Legal

Privacy Policy

Last updated June 1, 2026

This Privacy Policy explains how Oncalled collects, uses, stores, and shares information when you use our AI voice receptionist service (the “Service”), our website, or interact with us. Oncalled is operated by Holden King as a sole proprietorship out of Pasadena, CA.

1. Information we collect

From customers (you, the business signing up for the Service):

• Account info: business name, contact name, email, phone, address (via Stripe).
• Payment info: handled by Stripe; we do not store card numbers.
• Configuration: business hours, FAQ content, dispatch numbers, integrations.
• Usage logs: timestamps, durations, costs, and outcomes of calls handled by your account.

From callers (people who call your business number):

• Phone number (caller ID).
• Audio recording of the call.
• Real-time transcript of the call.
• Any information the caller provides during intake (name, address, problem description, email, preferred callback time, etc.).

From leads (people who submit a Facebook / Instagram lead ad form for a business that uses Oncalled):

• The fields you entered into the lead form (typically name, phone, email, and any custom questions the business added).
• The Meta-generated lead identifier, ad ID, form ID, and page ID associated with your submission.
• The timestamp of your submission.
• If a callback is placed: the same call data described under “From callers” above.

We receive this information from Meta via the Lead Ads webhook on behalf of the business whose ad you submitted, for the sole purpose of contacting you about that business’s services as you requested when submitting the form.

2. How we use information

We use information to:

• Provide the Service (answer calls, route them, book appointments, send notifications);
• Improve the Service (review failed calls, tune prompts, fix bugs);
• Bill you and process payments;
• Communicate with you about your account and the Service;
• Comply with legal obligations.

We do not sell your data, your callers’ data, or any audio recordings to advertisers or data brokers. We do not use your data to train general-purpose AI models.

3. Recording and AI disclosure

Every inbound call to a Oncalled-managed number opens with a verbal disclosure that (a) the caller is speaking with an AI assistant, and (b) the call is being recorded. This is intended to satisfy California SB 243 (AI bot disclosure) and California Penal Code §§ 631 / 632 (CIPA two-party consent). If a caller declines or asks to stop recording, the bot is configured to apologize and end the call.

If your business operates in another jurisdiction with stricter recording or AI-disclosure laws, you are responsible for any additional disclosures required.

4. Where data is stored

We use third-party processors to operate the Service. Each handles data per its own privacy policy:

• Vapi — voice AI orchestration, call recordings, transcripts.
• Telnyx — phone numbers and call routing.
• Meta (Facebook / Instagram) — source of lead-ad submissions when a business uses our Meta Lead Ads integration. Meta’s handling of your data prior to delivery to us is governed by Meta’s privacy policy.
• OpenAI / Anthropic / Google — large language models that generate the bot’s responses.
• ElevenLabs — voice synthesis.
• Deepgram — transcription.
• n8n (self-hosted on DigitalOcean) — workflow execution and per-call data storage.
• Google Calendar — appointment booking.
• Stripe — payment processing.
• Vercel + Cloudflare — website hosting and DNS.
• Plausible — privacy-respecting website analytics (no cookies, no cross-site tracking).

5. Retention

Call recordings and transcripts are retained for ninety (90) days by default and then auto-deleted, unless you request a longer retention period in writing. Account information and billing records are retained for as long as your account is active and for a reasonable period afterward to comply with tax and accounting obligations.

6. Sharing

We share information only:

• With the third-party processors listed above, as needed to operate the Service;
• With you (the customer), as the data controller for your callers’ data;
• When required by law, court order, or legal process;
• In connection with a merger, acquisition, or sale of all or substantially all of our assets, with notice to you.

7. Security

We use commercially reasonable measures to protect data in transit (HTTPS) and at rest (encrypted storage on infrastructure providers). No system is perfectly secure; we cannot guarantee absolute security. You are responsible for protecting your account credentials.

8. Your rights (California residents)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to: (a) know what personal information we collect and how we use it; (b) request deletion of personal information; (c) request correction of inaccurate personal information; (d) opt out of the “sale” or “sharing” of personal information (we do not sell or share for cross-context behavioral advertising); (e) limit the use of sensitive personal information; and (f) be free from retaliation for exercising any of these rights. To exercise these rights, email us at [email protected]. We will verify your identity before responding.

9. Children

The Service is intended for businesses, not for individuals under 18. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through the Service, contact [email protected] and we will delete it.

10. Facebook / Instagram (Meta) lead ad data

When a business that uses Oncalled runs a Facebook or Instagram Lead Ad and you submit the form, Meta transmits your submission to us via webhook so we can promptly contact you on the business’s behalf — which is the action you requested when you tapped “Submit” on the form.

What we receive: a lead identifier issued by Meta, the form fields you filled out, the ad/form/page IDs, and the time of submission.

How long we keep it: lead submission data is retained for ninety (90) days by default and then deleted, matching our general call-data retention. The business that ran the ad may request a longer retention period in writing for their own records.

How to request deletion: you can request deletion of your data at any time by (a) removing Oncalled from the apps connected to your Facebook account, which triggers our automatic data deletion callback, or (b) emailing [email protected] with the phone number or email you used on the form. Deletion is completed within 30 days; you will receive a confirmation code you can use to verify status at oncalled.com/api/meta/data-deletion-status.

How we do not use it: we do not sell lead data, share it with parties other than the business whose ad you submitted, use it for any other business’s marketing, or use it to train general-purpose AI models.

11. Changes to this Policy

We may update this Privacy Policy at any time by posting the updated version on our website and updating the “Last updated” date. Material changes will be communicated via email to active customers.

12. Contact

Privacy questions or requests can be sent to [email protected].