Last updated: October 10, 2026
Proposed revision. Not yet effective. Material changes take effect no earlier than 30 days after customer email notice.
CallBackOrElse ("Company," "we," "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our storm-response and AI phone receptionist service ("Service"). Please read this policy carefully.
When you register, we collect: name, email address, phone number, business name, business address, and payment information (processed by Stripe).
When our AI handles calls for your business, we collect: caller phone number, call duration, call recordings, call transcripts, AI-generated summaries and analysis, and caller-provided information (name, address, service requested).
We collect: phone numbers, message content, opt-in/opt-out records, and delivery status for SMS messages sent through the Service. When customers interact with our automated SMS reply system, we may also collect caller-provided information (name, service address, service requested) and store it on the customer's contact record.
By providing your phone number and opting in (verbally during a call with our AI receptionist, by submitting our online consent form, or by texting our program number and confirming by reply), you agree to receive SMS text messages, and where you have separately indicated AI-powered voice calls, from CallBackOrElse regarding customer care, appointments, service updates, and promotional offers. The following SMS program terms apply:
Carriers are not liable for delayed or undelivered messages. For additional detail on how we capture and log messaging consent, including verbal opt-in during AI calls, see our Messaging Compliance FAQ.
We automatically collect: IP address, browser type, device information, pages visited, referral URLs, and interaction data (clicks, page views).
We use cookies and similar technologies as described in our Cookie Policy.
When you sign in using a third-party authentication provider (Google or Apple), we receive and store: a unique identifier from that provider, your name (if provided), and your email address. We do not receive or store your Google or Apple account password.
When you create an email and password account, we store your email address and a salted, one-way bcrypt hash of your password. We never store the plaintext password and cannot recover it; a forgotten password can only be reset. Your account password is separate from any third-party authentication provider's password.
When a technician creates a field-app login, we store the technician's chosen username and a salted, one-way bcrypt hash of the password. We never store the plaintext password and cannot recover it; a forgotten password can only be reset. The technician username is unique across the Service.
When you contact us through the support form on our website or by emailing support@callbackorelse.com, we collect the information you provide: your name, email address, phone number (if provided), the topic you select, and the contents of your message. We use this information only to respond to your inquiry and to maintain a record of support requests. These submissions are stored in our Notion workspace (see Section 5) and a notification is emailed to our support team. You may submit a support request this way without holding a CallBackOrElse account.
In-app human support (signed-in accounts). When a signed-in account user asks our in-dashboard assistant to connect them with a human, or the assistant determines the request needs a person, we create a support case containing your name, account email, a short problem summary, and a compact business-context summary, not a full transcript of your assistant conversation. That case is handed off to our support team through Chatwoot Cloud, a third-party hosted human-support inbox. A support agent's replies, and any further messages you send in that conversation, are processed through Chatwoot and relayed between the assistant chat and the support inbox so the conversation continues in one place. We also maintain a matching record of the case (business name, contact name and email, problem and context summary, status, and a link to the internal conversation) in our Notion workspace (see Section 5) as our customer-success record for that case. To let a support agent know a new case or message is waiting, Chatwoot may send a minimal notification (case reference and a short preview, not the full case content) to our support team's mobile devices through its push-notification relay, which in turn delivers it through Apple's or Google's push notification service depending on the device. See Section 6 for how long in-app support case records are retained.
If you sign in with Apple and choose to use Apple's "Hide My Email" feature, we receive a private relay email address instead of your personal email. We treat this relay address as your account email and do not attempt to obtain your real email address. Service communications sent to the relay address are forwarded by Apple to your personal inbox.
When you use customer-map, storm, traffic, weather, or demand-surge features, we process service addresses, derived latitude/longitude coordinates, map viewport selections, weather-alert areas, forecast-grid locations, and related operational signals so the dashboard can show nearby customers, weather hazards, traffic layers, flood zones, tropical-cyclone overlays, and HVAC demand-surge indicators. We do not collect device GPS location for these features. Where geocoding is enabled, we may send service-address text to the U.S. Census Bureau geocoder and, if configured by us, Photon/OpenStreetMap geocoding services to derive coordinates. Weather and hazard features may send coordinates, grid points, or map-tile requests to the National Weather Service, NOAA, FEMA, and TomTom as described in Section 5.
