with its Paddle transaction, amount, what is left and when it expires) or given at no charge; and your low-balance warning level.
• Your Stripe customer identifier, and your Paddle customer identifier if you bought credit earlier.

Calls

For each call: the time, connected duration, outcome, cost and rate, the guest’s country, the two languages, the guest’s name as you typed it, the last four digits of the guest’s number, and a one-way keyed hash of the guest’s full number (used to apply daily call limits without storing the number). A separate diagnostic log keeps the last four digits of both numbers, the languages, the outcome, the duration and the timing of each translated phrase, without any words.

Dial-in

If you turn on dial-in: that it is on, a one-way salted hash of your phone PIN (never the PIN itself), when you set it, how many wrong PINs were entered in a row and any lock that followed, which credit dial-in calls use and the voice for your words. Contacts you save for dial-in are kept with their name, full phone number, language and voice, and when you last called them, until you delete them or your account. When someone calls the dial-in number we use the calling number to find the account and to limit how often one number can call or fail to sign in (stored for that only as a keyed hash). Each dial-in sign-in, wrong PIN and refusal for your account is logged with the calling number and shown to you on the account page; this log is kept 90 days. What you say to choose whom to call is recognized by our speech providers and, for language names, may be sent to Anthropic; it is kept as text with numbers removed (What you say to Callingual, below). The PIN is entered by keypad only and is never logged.

Identity verification

If you choose to verify your identity on the dashboard (it removes a new account’s usage limit and raises the amount at which your card is charged), Stripe Identity checks a photo ID and a selfie on Stripe’s own pages. The ID and the selfie go to Stripe, not to us: we receive and keep only the result (verified, pending or failed, with Stripe’s reason code when it failed), the identifier of each verification and when it was started. We never receive the documents, the photos, or the name and other details on the ID, and we keep none of them. Stripe processes them under its own privacy policy. The verification records are deleted with your account.

Call explanations

If you play the explanation for the person you are about to call, we make its audio from your name, the company name for a company call and the number that will call them, and keep that audio for up to 30 days so it can be played again without being made again. Each play is counted for the hourly limit (with a keyed hash of your account id, kept one hour) and recorded for our costs (time, kind and characters spoken). Their phone number is used only to choose the caller ID that is read out and is not stored.

Guest invite links

If you make an invite link for a guest, we store your name and language, the guest’s name, full number and language, and the guest’s answer on the page (accept, decline or block), when they answered and the language the page was shown in. The link itself is stored only as a hash.

Blocked numbers

If a guest presses 3 during a call, or asks us by email, we store their number and when it was blocked, so that Callingual never calls it again for anyone. If they choose Block on an invite page, we store their number and when it was blocked with the account that made the invite, so that this account cannot call it again.

Sign-in

• Sign-in sessions: a random token in a cookie, stored by us only as a hash, with when the session started, was last used and ends.
• Your password, stored only as a salted scrypt hash. If you turn on two-step verification: the authenticator app's key (encrypted), your recovery codes (stored only as hashes) and the browsers you signed in from (a random value stored only as a hash). Password reset links are stored only as hashes and expire after 30 minutes.
• One-time codes sent by email, stored only as hashes (SMS codes are held by Twilio), with the address or number they went to.
• Invitation links, stored only as hashes, with the invited email address.
• Your IP address and email address, briefly, to limit how many codes can be requested.

Company accounts

For a company account: the company’s name, billing address and tax number, its members, their roles and monthly limits, invitations (the email address, role and when it was sent; the link only as a hash), the company’s credit and purchases with who bought them, and a log of changes to the company account (who did what, and when). When a member bills a call to a verified company, the company’s name is said to the guest with the member’s name, before the guest accepts.

Company verification: to check that a company may be named to the people its members call, we keep the company’s domain, how it was proved (a code emailed to a work address, or a DNS record), the work email address the code was sent to, when it was proved and when it must be checked again, our review of the name and its outcome (approved, with the exact name announced, or rejected, with the reason), and how many guests blocked or reported calls billed to the company. The code itself is kept only as a one-way hash until it is used or expires. We use this to stop people from claiming to call from a company they do not represent; it is kept while the company account exists, and its history is part of the company’s change log (section 9).

When a company account is closed, its members are removed, its pending invitations are deleted after they expire, and its verification ends, so another company can verify the same domain. Its call and billing records are kept for the periods in section 9, and the former owner can download its usage reports for 90 days. If we transfer ownership of a company account, the new owner sees the company’s records as any owner does.

