1. Who we are and who this policy covers
RinglyAI, Inc. ("RinglyAI", "we", "us") provides an AI phone receptionist that answers calls on behalf of businesses, books appointments, captures leads and alerts the business when a call is missed.
This policy covers two different groups of people, and your rights differ depending on which one you are:
| You are… | Our role | Who to contact about your data |
|---|---|---|
| A customer — a business that subscribes to RinglyAI, or a user on that account | Data controller for your account, billing and configuration data | Us, at privacy@ringly.ai |
| A caller — you dialled a phone number answered by a RinglyAI receptionist | Data processor, acting only on the instructions of the business you called | The business you called. They decide what is collected and how long it is kept. We will forward requests to them. |
| A visitor — you are browsing this website | Data controller for limited technical and account-creation data | Us, at privacy@ringly.ai |
2. What information we collect
Account and business information
- Your name, work email address, and a password (stored only as a bcrypt hash — we never hold the password itself).
- Your business name, industry, timezone, address, business phone number and opening hours.
- The configuration you give your receptionist: its persona and voice, your services and prices, your policies, your knowledge base documents, and the number calls transfer to.
Call information
When someone calls a phone number connected to your RinglyAI account, we process:
- The caller's phone number, the number they dialled, and the time, duration and outcome of the call.
- Call audio and its transcript, where recording is enabled on your account.
- Voicemail recordings and their transcripts.
- Anything the caller tells the receptionist — which, depending on your industry, may include their name, contact details, appointment reason, service address, vehicle details or insurance provider.
- The appointments, leads and follow-up SMS messages generated from the call.
Sensitive categories
Callers to a healthcare, legal or financial practice may volunteer health information or details of a legal matter without being asked. We do not solicit special-category data, but we cannot prevent a caller from speaking it. Where you operate in a regulated sector, you are responsible for confirming that our processing meets your obligations before you route live calls to us.
Billing information
Subscriptions are processed by Stripe. Card numbers are entered directly into Stripe's hosted checkout and are never transmitted to or stored on our servers. We retain your plan, subscription status, invoice history and the billing contact details.
Technical information
Server logs recording IP address, browser user agent, pages requested and timestamps, kept for security, abuse prevention and debugging.
3. Call recording and consent
This obligation is yours, not ours
RinglyAI supplies the technology. You decide whether calls to your number are recorded, and you — not us — are the party responsible for notifying callers and obtaining any consent the law requires.
Recording a telephone call without adequate notice is unlawful in many places. Several US states require the consent of every party to the call, not just one — including California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington. Requirements outside the United States, including under the UK and EU GDPR, are generally stricter still.
If you enable recording, you must ensure your greeting discloses it before the caller speaks, and you must keep that disclosure in place. Because your greeting is fully editable from your dashboard, we cannot enforce this for you.
Calls that cross state or national borders may attract the stricter of the two jurisdictions' rules. If you take calls from outside your own state or country, take advice on which applies.
4. How we use information, and our legal bases
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Answering, routing and transferring calls; booking appointments | Call data, business configuration | Performance of a contract |
| Alerting you by SMS when a call is missed | Caller number, call outcome, your notification number | Performance of a contract |
| Creating and administering your account | Account data | Performance of a contract |
| Taking payment and preventing failed billing | Billing data | Performance of a contract |
| Securing the service, preventing fraud and telecoms abuse | Technical logs, call metadata | Legitimate interests |
| Diagnosing faults and improving reliability | Technical logs, call metadata | Legitimate interests |
| Meeting legal, tax and telecommunications obligations | Billing and call records | Legal obligation |
| Sending product and marketing email to customers | Account data | Consent, withdrawable at any time |
We do not train models on your calls
Your call recordings, transcripts and knowledge base documents are not used to train any general-purpose or shared machine learning model, and are not pooled with other customers' data for any purpose.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act.
5. Who we share information with
We share personal information only with the service providers below, each bound by contract to process it solely on our instructions.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| SignalWire | Telephony carriage, call recording, speech-to-text, text-to-speech and SMS delivery | Caller phone numbers, call audio, transcripts, voicemail recordings, SMS content | United States |
| Amazon Web Services (Amazon Polly) | Text-to-speech synthesis for the receptionist voice, via SignalWire | The text spoken to the caller | United States |
| Stripe, Inc. | Subscription billing, payment processing and the customer billing portal | Billing contact, card details (held by Stripe, never by us), invoice history | United States |
We may also disclose information where we are legally compelled to — by a court order, subpoena or binding regulatory demand — or where disclosure is necessary to establish or defend a legal claim, or to protect the safety of a person. If our business is sold or merged, account data may transfer to the acquirer, who remains bound by this policy until they give you notice of any change.
6. How long we keep it
| Data | Retention |
|---|---|
| Call recordings and voicemail audio | Kept for the period you configure; deleted on request or on account closure |
| Call transcripts, appointments and leads | Kept for the life of your account, so your dashboard history stays intact |
| Account and configuration data | Kept while your account is open, then deleted within 90 days of closure |
| Invoices and payment records | Kept for 7 years, as tax and accounting law requires |
| Security and server logs | Kept for up to 12 months |
You can ask us to delete call data sooner at any time. Where a legal retention duty applies to a record, we keep that record for the required period and delete it when the period ends.
7. How we protect information
- All traffic to the service is encrypted in transit with TLS.
- Passwords are stored only as bcrypt hashes and are never recoverable, by you or by us.
- Sessions use a signed, HTTP-only cookie; the token is not readable by JavaScript in your browser.
- Every tenant's data is scoped to their organisation on every request, so one customer's dashboard cannot reach another's calls, leads or recordings.
- Inbound telephony webhooks can be cryptographically verified against our carrier's signature before they are accepted.
- Access to production data by our staff is limited to those who need it to operate and support the service.
No system is perfectly secure. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the timeframes the law requires.
8. Your rights
If you are in the UK, EU or EEA
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted where we have no overriding basis to keep it.
- Restriction and objection — limit or object to processing carried out under our legitimate interests.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, where consent was the basis for processing.
- Complain to your supervisory authority — in the UK, the Information Commissioner's Office.
If you are in California
- Know what personal information we collect, use and disclose, and obtain a copy.
- Delete personal information we hold about you, subject to statutory exceptions.
- Correct inaccurate personal information.
- Limit the use of sensitive personal information.
- Be free from retaliation — we will never degrade your service because you exercised a right.
Making a request
Email privacy@ringly.ai. We respond within 30 days, and will tell you if we need longer. We may ask you to verify your identity first — an unverified deletion request is itself a security risk.
If you were a caller, not a customer
When you rang a business that uses RinglyAI, that business — not us — decides what happens to your information. Send your request to them directly; they can action it immediately. If you contact us instead, we will pass it on and tell you we have done so, but we cannot act on it ourselves.
9. International transfers
Our infrastructure and our providers are located in the United States. If you or your callers are outside the United States, personal information is transferred there. Where the transfer originates in the UK, EU or EEA, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical safeguards including encryption in transit.
10. Children
RinglyAI is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us through a call, contact us and we will delete it.
12. Changes to this policy
We update this policy when the service or the law changes. The date at the top always reflects the current version. If a change materially affects your rights or how we use your information, we will email account owners before it takes effect.
Questions about this policy? Write to legal@ringly.ai or use the contact page.