AI Phone Receptionist — Privacy Policy
This policy covers NexusCaller's AI Phone Receptionist (app.nexuscaller.com). It applies to two groups: our customers — businesses whose phone calls the receptionist answers — and callers who phone those businesses. For callers, the business they call decides how their information is used (it is the "controller" or "business"); NexusCaller processes it on that business's behalf (as its "processor" or "service provider") under our Data Processing Agreement. Plans also include NexusCaller's AI Website Chat; how chats on a business's website are handled is described in the AI Website Chat Privacy Policy.
1. What we collect
| About | Data | Why |
|---|---|---|
| Customers | Name, email, business name, billing email; password stored only as a secure hash; sign-in and admin activity log; acceptance of these terms (time, version and IP address, kept as proof of the agreement) | To run and secure the account and send service emails |
| Customers | Subscription, plan and call-minute usage. Payments are handled by Stripe — we never see or store card numbers. | Billing |
| Customers | The public pages of the website they submit; the knowledge, instructions and settings they add, such as the staff number for call transfers and the email address for call summaries | To build and run their receptionist |
| Callers | Phone number (caller ID), the number called, date, time and duration of the call | To answer and log the call and let the business call back |
| Callers | Voice recording of the call and its transcript | So the business can review what was said and follow up |
| Callers | Anything they choose to say, such as name, email, address or the reason for calling | Passed to the business so it can help them |
| Callers | A summary our AI makes of the call: who called, what they need, and whether a follow-up is needed | Emailed to the business so it can prioritize and respond |
We do not create voiceprints or use recordings to identify callers by their voice. We do not sell or share personal data for advertising, and we do not use calls to train AI models.
We do not respond to browser Do Not Track signals, and we do not allow third parties to track you across websites through our service.
2. AI transparency and call recording
Every call starts with a fixed spoken notice, before the receptionist says anything else, telling callers that the call is answered by an AI assistant and is recorded. Businesses cannot remove it. This is how we meet AI transparency requirements, including the EU AI Act's obligation to inform people that they are interacting with an AI system, and how callers are told that the call is recorded.
Calls are recorded and transcribed so the business can review them. Recordings are streamed only to signed-in users of the business that received the call, through the portal at app.nexuscaller.com; transcripts are likewise available only to those users. NexusCaller accesses them only where needed to operate and support the Service. If you do not want to be recorded, you can end the call and contact the business another way. If a call is transferred to the business's own staff line, the conversation continues with that business's staff.
On a business's website, the included AI Website Chat shows visitors, before they write, a fixed notice: "You're chatting with an AI assistant. Chats are recorded and processed by NexusCaller and its AI providers for [Business]. By continuing, you agree to the Privacy Policy." [Business] is the name of the business, and "Privacy Policy" links to that business's privacy policy or, if it has not provided one, to a chat privacy notice we host for it.
3. Service providers (sub-processors)
| Provider | What it does | Location |
|---|---|---|
| Railway | Hosts the application and database | United States |
| Vapi | Voice AI platform: runs the calls, recordings and transcripts | United States |
| Twilio | Telephony: phone numbers and call connections | United States |
| Deepgram, Microsoft Azure (via Vapi) | Speech recognition (turning callers' speech into text) | United States |
| ElevenLabs (via Vapi) | Synthetic voices for Bulgarian-language calls | United States |
| OpenAI, Google, Anthropic | AI models that generate the receptionist's replies and call summaries | United States |
| Stripe | Customer payments | United States |
| Resend | Service emails and call-summary emails | United States |
Each processes data only to provide its part of the Service, under contract. We give customers at least 30 days' notice before adding a new sub-processor.
4. How long we keep data
| Data | How long we keep it |
|---|---|
| Call records, recordings, transcripts, call summaries and leads | 12 months after the call, then deleted automatically — in our systems and at Vapi — or earlier if the business deletes them |
| Chats and leads from the included website chat | 12 months after the chat, then deleted automatically — or earlier if the business deletes them |
| Customer account data: account details, receptionists, knowledge, instructions and settings | While the account is open, and for 30 days after it closes |
| Sign-in and audit logs; records of acceptance of our terms | 6 years after the account closes, as proof of the agreement and for security |
| Billing records, including call-minute usage | As tax law requires — typically 7 years — at Stripe and with us |
When a customer closes their account, we delete their receptionists, knowledge, calls and chats within 30 days. Summary emails already delivered to a business are under that business's control. Our providers may keep limited logs (e.g. abuse monitoring, email delivery) for up to 30 days under their own terms.
5. Security
Encrypted connections (HTTPS); hashed passwords; two-step sign-in for administrator access; each customer can see only its own data, and recordings are reachable only by signed-in users of that business; call events from our voice platform are verified with a shared secret; an audit log of administrative actions; provider keys stored encrypted; and protections against misuse of the website reader.
6. Your rights
Callers: to access, correct or delete information about your calls, including recordings, contact the business you called. You can also email info@nexuscaller.com; we will pass your request to that business and help it respond. Businesses can find and delete all calls linked to a phone number or email address in one step.
Customers: you can delete your data from your account at app.nexuscaller.com, or email us.
7. European Union and EEA (GDPR)
For callers, the business you call is the controller and determines the legal basis (typically its legitimate interest in answering and keeping a record of calls, or steps taken at your request before a contract). For customers' account data, NexusCaller is the controller and relies on the performance of our contract and on our legitimate interest in securing the Service.
You have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Data is processed in the United States; transfers rely on the European Commission's Standard Contractual Clauses (and, where our providers are certified, the EU–US Data Privacy Framework). You have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where you believe the infringement took place.
EU representative (GDPR Art. 27): [to be added — name, address, email]
8. California (CCPA/CPRA)
For callers, NexusCaller acts as a service provider to the business: we process personal information only to provide the Service, and do not sell or share it or use it for our own purposes. For customers' account data, NexusCaller is the business responsible for it.
California residents have the right to know what personal information is collected about them and how it is used and disclosed, to access it, to correct it if it is inaccurate and to have it deleted, and to use an authorized agent to make a request for them. We verify requests by matching the email address or phone number used with the Service; we may ask an authorized agent for proof of your permission. We have not sold or shared personal information (as the CCPA defines those terms) in the past 12 months. We use sign-in credentials only to provide the Service. We will not discriminate against anyone for exercising these rights. Callers can send requests to the business they called, or to info@nexuscaller.com; customers can email us there.
9. Children
The Service is for businesses and is not directed at children. Please do not share personal information on a call if you are under 16.
10. Changes and contact
We will post changes here and notify customers at least 30 days before material changes. Questions: NexusCaller LLC · info@nexuscaller.com.