Privacy Policy

1. Information We Collect

Account Information

• Name and email address (from Google/Apple sign-in)
• Phone number (for reservations, callbacks, call-related services, and, if you choose to verify a number, SMS one-time-code verification)
• Preferences (such as language, timezone, and gender)
• Profile information you choose to provide (such as preferred name and birthday)

Call Data

• Call transcripts and summaries
• Call outcomes and metadata
• Business information from calls

Payment Information

• Stripe customer ID or Apple subscription ID
• Subscription status (we don't store card numbers)

Device Information

• Push notification tokens for call updates
• Advertising and install identifiers used to measure our advertising. On Android this includes the Google Advertising ID, which you can reset or delete at any time in the Android system settings
• On iOS, Apple asks for permission before we let Meta collect Apple's advertising identifier (IDFA). If you decline, Meta receives no IDFA. The limited advertising events described below are still sent either way, and Apple's SKAdNetwork also attributes installs in aggregate

Support Messages

When you message Callio Support, we store your messages and our replies. A person on the Callio Support team reads them. While answering, we can see your account details, such as your plan, your platform, and your recent calls.

Referral & Abuse Prevention

When you use an invite code, we record that you joined through it, linking your account to the friend who invited you. To keep one-time benefits like invite rewards and free trials fair, we also use a pseudonymous identifier from your Google or Apple sign-in, an approximate network region (never your full IP address), and a device identifier, solely to stop the same person or device from claiming a reward more than once. These signals are used only for abuse prevention, never advertising or profiling. To keep this protection working, one-way hashes of your sign-in and device identifiers are kept for a limited time after you delete your account, solely to prevent repeat claiming of one-time benefits, and they carry no other personal information.

2. How We Use Your Information

• To make calls on your behalf with the information you provide
• To generate call plans, transcripts, summaries, and call updates
• To personalize your experience and improve Callio's reliability, accuracy, and features. We do not use your call transcripts or chat content to train third-party AI models, and we do not use them to train our own models
• To process payments and manage subscriptions
• To send you call updates and important notifications
• To respond to your support requests
• To prevent fraud, abuse, misuse, and security issues
• To measure how well our advertising works, using app install, app open, account creation, and subscription events only. We never use call transcripts, call summaries, or chat messages for advertising

3. Call Recording & AI Disclosure

Important information about how calls work:

• Calls are made by our AI assistant on your behalf
• Calls may be recorded, transcribed, and analyzed for quality assurance, to generate transcripts and summaries, to provide the Service, and to maintain safety
• Where required by law, Callio may disclose that the call may be recorded or transcribed
• Our AI assistant never pretends to be a person: it identifies itself as an AI when asked, and before anything is confirmed on any call that books, changes, or cancels something for you
• Call audio is transmitted to our voice provider (Retell AI) for processing. Audio retention is governed by Retell AI's privacy policy
• Call audio is processed by our voice provider Retell AI under their privacy policy. Callio does not display or download recordings within the app.

4. Third-Party Services

We use trusted third-party services to provide our functionality. Your data may be processed in the United States and other countries where our service providers operate:

Retell AI

Powers our voice calling capability. Call audio is processed by Retell AI under Retell AI's privacy policy, which governs retention. Retell AI may use call data to improve their service. Callio does not display or download recordings within the app.

Stripe

Processes payments securely. We never see or store your full card details.

Apple

Handles iOS in-app purchases and subscription management.

AI Model Providers

We may use AI model providers, such as Google Gemini and OpenAI, to analyze call instructions, call context, transcripts, and related information to generate call plans, summaries, and responses. These providers process data on our behalf according to their applicable data processing terms and do not use your data to train their general-purpose foundation models. Providers may process limited data for abuse detection and safety as described in their terms.

Google Places

Provides business search and information. Your searches are not personally identified.

Firebase

Provides authentication (including SMS delivery of one-time codes when you verify a phone number), database, and notification services with enterprise-grade security.

Resend

Delivers emails we send you, such as replies to support requests. It receives your email address and message content to deliver them.

Meta (Facebook and Instagram)

We never share your call transcripts, call summaries, chat messages, phone number, contacts, or the businesses you search for.

