Privacy policy.

What we collect

To provide the ModPhone service we collect the following categories of information:

Account information

• Your name, email address, business name, and billing address
• Payment information (processed by our payment providers — we never store full card numbers)
• Authentication credentials (password hashes and session tokens)

Agent configuration & knowledge

• Content from websites, documents, and sources you upload to teach your agent
• Agent prompts, voice selection, business hours, and other settings you configure
• Integration credentials (calendar OAuth tokens, CRM API keys, Shopify tokens) — stored encrypted

Conversation data

• Call audio (if recording is enabled), transcripts, SMS messages, emails, and chat logs
• Caller phone numbers, email addresses, and any details the caller shares
• Call metadata: timestamp, duration, outcome, transfer destination if applicable

Usage data

• Pages visited on our dashboard, features used, error reports
• IP address, browser type, and device information for security and debugging

How we use it

We use your information to:

• Operate the AI that answers your customers — retrieving your knowledge base, processing conversations, sending confirmations
• Deliver your account and the features you’ve configured
• Bill for usage and prevent abuse
• Investigate bugs, incidents, and fraud
• Send you service-related email (receipts, security alerts, product updates you opted into)

What we don’t do

• We do not sell your data, customer data, or conversation data to third parties.
• We do not use your customer conversations or knowledge base to train shared AI models.
• We do not read your conversations for marketing targeting.

Who we share with

We share data only with sub-processors needed to run the service. Those include:

• Voice & telephony: Twilio, Daily.co, and (for some unified numbers) their upstream carriers
• AI model providers: Anthropic, OpenAI, Groq, Gemini, ElevenLabs, Cartesia, Deepgram — each covered by their own data-processing terms; none of them train shared models on your data in our configuration
• Cloud hosting: AWS and Neon for application and database hosting
• Email delivery: SendGrid / SMTP providers for transactional email
• Payments: Stripe for subscription billing
• Analytics: Google Analytics for aggregated marketing-site usage (with IP anonymization)

We will share data with law enforcement only when legally compelled to do so.

How ModPhone handles Google user data

If you connect a Google account to ModPhone (Google Workspace email, Google Calendar, or Google Sheets), the following applies to all Google user data we receive through Google APIs. ModPhone’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data accessed

Depending on which integrations you enable, ModPhone accesses:

• Basic profile: your Google account email address and profile identifier, to identify which account is connected.
• Gmail (email integration): reads messages received in the connected mailbox, sends replies on your behalf, and manages send-as alias settings so replies can come from your chosen address.
• Google Calendar (appointment booking): reads availability and creates, updates, or cancels events when callers book appointments.
• Google Sheets & Drive (call logging): appends call records to spreadsheets you select. We use the drive.file scope, which only grants access to files you explicitly pick or that ModPhone creates — never your whole Drive.

Data usage

Google user data is used solely to provide the features you have enabled: routing incoming email to your AI agent and sending its replies, checking availability and booking appointments, and logging calls to your spreadsheets. We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.

Data sharing

We do not sell Google user data, and we do not share it with third parties except the sub-processors strictly necessary to provide the features above:

• AI processing: the content of emails handled by your agent is processed by our AI model provider (Anthropic) solely to generate responses on your behalf. Under our API agreements, this content is not used to train their models.
• Infrastructure: our application and database hosting providers (listed in “Who we share with” above), which store data on our behalf under data-processing agreements.

No humans at ModPhone read your Google user data except with your explicit permission for support, when required for security investigation or abuse prevention, or when legally compelled.

Data storage & protection

Google user data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Google OAuth access and refresh tokens are additionally encrypted at the application layer (AES-256-GCM) before being written to our database, and are never exposed to the browser or included in API responses. Access inside ModPhone is restricted by role-based controls.

Data retention & deletion

• Disconnect anytime: removing a Google integration from your dashboard immediately revokes ModPhone’s access with Google and permanently deletes the stored OAuth tokens.
• Derived data: email threads and appointment records created through an integration remain in your account (they’re your business records) and can be deleted from your dashboard at any time.
• Account closure: closing your account deletes all stored Google user data within 30 days, except where retention is legally required.
• Deletion requests: you can also request deletion of any Google user data by emailing hello@modphone.ai; we complete verified requests within 30 days.

You can additionally revoke ModPhone’s access at any time from your Google account’s security settings.

Where data is stored

Your account and conversation data is stored in the United States by default. EU data residency is available on the Enterprise plan. Backups are encrypted and retained for disaster recovery, with configurable retention windows on paid plans.

Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls inside our organization
• Full audit logs of configuration changes on paid plans
• Regular vulnerability scanning and penetration testing
• Security disclosure: email hello@modphone.ai with security in the subject line

Your rights

You can:

• Access and export your account data, call transcripts, and knowledge base content at any time from your dashboard
• Delete any content from your knowledge base, or your entire account
• Configure call recording, transcript retention, and data export behavior
• Request deletion of specific caller data (we’ll honor right-to-be-forgotten requests under GDPR and CCPA)
• Close your account at any time — we delete account data within 30 days of closure, except where legally required to retain

Cookies & tracking

Our marketing website uses cookies for analytics (Google Analytics) and conversion tracking (Google Ads). Our dashboard uses cookies for authentication only. You can disable cookies in your browser without losing access to the dashboard.

Children

ModPhone is not intended for use by children under 16. We don’t knowingly collect information from anyone under 16.

Changes to this policy

If we materially change how we handle your data, we’ll email account owners at least 30 days before the change takes effect.

Contact

Questions, complaints, or requests under GDPR / CCPA: email hello@modphone.ai. A real person reads it.