The company’s owner and admins can see, for each call a member bills to the company: the date and time, the member’s name and email address, the last four digits of the number called, the destination country, the outcome, the connected time, the minutes billed and the cost, also as a downloadable spreadsheet, and each member’s spending this month. They cannot see calls a member bills to their own credit, the guest’s name, full number or languages, or anything said in a call (we do not keep it, section 4). A member sees only their own company calls. After a member leaves, their earlier company calls stay in the company’s records.

Automatic top-up (earlier setups)

Automatic top-up is no longer offered and makes no new charges. If you turned it on earlier, we keep the pack, threshold and monthly maximum you chose, the exact terms you agreed to, their version, when you agreed and the IP address you agreed from, the Paddle subscription that held your payment method, and each top-up (when, how much, and whether it was charged).

What you say to Callingual

To find and fix faults, we keep a text record of what Callingual says on a call and of what callers say to Callingual itself before the two people are connected: dial-in menu answers and choices, a guest’s answers about language and to the notice, and what you say on the support line. Digit sequences, numbers spoken in English and email addresses are removed before the text is stored, and PINs and numbers entered on the keypad are never stored. The record stops for good when the two people are connected: nothing they say to each other is kept. We also keep service events for each call, such as timings, silences, retries and errors, which contain no words. Both are linked to the call, seen only by our site administrators and deleted after one year.

Referral program

If you open a referral link, we count the visit and set the cl_ref cookie (section 8). If you create an account with a referral link or code, we record who referred you, the link and any discount it gives. If you join the referral program, we keep your links and their codes, labels, visit and sign-up counts, the agreement version you accepted with the time, IP address and browser, the commission earned on each referred customer’s card charges, and your payouts. Payouts are made through Stripe Connect: Stripe collects your identity, bank and tax details and issues tax forms where required; we keep your Stripe account id and its status. Referrers see each referred customer only as a number, with the sign-up date and the commission it brought, never a name, email address, phone number or call.

Support requests

When you send us a support request (the form on the Contact page or under Account → Support requests), we keep your name, your email address, the language of the page, what you write and our answers. A request sent while signed in is linked to your account, so our support staff can see your balance, your recent calls, your dial-in settings and your company account while answering. A request sent while signed out is not linked to any account, even when an account uses the same email address.

Web server logs

Our servers may log technical details of requests, such as the IP address, time, requested address and browser, to keep the Service secure and find errors.

4. What we do not store

No call audio, and no transcripts or translations of the conversation. What the two people say to each other is sent to our speech and translation providers while the call is live (section 7) and is not kept by Callingual. We cannot play back or provide a record of the conversation. What callers say to Callingual itself before they are connected is kept as text (section 3, What you say to Callingual).

5. If you received a call

• The account holder entered your name, number and language. When we call you, you hear their name (and, if the call is billed to a verified company account, the company’s name) and that the call is translated by AI, and you choose whether to accept. The call record notes which version of that notice was played.
• If you decline or do not answer, the call ends. The account holder hears that you did not accept; they are not told whether you blocked them.
• To stop all Callingual calls to your number, email us the number (section 11). Pressing 3 when Callingual calls stops calls from that caller and the company the call is billed to; Block on an invite page stops calls from the account that sent it. During a call you can press *7 to report it. A block or report is recorded with the call and counted against the account, and the company, the call was billed to.
• Guests can be in any country listed on the Pricing page, currently the United States, Canada, Mexico, the United Kingdom, France, Spain, Italy, the Netherlands, Germany, Japan, Ireland, Portugal, Belgium, Austria, Switzerland, Puerto Rico, Colombia, Brazil, South Korea and Hong Kong. This policy covers guests wherever they are.

Guests in the European Economic Area, the United Kingdom or Switzerland

• Angry Pixie Electronics LLC, doing business as Callingual, is the controller of the information about you described in this policy. Contact: support@callingual.com.
• We use your number, the name and language the account holder entered, and your answer to place the call the account holder asked for, to keep the Service safe (call limits and blocks) and for billing records. The legal basis is our legitimate interest and the account holder’s in placing a call that you can accept or refuse.
• Translation starts only after you press 1. By pressing 1 you agree that what you say is processed by our speech and translation providers (section 7) while the call is live. You can withdraw at any time by hanging up.
• Nothing you say in the conversation is recorded or kept (section 4). Your answers to Callingual before you are connected, such as your language and whether you accept, are kept as text for one year (section 3). What we keep about the call (section 3: the last four digits of your number, a one-way hash of the full number, your country, the languages, the name the account holder entered, the outcome and the duration) is kept as section 9 describes. A block is kept until you ask us to remove it.
• Your information is processed in the United States (section 14). You have the rights described in section 11, and you can complain to the data protection authority where you live or work.

