Privacy Policy

CallMyBusiness.ai (also operating as Zyfyo) ("we," "us," or "our") provides an AI-powered voice receptionist and call management SaaS platform for businesses ("Subscribers"). This Privacy Policy explains how we collect, use, store, share, and protect personal data from:

• Subscribers — businesses that register for and use our platform
• End Callers — individuals who call a Subscriber's phone number answered by our AI
• Website Visitors — individuals who visit our marketing website or request a demo

By using our platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our services immediately.

Our platform is designed to support responsible use across multiple jurisdictions, including privacy, consumer protection, call consent, SMS compliance, and payment-security obligations where applicable.

2.1 — Data from Subscribers (Business Accounts)

• Business name, email address, phone number, website
• Business EIN / Tax ID (required for Twilio KYC phone provisioning)
• Physical business address
• Billing and payment information (processed by Stripe; we do not store raw card data)
• Account credentials, usage data, configuration settings
• KYC identity verification data (name, business documents) for regulatory compliance
• Campaign contact records uploaded by Subscribers, including names, phone numbers, consent notes, opt-in status, opt-out status, and related campaign metadata
• IP addresses and session metadata

2.2 — Data from End Callers (Processed on behalf of Subscribers)

When callers interact with a Subscriber's AI agent powered by our platform, we may collect and process:

• Caller phone number (inbound call metadata)
• Full name and contact details (if provided during the call)
• Call audio recordings (when recording is enabled by the Subscriber)
• AI-generated call transcripts
• Call duration, timestamps, and metadata
• Information voluntarily provided: location, service needs, appointment requests
• Lead scoring signals: urgency level, intent, sentiment
• Health-related information (for healthcare Subscribers, treated as PHI under HIPAA)

⚠️ End Callers are data subjects of the Subscriber. CallMyBusiness.ai processes this data as a data processor/service provider under the Subscriber's instructions. Subscribers are responsible for obtaining required consent from their callers.

2.3 — Data from Website Visitors & Demo Leads

• Name, email, and optional phone number (if requesting a guided sales demo)
• Industry, business name, demo goals, and preferred meeting time (optional except where required by the booking form)
• IP address, browser type, referral source
• Cookie-based tracking (see Section 15)

2.4 — Automatically Collected Technical Data

• Log data: request timestamps, error logs, API calls
• Device and browser fingerprints
• Feature usage telemetry (non-PII)

We use personal data for the following purposes, each grounded in a lawful basis:

Our platform enables Subscribers to record, transcribe, and analyze calls using AI technology powered by Retell AI. Call recording is only enabled when the Subscriber explicitly configures it and is legally responsible for complying with applicable recording consent laws.

Recording Consent Requirements

Recording consent laws vary by jurisdiction. Many U.S. states require two-party (all-party) consent before recording a phone call, including but not limited to: California, Florida, Illinois, Maryland, Massachusetts, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington.

Subscribers are legally required to:

• Inform callers that the call may be recorded and/or handled by AI
• Obtain affirmative consent where required by applicable state or federal law
• Configure their AI agent greeting to include a recording disclosure
• Maintain records of consent where required

⚠️ By accepting our Terms of Service, Subscribers agree to bear sole legal responsibility for complying with all applicable call recording and AI disclosure laws in their jurisdiction.

AI Processing of Call Data

• Calls are processed in real-time by our AI engine (Retell AI integration)
• Transcripts, summaries, and lead scoring are generated automatically
• Personally identifiable information (PII) may be extracted and stored in the Subscriber's dashboard
• Aegis AI monitors for security threats, prompt injection, and PII leaks — flagged content is redacted
• AI analysis is used to generate call outcomes, sentiment scores, and recommended actions

Data Minimization

We apply PII redaction by default in audit logs. Subscribers can enable full PII retention in their settings, subject to their own compliance obligations.

Our platform supports SMS follow-up communications and sales demo booking follow-up, subject to the Telephone Consumer Protection Act (TCPA) and applicable FCC regulations where phone or SMS contact is used.

Sales Demo Requests (Website Visitors)

Visitors may request a guided product demo with Rayan, our AI Sales & Marketing Manager. The booking form records contact consent and a preferred meeting time. Submitting the form does not automatically place an AI demo call and does not itself confirm a calendar appointment.

• Contact consent is explicitly displayed and checked before submission
• Consent is timestamped and stored with the booking request
• Phone contact is used only when a visitor provides a valid phone number and requests or permits phone follow-up
• Visitors may withdraw follow-up consent by contacting privacy@callmybusiness.ai

SMS Notifications to Callers (Subscriber Feature)

Subscribers may enable SMS follow-up messages to callers. Subscribers are solely responsible for:

• Obtaining TCPA-compliant prior express written consent from recipients
• Maintaining and honoring opt-out requests (STOP messages)
• Registering phone numbers with The Campaign Registry (TCR) for A2P 10DLC compliance
• Complying with all applicable federal, state, and industry-specific messaging regulations

SMS Messaging & Mobile Privacy

By onboarding with CallMyBusiness.ai, submitting forms, requesting services, booking appointments, or interacting with AI receptionist workflows, users consent to receive service-related SMS messages, phone calls, verification codes, appointment reminders, AI receptionist updates, and related communications from CallMyBusiness.ai or Subscribers using our platform.

• Mobile information will not be shared, sold, rented, or transferred to third parties or affiliates for marketing or promotional purposes.
• Message frequency may vary depending on customer interaction, onboarding activity, appointment scheduling, AI receptionist workflows, and requested services.
• Message and data rates may apply.
• Users may reply STOP to unsubscribe or HELP for support.
• CallMyBusiness.ai may use third-party communication providers including Twilio, Retell AI, and telecommunications partners to deliver SMS messages, phone calls, verification codes, appointment reminders, and AI receptionist services.

