Menu

Privacy Policy

Welcome to Ai Boost Kit, an AI-powered phone receptionist platform provided by Bluecarbon Technologies Inc ("Company", "we", "us", or "our"). Our platform answers, transcribes, and manages phone calls on behalf of our business customers — handling live voice conversations, appointment scheduling, SMS follow-ups, and outbound calling campaigns through an administrative dashboard. We are committed to maintaining the highest standards of data protection and individual privacy for our customers, their end callers, and all individuals who interact with our systems.

This Privacy Policy explains how personal information and call interaction data are collected, processed, secured, and shared across the platform.

1. Information We Collect

Our collection of data is categorized by the nature of the interaction with our platform.

1.1 Website & Platform Visitors

When you visit our website or dashboard, we automatically collect:

  • Device Information: Browser type, operating system, and device identifiers.
  • Log Data: IP address, access times, and navigation history.
  • Interaction Data: How you interact with our dashboard, including navigation paths and feature usage.

1.2 Registered Users (Account Owners)

Upon registration and subscription, we collect:

  • Identification Data: Full legal name, email address, and account password (hashed, never stored in plain text).
  • Organization Data: Company name and business information used to configure your AI receptionist agents.
  • Financial Data: Payment method details and billing history. All sensitive payment information is processed directly by our payment processor, Stripe, and is not stored on our servers.
  • API Keys (optional): If you choose to "bring your own key" for a supported third-party service (e.g., your own OpenAI or Twilio account), that credential is stored encrypted at rest and used only to place calls/generate responses on your behalf.

1.3 Call, Scheduling & Messaging Data (The Core Service)

Operating a phone receptionist requires processing the following categories of data, both for our business customers and for the end callers/contacts who interact with a customer's AI agent:

  • Voice and Telephony Data: Real-time audio streams and call signaling data (caller/callee phone numbers, call duration, call status) needed to answer, transcribe, and speak on a call.
  • Call Recordings and Transcripts: Where enabled, calls are recorded and transcribed to text.
  • Call Summaries: After a call ends, our system uses an LLM to generate a short summary of the call and extract any message left for the business owner, so it can be surfaced on the dashboard.
  • SMS/Text Message Data: Content and delivery metadata for SMS notifications and outbound text messages sent through the platform.
  • Scheduling Data: Appointment details exchanged with a customer's connected Google or Microsoft Calendar to book, reschedule, or cancel appointments during a call.
  • Outbound Campaign & Contact Data: For customers using outbound calling, the phone numbers, names, and call outcomes of contacts uploaded to a campaign, plus any answers a contact gives to configured qualifying questions.
  • Metadata: Call duration, timestamps, call direction (inbound/outbound), and usage/billing statistics (e.g., minutes consumed).

2. How We Use the Data

We process data under the following legal and operational frameworks:

2.1 Provision of Services

  • To answer, transcribe, and respond on live phone calls using your configured AI agent(s).
  • To book, update, and cancel calendar appointments on your behalf.
  • To send SMS notifications and run outbound calling campaigns you configure.
  • To provide an administrative dashboard for reviewing call logs, transcripts, recordings, campaign performance, and usage/billing.

2.2 Improvement and Optimization

  • No AI Model Training: We do not use your call recordings, transcripts, or account data to train or fine-tune any AI models — ours or a third party's. This data is used only to deliver and support your account (e.g., generating a call summary for your dashboard), not for model improvement or research purposes.
  • System Health: We monitor latency, error rates, and infrastructure performance to keep the platform reliable.

2.3 Compliance and Security

  • Abuse Prevention: Monitoring for violations of our Acceptable Use Policy (e.g., unlawful robocalling, harassment, or prohibited call content).
  • Fraud Detection: Detecting and preventing unauthorized access or financial irregularities.
  • Legal Compliance: Complying with tax records, telecommunications regulations, or valid legal requests.

3. Data Sharing and Third-Party Sub-Processors

We do not sell, rent, or lease your personal information to third parties for marketing purposes. To operate the platform, we share data with the following categories of service providers ("sub-processors"), each limited to what is required for their function:

Telephony (voice & SMS)

  • Twilio: Places and receives phone calls and SMS messages; carries live call audio and delivers status/webhook events back to our platform.
  • Telnyx: Alternate telephony provider used for some customer phone numbers/accounts; performs the same call and SMS carriage function as Twilio.

AI / Language Processing

  • OpenAI: Processes call transcripts and conversational text to generate the AI agent's spoken responses, and generates post-call summaries.

Speech Processing

  • Deepgram: Converts live caller audio into text (speech-to-text) in real time during a call.
  • ElevenLabs: Converts the AI agent's text responses into spoken audio (text-to-speech) played back to the caller.

Scheduling

  • Google Calendar: When a customer connects a Google account, appointment data (event times, attendee details supplied during the call) is read from and written to that calendar via OAuth.
  • Microsoft Calendar (Outlook): Same function as Google Calendar, for customers who connect a Microsoft/Outlook account instead.

Payments

  • Stripe: Processes subscription billing, card payments, and stores payment method tokens; we never store raw card numbers.

Storage

  • AWS S3: Stores call recordings and other platform file uploads (e.g., generated documents) in encrypted storage.

4. Data Retention and Deletion

We adhere to the principle of data minimization:

  • Call Recordings, Transcripts & Summaries: Retained for the duration of your active subscription unless explicitly deleted by you through the Platform.
  • Account Data: Retained for as long as your account is active and for a reasonable period thereafter to facilitate account recovery or legal compliance.
  • No Indefinite Retention for Training/Research: Because customer data is not used for AI model training or research (see Section 2.2), we do not retain anonymized copies of call data indefinitely for those purposes.

5. Security Architecture

We employ a multi-layered security approach:

  • Encryption: All data in transit is encrypted using industry-standard TLS. Sensitive data at rest — including OAuth tokens for connected calendars, bring-your-own API keys, and telephony subaccount credentials — is encrypted using AES-256.
  • Access Control: Administrative (staff) accounts and customer accounts are structurally separated into distinct authentication systems, each with its own credentials and session handling, so a customer account can never be used to reach internal administrative tools. Access to production data is limited to essential personnel.
  • Isolation: Customer data is logically scoped per account to prevent one customer from accessing another customer's calls, contacts, or configuration.

6. Your Data Rights

Regardless of your jurisdiction, we strive to provide a high level of control over your data:

  • Access and Portability: You can export your interaction logs and account data from the dashboard.
  • Rectification: You have the right to update any inaccurate information through your profile settings.
  • Erasure: You may request the permanent deletion of your account and all associated data at any time. Requesting deletion deactivates your account immediately (you are logged out and any active subscription is canceled right away); your data is then retained for a 30-day grace period before being permanently and irreversibly deleted.

7. International Data Transfers

Our sub-processors (listed in Section 3) may process data in jurisdictions outside your own, including the United States. By using our services, you consent to this international transfer of data, subject to appropriate safeguards such as those sub-processors' own compliance certifications and data protection agreements.

8. Updates to this Policy

This Privacy Policy is a living document. We reserve the right to modify it as our technology evolves or as regulatory requirements change. Material changes will be communicated via on-platform notifications or email to account owners.

Ai Boost Kit A Product of Bluecarbon Technologies Inc