6. How we use it

• To create and run your account, sign you in and verify your phone number.
• To place and translate the calls you request.
• To charge your calls to your card, show your unbilled calls, charges, receipts and any credit left, apply the usage limit and, if you ask for it, identity verification, and handle refunds and payment disputes.
• To send service emails: sign-in codes, a reminder 30 days before credit bought earlier expires, a notice when a charge to your card fails, company account invitations, and notices about these policies or the Service.
• To prevent misuse: call and spending limits, blocked numbers, verifying company names before they are announced, and investigating reports of abuse.
• To find and fix faults, using the diagnostic log, the service events and what callers say to Callingual, described above.
• To meet legal, tax and accounting obligations.

We do not use your information for advertising or profiling.

7. Who processes data

We share personal information only with the service providers below, which process it for us to run the Service; when the law requires it, or to protect the rights, safety or security of people or of us; and with a successor if the Service is sold or merged, under this policy.

Stripe collects card details on its card page (Stripe Checkout) and identity documents on its verification pages (Stripe Identity), under its own privacy policy, and may set its own cookies there. Paddle keeps the records of earlier purchases under its own privacy notice.

8. Cookies

The Service sets these cookies, all needed to sign you in: cl_session holds your sign-in session (not readable by scripts); cl_in only tells the site’s menu that you are signed in; cl_dev remembers that this browser has signed in to your account before, so we can ask for an emailed code on a new one (kept 400 days); cl_step holds an unfinished sign-in step for 15 minutes. cl_session and cl_in end when the session ends or when you sign out. We use no analytics, advertising or tracking cookies. cl_ref holds the referral link you opened and when, for 30 days, so an account you create is credited to the person who shared it.

9. How long we keep it

• Account information: while your account exists.
• Sign-in sessions end 30 days after last use (90 days for a session started from an invitation). One-time codes expire after 10 minutes. The records of sessions, codes sent and invitations are deleted one year after they end or expire.
• Call records: the guest’s name, the last four digits and the keyed hash of the guest’s number, the languages, the diagnostic log (including which notice the guest heard) and the call’s usage counts are deleted one year after the call. What stays is the billing record of the call: when it took place, its duration and outcome, the destination country, the rate, the cost and the account or company it was billed to.
• Billing records (calls as above, charges to your card, credit, purchases, refunds, chargebacks, and automatic top-ups with the terms you agreed to): kept seven years for tax, also after your account is deleted, then deleted. The record of an automatic top-up you turned off is deleted seven years after you turned it off.
• Guest invite pages and the guest’s answer: one year after the invite was made.
• Records of actions by our administrators, of changes to company accounts and of payment notifications received: one year.
• Counts used to limit sign-in codes and dial-in calls: up to two days.
• Web server and service logs: up to one year.
• What callers say to Callingual and the service events of a call: one year, then deleted.
• Blocked numbers: until the number’s owner asks us to remove the block.
• Guest blocks and reports counted against an account or company: one year.
• Support requests: one year after the last message or after the request was closed, then deleted.
• Dial-in settings and contacts: until you change or delete them, or delete the account.

10. Deleting your account

You can delete your account under Account. We then delete your email address, name, language, phone number, sessions, codes and identity verification records. Unused credit is given up. Call records stay without your account details and without the guest names you typed, and credit records stay without your account details, as billing records. Guest invite records are not linked to accounts and are not deleted with the account. Stripe and Paddle keep their own records of your payments.

11. Your choices and rights

You can see and change your name, language and phone number under Account, and see your calls and charges on the dashboard. Depending on where you live, you may have the right to ask for access to, correction of or deletion of your personal information, to object to how we use it, to restrict it, or to receive a copy of it. Guests can ask the same about information an account holder entered about them. Write to us at support@callingual.com. We may need to confirm that the request comes from you.

12. Security

Connections to the Service are encrypted. Passwords are stored only as salted scrypt hashes; sign-in tokens, one-time codes, recovery codes, password reset links and invite links only as hashes; and guests’ full numbers are not stored in call records. No online service is completely secure; if we learn that your personal information was accessed without permission, we will tell you by email.

13. Children

The Service is not for people under 18. We do not knowingly collect personal information from children. If you believe a child has an account, contact us and we will delete it.

14. Where data is processed

We store data in the United States. If you are outside the United States, including as a guest, your information is transferred to and processed in the United States. Our service providers may process it in other countries under their own safeguards.

15. Changes to this policy

We may update this policy. We email account holders about material changes before they take effect, and the “Last updated” date above changes.