Opt-Out

Recipients can opt out of SMS communications at any time by replying STOP to any message. Users may reply HELP for support. Opt-outs are honored within one business day. To opt out of sales demo follow-up, contact privacy@callmybusiness.ai.

Subscribers may upload contact records for SMS Campaigns and future Call Campaign features only for contacts who have clearly opted in to receive SMS messages, calls, or automated communications from that Subscriber's business.

• Subscribers are responsible for the accuracy, legality, and completeness of uploaded consent records.
• Subscribers may not upload purchased lists, scraped contacts, harvested phone numbers, third-party lists without valid consent, or contacts who opted out.
• When uploading campaign contacts, Subscribers may be required to confirm that contacts opted in and that they accept responsibility under our Terms and SMS & Calling Policy.
• CallMyBusiness.ai may use opt-out, STOP reply, delivery, complaint, and suppression data to block or prevent messages or calls to contacts who should not be contacted.
• SMS Campaigns and future Call Campaigns may be subject to daily caps, account limits, safety review, billing status, consent checks, and abuse-prevention controls.

CallMyBusiness.ai does not guarantee SMS or call delivery because carriers, providers, customer devices, blocked numbers, consent status, opt-outs, and compliance filters may affect delivery.

We do not sell personal data. We share data only as necessary to operate our platform, under contractual data processing agreements, with the following categories of recipients:

We may also disclose data: (a) to comply with legal obligations, court orders, or government requests; (b) to protect the rights, property, or safety of CallMyBusiness.ai, our users, or the public; (c) in connection with a merger, acquisition, or asset sale (with notice provided).

We retain personal data for the minimum time necessary to fulfill the purposes outlined in this policy:

Upon account termination, Subscriber data is deleted or anonymized within 90 days, except where retention is required by law.

We implement security-minded technical and organizational measures based on industry best practices:

Despite our measures, no method of transmission over the internet is 100% secure. In the event of a data breach, we will notify affected parties in accordance with applicable law (within 72 hours under GDPR Article 33; as required by applicable U.S. state breach notification laws).

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR) (EU 2016/679).

Data Controller vs. Data Processor

• For Subscriber account data: CallMyBusiness.ai is the Data Controller
• For End Caller data: CallMyBusiness.ai is a Data Processor acting on behalf of the Subscriber (Data Controller)

Lawful Bases (GDPR Article 6)

• Contract (Art. 6(1)(b)): Processing necessary to provide our services
• Legitimate Interest (Art. 6(1)(f)): Security, fraud prevention, service improvement
• Legal Obligation (Art. 6(1)(c)): KYC, AML, compliance obligations
• Consent (Art. 6(1)(a)): Marketing communications and sales demo follow-up

International Data Transfers

Data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) as the lawful transfer mechanism for EU personal data transferred to the U.S. (per GDPR Article 46).

Your GDPR Rights

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure / "Right to be Forgotten" (Art. 17)
• Right to Restriction of Processing (Art. 18)
• Right to Data Portability (Art. 20)
• Right to Object (Art. 21): Including to direct marketing
• Right to Lodge a Complaint with your local supervisory authority (e.g., ICO in the UK)

To exercise these rights, contact: privacy@callmybusiness.ai. We respond within 30 days (with up to 2-month extension for complex requests).

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

• Identifiers (name, email, phone, IP address)
• Commercial information (billing, subscription records)
• Audio/electronic data (call recordings, transcripts)
• Internet activity (usage logs, cookies)
• Professional information (business name, industry, EIN)
• Inferences drawn from above to create profiles (lead scoring)

Your CCPA/CPRA Rights

• Right to Know: Categories and specific pieces of personal information collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To submit a CCPA request, contact: privacy@callmybusiness.ai with subject "CCPA Request." We will verify your identity before processing. Response within 45 days (extendable to 90 days).

California residents may also submit requests via our authorized agent with proper written authorization.

If you are a Subscriber operating in a healthcare, medical, or home care context where calls may involve Protected Health Information (PHI), additional legal obligations may apply.

• Healthcare Subscribers are responsible for determining whether HIPAA or similar health privacy rules apply to their use case.
• Subscribers should contact legal@callmybusiness.ai before configuring workflows that may collect PHI.
• Healthcare-related workflows may require additional agreements, disclosures, retention limits, and access controls before use.
• Call recordings and transcripts that may contain PHI should be configured carefully by the Subscriber.

⚠️ Do not use the platform for PHI-heavy workflows until the required legal and configuration review is complete.

Our platform is not directed to or intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or 16 in the EU). If we become aware that we have collected personal data from a minor, we will delete it promptly.

If you believe we have inadvertently collected information from a minor, please contact privacy@callmybusiness.ai immediately.

Regardless of jurisdiction, all users have the following rights:

Submit all rights requests to: privacy@callmybusiness.ai. Please include your full name, email address, and a description of your request. We will verify your identity before processing and respond within the legally required timeframe.

We use cookies and similar tracking technologies on our marketing website:

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling strictly necessary cookies may impair platform functionality.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to active Subscribers at least 30 days before the effective date of material changes
• Display a prominent notice in the application dashboard
• For changes that materially reduce your privacy protections, we will obtain fresh consent where required by law

Your continued use of the platform after the effective date constitutes acceptance of the updated policy. If you disagree with any changes, please discontinue use and contact us to exercise your data rights.

For all privacy-related inquiries, data subject rights requests, or compliance questions:

If you are not satisfied with our response to your privacy request, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction (e.g., the FTC in the U.S., ICO in the UK, or your national DPA in the EU).