Privacy Policy

Who we are & how to contact us

Controller: Instack AI, Inc.
Address: Update your company address here
Email: privacy@instack.ai

Scope

This Policy applies to visitors to our websites, account holders, and end users interacting with our AI phone/voice agents on behalf of our business customers. If you are an end user whose data we process on behalf of a customer, we act as a processor (or “service provider”) and our customer’s privacy policy governs. We process that data in accordance with our customer agreements.

Information we collect

• Account & Profile: name, company, role, email, phone number, authentication identifiers.
• Billing: payment method, billing address, transaction history (processed by our PCI-compliant payment processor).
• Communications & Call Data: call metadata (numbers, timestamps, duration), call audio (if enabled), transcripts, messages (SMS/voice), notes, and related analytics.
• Integrations: connection metadata and data you authorize us to access from third-party services (e.g., CRM, calendar, help desk).
• Technical: device, browser, OS, IP address, approximate location, log files, cookies, page views, and product interaction events.
• User Content: prompts, instructions, and configurations you provide to build/operate your agents.

Sensitive data: We do not intentionally collect sensitive categories unless you or your end users provide them within calls or messages. You must ensure you have a lawful basis to capture any such information and configure redaction where appropriate.

How we use information

• Provide, operate, and improve the Services.
• Enable AI call handling, routing, transcription, and analytics.
• Configure integrations and sync data with third-party tools you choose.
• Personalize features and recommendations.
• Provide support; investigate issues; ensure security and integrity.
• Billing, account management, and service communications.
• Comply with law, enforce terms, and prevent abuse or fraud.
• With your consent, for additional purposes described at collection.

Lawful bases (EEA/UK/Switzerland)

We process personal data under one or more of the following bases: contract necessity, legitimate interests (e.g. to secure and improve the Services), consent (where required), and legal obligation.

How we share information

• Service providers & subprocessors supporting hosting, telephony, transcription, analytics, customer support, and payments.
• Integrations you enable, such as CRM, calendar, and help desk systems, per your configuration.
• Corporate transactions (merger, acquisition, financing, or sale of assets), subject to confidentiality safeguards.
• Legal: to comply with applicable law, enforce agreements, or protect rights, safety, and security.

We do not sell personal information. We do not share for cross-context behavioral advertising without your consent.

Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Customers can configure retention periods for call audio, transcripts, and logs where available.

Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

International data transfers

We may transfer, store, and process information in countries other than where it was collected. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) for international transfers.

Your rights & choices

• Access, rectification, deletion, and portability (where applicable).
• Object to or restrict certain processing.
• Opt out of marketing communications.
• Cookie and tracking preferences via your browser or our controls (if provided).

To exercise rights, contact privacy@instack.ai. If we process your data on behalf of a customer, please contact that customer directly.

California privacy disclosures (CCPA/CPRA)

California residents have rights to know, access, correct, delete, and opt out of certain sharing. We do not “sell” personal information as defined by the CPRA. We may “share” for cross-context behavioral advertising only with your consent. To exercise rights, email privacy@instack.ai.

Children’s privacy

The Services are not directed to children under 13 (or older threshold where required by local law), and we do not knowingly collect personal information from them.

AI-specific processing

• Model providers: We may use third-party AI/voice/ASR/TTS providers as subprocessors to process audio, transcripts, and prompts.
• Training: We do not use your customer content to train foundation models unless you give explicit, informed consent and a contractual agreement permits it.
• Redaction & controls: Optional PII redaction, opt-in call recording, and configurable retention may be available in your admin settings.

Cookies & tracking

We use cookies and similar technologies (e.g., local storage, pixels) for authentication, preferences, analytics, and to improve the Services. You can manage cookies in your browser and, where available, via our cookie banner and settings.

“Do Not Track”

Our Services do not currently respond to browser “Do Not Track” signals.

Third-party links & services

Our Services may contain links to third-party sites or allow you to enable integrations. We are not responsible for the privacy practices of those third parties. Review their policies before sharing data.

Changes to this Policy

We may update this Policy from time to time. The “Last updated” date reflects the latest changes. Material changes will be communicated via the Services or by email where appropriate.

Contact

Questions about this Policy? Email privacy@instack.ai.

Disclaimer

This Policy is provided for informational purposes and does not constitute legal advice. You should consult counsel to tailor this document to your specific operations and regulatory obligations.