Measures how well our ads on Facebook and Instagram work. Meta's SDK reports a limited set of events from your device on its own: your app install, each time you open the app, free trial start, subscription start, the subscription price, and an advertising identifier, which is a different kind of identifier on Android than on iOS as described below. Callio itself sends one event, when you create an account, along with whether you used Google or Apple to create it. Basic device and app information is sent along with those events.

On Android, these events are sent directly to Meta and they carry the Google Advertising ID, along with basic device information and your network address. The Google Advertising ID is provided by your device to the apps on it, so Meta can recognize it in other apps too. You can reset or delete it at any time in the Android system settings.

On iOS, these events are sent directly to Meta. They always carry an identifier specific to your install of Callio, basic device information, and your network address. Apple also asks whether you allow tracking before Meta can receive Apple's advertising identifier (IDFA). If you allow it, the IDFA may accompany these events so Meta can connect installs and subscriptions to ads across companies' apps and websites. If you decline, Meta receives no IDFA. Apple's SKAdNetwork is also used for aggregate attribution.

California law treats sharing these advertising events as sharing for cross-context behavioral advertising.

Website Analytics & Request Logs

Our marketing website counts aggregate page views and referring sites at the edge using our own Cloudflare-hosted infrastructure. It is privacy-first: it is cookieless, does not fingerprint or track you across sites, and stores no IP address; the only thing kept in your browser is the source tag from the link you arrived on, held for that browser tab and erased when the tab closes. It records only approximate country, the page requested, the referring site, any source tag on the link you followed, such as utm_source, and a few signals used only to tell automated traffic from people, such as whether your browser sent standard language and browser-version headers and how long after the page loaded a download link was tapped.

We also measure clicks on our app download links using our own Cloudflare-hosted endpoints, and we keep short-lived server request logs (including approximate country, browser user-agent, and the page requested) to operate and secure the site. We do not use any of this to advertise to you or to track you across other sites, and we do not sell or share it. Click measurement is aggregate and cookieless; request logs are retained only briefly.

5. Data Retention

• Call audio: processed by Retell AI and retained per Retell AI's privacy policy. Callio does not display or download recordings.
• Call transcripts and summaries: retained until you delete your account.
• Account data: until you delete your account, unless retention is required for legal, security, fraud prevention, or operational reasons
• Payment and subscription records: retained as required by law for tax, accounting, and compliance purposes (up to 7 years), and anonymized after account deletion
• Advertising events shared with Meta: held by Meta under its own policies and retention schedules, which we do not control
• Website request logs and aggregate click counts: short-lived, kept only for site operation, security, and aggregate measurement

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Request access to or a copy of your personal information
• Request deletion of your account and associated personal information
• Request information about how your data is used and shared
• Lodge a complaint with a data protection authority

Access these options in Settings > Data Management, or contact us at support@callio-app.com.

California Privacy Rights (CCPA)

California residents may have additional rights, including the right to know what personal information we collect and how it is used, the right to request deletion of personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information.

We do not sell your personal information. We do share a limited set of advertising events with Meta so we can measure how well our advertising works, and California law treats this as sharing for cross-context behavioral advertising. We do not use sensitive personal information for purposes other than providing and securing the Service.

To be clear about what these controls do and do not do: they govern the advertising identifier, not the sharing itself. The limited advertising events described above are sent to Meta either way. On iOS, denying tracking in Apple's prompt, or changing it later in Settings > Privacy & Security > Tracking, means Meta receives no IDFA, so those events cannot be joined to you inside other companies' apps. On Android, resetting or deleting the Google Advertising ID in Android settings starts a new identifier rather than stopping the sharing. If you want the sharing itself to stop, contact support@callio-app.com.

To exercise your rights, use Settings > Data Management or contact support@callio-app.com.

7. Data Security

We implement industry-standard security measures:

• All data encrypted in transit (TLS 1.3) and at rest
• Secure authentication via Google/Apple OAuth
• Regular security audits and monitoring

8. Children's Privacy

Callio is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact privacy@callio-app.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days in advance via email or in-app notification. Continued use after the effective date constitutes acceptance of the updated policy.

10. Contact Us

For questions about this Privacy Policy or your personal data, please contact us: