Legal

Privacy Policy

Last updated June 23, 2026

This Privacy Policy explains how Oncalled collects, uses, stores, and shares information when you use our AI voice receptionist service (the “Service”), our website, or interact with us. Oncalled is operated by Holden King as a sole proprietorship out of Pasadena, CA.

1. Information we collect

From customers (you, the business signing up for the Service):

• Account info: business name, contact name, email, phone, address (via Stripe).
• Payment info: handled by Stripe; we do not store card numbers.
• Configuration: business hours, FAQ content, dispatch numbers, integrations.
• Usage logs: timestamps, durations, costs, and outcomes of calls handled by your account.

From callers (people who call your business number):

• Phone number (caller ID).
• Audio recording of the call.
• Real-time transcript of the call.
• Any information the caller provides during intake (name, address, problem description, email, preferred callback time, etc.).

From leads (people who submit a Facebook / Instagram lead ad form for a business that uses Oncalled):

• The fields you entered into the lead form (typically name, phone, email, and any custom questions the business added).
• The Meta-generated lead identifier, ad ID, form ID, and page ID associated with your submission.
• The timestamp of your submission.
• If a callback is placed: the same call data described under “From callers” above.

We receive this information from Meta via the Lead Ads webhook on behalf of the business whose ad you submitted, for the sole purpose of contacting you about that business’s services as you requested when submitting the form.

2. How we use information

We use information to:

• Provide the Service (answer calls, route them, book appointments, send notifications);
• Improve the Service (review failed calls, tune prompts, fix bugs);
• Bill you and process payments;
• Communicate with you about your account and the Service;
• Comply with legal obligations.

We do not sell your data, your callers’ data, or any audio recordings to advertisers or data brokers. We do not use your data to train general-purpose AI models.

3. Recording and AI disclosure

Calls handled by a Oncalled-managed AI assistant are configured to open with a clear disclosure that the voice is an AI assistant and that the call is being recorded. If a person declines recording or says they are not comfortable speaking with an AI, the assistant is configured to stop, offer a follow-up from a human, and end the call rather than continue on a recorded line; if a person asks not to receive further calls, the platform records that request. These controls are designed to support transparency and consent obligations, including California Penal Code §§ 631, 632, and 632.7 and applicable telephone-consumer-protection rules; they are not a substitute for advice from qualified counsel about a particular campaign or jurisdiction.

Real-time processing by service providers. To answer and handle a call, the live audio and transcript are processed in real time by the third-party technology providers listed in Section 4 (including the telephony, speech-to-text, voice, and large-language-model vendors). These providers act as our service providers / processors: they are permitted to use the contents of a call solely to deliver the Service to us and not for their own independent purposes. The opening disclosure that the call is handled by an AI assistant and is being recorded is intended to inform all parties that automated systems and these service providers are part of the call.

If your business operates in another jurisdiction with stricter recording or AI-disclosure laws, you are responsible for any additional disclosures required.

4. Where data is stored

We use third-party processors to operate the Service. Each handles data per its own privacy policy:

• Vapi — voice AI orchestration, call recordings, transcripts.
• Telnyx — phone numbers and call routing.
• Meta (Facebook / Instagram) — source of lead-ad submissions when a business uses our Meta Lead Ads integration. Meta’s handling of your data prior to delivery to us is governed by Meta’s privacy policy.
• OpenAI / Anthropic / Google — large language models that generate the bot’s responses.
• ElevenLabs — voice synthesis.
• Deepgram — transcription.
• n8n (self-hosted on DigitalOcean) — workflow execution and per-call data storage.
• Google Calendar — appointment booking.
• Stripe — payment processing.
• Vercel + Cloudflare — website hosting and DNS.
• Plausible — privacy-respecting website analytics (no cookies, no cross-site tracking).

5. Retention

Call recordings, transcripts, and ordinary lead records are retained for ninety (90) days by default and then auto-deleted, unless a different period is required or agreed in writing. Limited compliance records—including consent evidence, do-not-call requests, the script/disclosure version, and call-ledger facts required for telemarketing recordkeeping—may be retained for at least five (5) years. Account and billing records are retained for as long as the account is active and for a reasonable period afterward to meet legal, tax, and accounting obligations.

6. Sharing

We share information only:

• With the third-party processors listed above, as needed to operate the Service;
• With you (the customer), as the data controller for your callers’ data;
• When required by law, court order, or legal process;
• In connection with a merger, acquisition, or sale of all or substantially all of our assets, with notice to you.

7. Security

We use commercially reasonable measures to protect data in transit (HTTPS) and at rest (encrypted storage on infrastructure providers). No system is perfectly secure; we cannot guarantee absolute security. You are responsible for protecting your account credentials.

8. Your rights (California residents)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to: (a) know what personal information we collect and how we use it; (b) request deletion of personal information; (c) request correction of inaccurate personal information; (d) opt out of the “sale” or “sharing” of personal information (we do not sell or share for cross-context behavioral advertising); (e) limit the use of sensitive personal information; and (f) be free from retaliation for exercising any of these rights. To exercise these rights, email us at [email protected]. We will verify your identity before responding.

9. Your rights (residents of other U.S. states)

Several other U.S. states — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as their laws take effect — give residents privacy rights similar to those above, such as the right to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising or the “sale” of personal information. We do not sell personal information and do not use it for cross-context behavioral or targeted advertising. Note that some of these laws — such as the Texas Data Privacy and Security Act — can apply regardless of our size or revenue. Regardless of where you live, you may make the same access, correction, and deletion requests by emailing [email protected]; we will honor them to the extent the applicable law requires and will verify your identity before responding. If we deny a request, you may appeal by replying to our response.

10. Children

The Service is intended for businesses, not for individuals under 18. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through the Service, contact [email protected] and we will delete it.

11. Facebook / Instagram (Meta) lead ad data

When a business that uses Oncalled runs a Facebook or Instagram Lead Ad and you submit the form, Meta transmits your submission to us via webhook so we can promptly contact you on the business’s behalf — which is the action you requested when you tapped “Submit” on the form.

What we receive: a lead identifier issued by Meta, the form fields you filled out, the ad/form/page IDs, and the time of submission.

How long we keep it: lead submission data is retained for ninety (90) days by default and then deleted, matching our general call-data retention. The business that ran the ad may request a longer retention period in writing for their own records.

How to request deletion: you can request deletion of your data at any time by (a) removing Oncalled from the apps connected to your Facebook account, which triggers our automatic data deletion callback, or (b) emailing [email protected] with the phone number or email you used on the form. Deletion is completed within 30 days; you will receive a confirmation code you can use to verify status at oncalled.com/api/meta/data-deletion-status.

How we do not use it: we do not sell lead data, share it with parties other than the business whose ad you submitted, use it for any other business’s marketing, or use it to train general-purpose AI models.

12. Changes to this Policy

We may update this Privacy Policy at any time by posting the updated version on our website and updating the “Last updated” date. Material changes will be communicated via email to active customers.

13. Contact

Privacy questions or requests can be sent to [email protected].