Privacy Policy

Effective: July 4, 2026 · Offworkr

Offworkr takes privacy seriously. This policy explains what data we collect, how we use it, and how we protect it when you use our AI receptionist service.

1. Who This Covers

This policy covers two groups of people:

Clients - businesses that subscribe to the service and use the dashboard.
Callers - individuals who call a client's AI-powered phone number.

2. Data We Collect

From clients (your business):

Business name, industry, address, and contact email.
A provisioned Vapi phone number assigned to your business.
Business configuration data you enter: hours, services, FAQs, policies, and preferences.
Billing information - handled by a third-party, PCI-DSS-compliant payment processor. We receive a secure payment token; we never see or store your full card number.
Usage data: calls answered, minutes used, and dashboard activity.

From callers (people who call your number):

Phone number (caller ID).
Voice recording of the call.
Transcript and AI-generated summary of the call.
Call metadata: date, time, duration, and call outcome (booking, message, or information).

Important: We do not accept protected health information (PHI), legally privileged communications, or any data subject to HIPAA, GDPR special-category requirements, or equivalent regulations. Do not use this service in regulated industries that require such compliance.

3. How We Use Your Data

Delivering the service: routing calls, generating summaries, and powering your dashboard.
Billing and subscription management.
Monitoring fair-use compliance and overall service quality.
Sending service-related communications: usage alerts, billing receipts, and policy updates.
Responding to support requests.

We do not sell your data to third parties. We do not use call content to train AI models.

4. Third-Party Service Providers

We share data with the following sub-processors only as necessary to deliver the service:

Vapi.ai - real-time call routing, voice synthesis, speech recognition, and call recording storage. Call audio is processed in real time and recordings are stored on Vapi's infrastructure.
Supabase - cloud database hosting for call transcripts, summaries, and client configuration data. Hosted on AWS (US region).
Payment processor - a third-party, PCI-DSS-compliant provider handles payment processing and subscription billing, subject to its own privacy policy.
Messaging carrier - delivery of any SMS text messages sent through the service (see the Text Messaging section below).
Anthropic - AI processing for generating call summaries and extracting business information from websites. Text data sent to Anthropic's API is not used for model training by default per Anthropic's data usage policy.
Render - application server hosting (US region).

5. Text Messaging (SMS)

When enabled, the service may send text (SMS) messages on behalf of a client business - for example, to follow up with a caller whose call was missed, to confirm details, or to request a review after a completed service. Mobile numbers used for messaging are collected when an individual contacts, or is a customer of, a client business, or when a person provides their number directly.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Numbers are shared with our messaging carrier only to deliver the messages you have consented to, and are never sold or used for third-party marketing.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time; reply HELP for help.

6. Call Recordings

Call recordings are stored by Vapi.ai on their own infrastructure. We store a reference URL and display it in your dashboard - we do not store audio files in our own database. If you need a recording deleted, email us and we will request its removal from Vapi on your behalf.

Your responsibility: You are solely responsible for complying with all applicable call-recording consent laws in your jurisdiction before deploying the AI receptionist. Many US states require callers to be informed that a call may be recorded.

7. Data Retention

Call logs, transcripts, and summaries: retained for 12 months from the date of the call, then deleted.
Business configuration data: retained for the duration of your subscription plus 30 days after cancellation, then deleted on request.
Billing records: retained as required by applicable accounting and tax law (typically 7 years).

8. Security

All data is transmitted over HTTPS. Our database uses encrypted storage. Access to production data is restricted to service-level credentials not exposed to end users. We review security practices periodically. No system is completely secure - if you believe there has been a data breach, please contact us immediately at hello@example.com.

9. Your Rights

You may contact us to:

Request a copy of the data we hold about your business.
Request correction of inaccurate data.
Request deletion of your business's data (processed within 30 days of your subscription ending).
Object to a specific use of your data.

Email requests to hello@example.com.

10. Children

This service is intended for business use by adults. We do not knowingly collect personal data from individuals under 18 years of age.

11. Changes to This Policy

We may update this Privacy Policy. We will notify you by email at least 14 days before any material changes take effect. The "Effective" date at the top of this page always reflects the current version.