Privacy Policy

Last updated: October 16, 2026

Who we are

The Call AI service (callai.live) is operated by KiwiAI. KiwiAI is the data controller for account-holder data. Support: [email protected] · Privacy: [email protected]

Call AI is committed to protecting the privacy of users and call recipients served via the Platform. This document explains what data we collect, how it is stored, and the rights of data subjects.

1. Data We Collect

From the Customer (account owner)

• Email, name, phone number, company details (incl. tax ID)
• Card details — entered in Cardcom's payment window and held by the payment processor, not by us
• Signup IP, billing country, card BIN country (for VAT residency detection)
• Customer-created content: prompts, knowledge base, contact lists

From Call Recipients

• Phone number (and name/address if uploaded by the Customer)
• Recordings + call transcripts (with automatic PII redaction)
• Telephony metadata (duration, quality, hangup cause)
• Opt-in / opt-out status

2. How We Use the Data

• Service operation — placing calls, routing audio through STT/TTS, issuing invoices
• Quality control — sampled human review (anonymized) to improve the service
• No model training — we do not use call recordings to train AI models
• Legal compliance — call logs retained for audit and legal defense

We do not sell data to third parties. We do not use call transcripts for marketing. We do not show one customer's data to another.

3. Sub-processors

To operate the Service, we share data with the following sub-processors, all of whom are bound by a DPA (Data Processing Agreement) and obligated to protect data:

Some data (including call content processed by DeepSeek / Kimi) may be processed outside Israel and the EU. Stripe is not used for platform billing — it is used only if a Customer connects their own Stripe account for payment links to their own clients, in which case Stripe works with that Customer directly.

This list is updated as our infrastructure changes. The current list is always available via [email protected].

4. Retention & Deletion

• Recordings — 90 days, then deleted automatically.
• Transcripts — stored alongside recordings; deleted with them.
• Audit logs — 365 days (statutory).
• Invoices — 7 years (Israeli Tax Authority requirement).
• Contact data — until the Customer requests deletion, and no more than 3 years after the last call.
• Account closure — after the account is closed (Billing page → "Close account"), data is deleted within 30 days after the paid period ends, except records the law requires us to keep (invoices: 7 years).

5. Security

• Encryption at rest — AES-256
• Encryption in transit — TLS 1.3
• Optional TOTP 2FA for all users, mandatory for OWNER role
• Immutable audit logs with timestamp signing
• API keys hashed (SHA-256) in DB
• HMAC-SHA256 signatures on every outgoing webhook
• Rate limiting + per-API-key IP allowlist
• Sentry error monitoring with PII redaction

6. Your Rights (GDPR + Israeli Privacy Act)

You may at any time:

• Access — on request by email to [email protected]
• Rectify — update details via your user profile
• Erase — close your account from the Billing page → "Close account"; data is deleted within 30 days after the paid period ends, except records the law requires us to keep (invoices: 7 years)
• Port — data export (Data Portability) on request by email to [email protected]
• Object to marketing — on request by email to [email protected]
• Lodge a complaint with the Israeli Database Registrar or your relevant EU DPA

Requests are handled within 30 business days at [email protected].

7. Call Recording

Calls placed via the Platform are recorded for quality control. At the start of each call (inbound or outbound), the agent provides a recording disclosure: "This call is being recorded for service improvement." Every outbound AI call also begins with a disclosure that the caller is an AI. A recipient who wishes not to be recorded may say so — the agent will end the call and notify the Customer.

Recordings are deleted automatically after 90 days, and transcripts are deleted together with them. We do not use call recordings to train AI models.

8. Cookies

We use only essential session cookies. There is no marketing tracking, no Google Analytics, and no Facebook Pixel inside the authenticated app.

9. International Transfers

Some of our sub-processors are located outside Israel / the EU (e.g., the United States). Such transfers rely on the EU Commission's Standard Contractual Clauses (SCCs), or the EU-U.S. Data Privacy Framework (DPF) where applicable. For Israeli data subjects, transfers comply with the Israeli Privacy Protection Regulations (Transfer of Data Abroad), 2001.

10. Children

The Service is not directed at children under 16. We do not knowingly collect information from children. If we learn we have inadvertently collected data from a child, we will delete it.

11. Law-Enforcement Requests & Court Orders

Call AI receives requests from law-enforcement authorities (police, prosecutors, tax authorities). Our policy:

• Validity check: we disclose information only on a valid court order or formal lawful demand from a competent authority in the relevant jurisdiction.
• Customer notice: we attempt to notify the account holder before disclosing — unless a gag order applies, the account itself is the subject of the criminal investigation, or there is legal urgency.
• Minimum scope: we disclose only what the order explicitly requires, nothing more.
• Transparency: we will publish an annual transparency report (request counts, no identifying details) once volumes warrant it.
• Channel: [email protected]

12. Changes

Material changes will be communicated by email at least 14 days in advance. Minor changes (wording, contact details) are updated without notice but will be marked in the "Last updated" line.

13. Contact

• Privacy: [email protected]
• DPO: [email protected]
• Legal: [email protected]