When this feature is enabled and an inbound caller provides a service address or the call creates a service or appointment record, we may send the caller-provided service address to the Google Address Validation API after the call ends. We use the returned validation verdict and standardized address components to determine whether the address should be flagged for review before dispatch and to present a possible standardized correction for review. An authorized user may choose either the caller-provided address or the suggested standardized address for operational use only after making an explicit selection. This review does not block or change a booking, automatically replace the stored address, or determine whether a call receives emergency handling. A possible correction, an address that cannot be verified, or an unavailable validation service creates an address-review flag for human follow-up.
When a business account owner enables field-app access for an employee or contractor, we process that worker's name, contact information, role, skills, assigned schedule, device display name, and field-app authentication records. The field app displays the customer and job information needed for assigned work, including customer contact information, service address, job notes, scheduled time, parts, and workflow requirements. It records operational events such as arrival, breaks, workflow answers, parts used, completion status, and confirmed technician actions.
Before a technician activates a phone, we display the business name, a summary of the work activity visible to that business, and links to the current Terms of Service and Privacy Policy. We record the technician, business account, approved device, date and time, and document versions associated with the technician's confirmation that the technician is at least 18, is authorized by the business, agrees to the Terms, and acknowledges this Policy. We do not collect a birth date or identity document for this confirmation.
When job-proof features are enabled, authorized users may upload before-and-after job photos and collect a customer's typed name, acknowledgment, and drawn signature image. Uploaded photos are decoded and re-encoded before storage to remove embedded camera and location metadata. Signature images are also re-encoded before storage. We do not use job photos or signatures for biometric identification or template generation. The field app does not collect a technician's device GPS location.
Field-app passkeys use public-key credentials. CallBackOrElse stores the public credential identifier, public key, usage counter, and related security records; a fingerprint, face scan, device passcode, and private cryptographic key remain on the technician's device and are not received or stored by CallBackOrElse.
The technician field-app provisions in this Section 2.10 and Section 3A.5 take effect August 13, 2026.
If an account user explicitly enables callback alerts for a browser and grants that browser notification permission, we store the browser-issued push subscription endpoint, its public encryption key and authentication secret, any expiration time the browser supplies, the associated business account and user, and creation and update timestamps. We use these subscription credentials only to route and encrypt optional service-related callback alerts to that browser; we do not use them for advertising or cross-site tracking.
The browser-push provisions in Sections 2.11, 3A.3, 5, 6, and 9A take effect July 21, 2026. Browser push is disabled by default and becomes available only after an account user enables it for a browser and grants that browser notification permission.
We do not train artificial intelligence models. CallBackOrElse is not an AI developer. We use third-party AI providers — ElevenLabs (real-time voice, transcription, summaries, factual intake, and post-call audio alignment for accounts on the ElevenLabs voice path), Telnyx (real-time voice, transcription, post-call analysis, and tool-call data exchange for accounts configured for Telnyx voice, using the speech and language-model services configured through Telnyx, currently Deepgram's Nova-3 transcription model and Moonshot AI's Kimi K2.6 language model), and OpenAI (inbox features, the in-dashboard AI assistant, the technician field assistant, and optional automatic post-call summaries as described in Section 4) — to perform inference on call audio, transcripts, and, when you use an assistant, the account data you submit to it (such as your call and lead records, contacts, message drafts, job records, and operational data), on a per-request basis. Those providers process our API requests under their published API terms; in particular, OpenAI does not use API-submitted data to train its models by default. ElevenLabs training defaults depend on the account plan and data-use settings. We require optional model-training use to be disabled for our production account. Its opt-out covers newly submitted data, not a retroactive assurance about previously submitted data. Telnyx and the speech and language-model services configured through it process receptionist audio, transcripts, and call details under Telnyx's published API terms and our account settings; we do not authorize Telnyx or those services to use caller content to train models on our behalf. Provider retention is separate from training. We do not run a training pipeline of our own and do not aggregate caller content into a model-training corpus. Improvements to "the Service" in the list above refer to human engineering work — prompt template revisions, code changes, infrastructure tuning — not machine learning on your data.
CallBackOrElse offers operational features that affect how caller data is processed and surfaced. We disclose them here so you and your callers know what happens during a call.
"Storm Mode" is a high-volume incident posture (e.g., severe weather event) that business owners can enable for a defined period. While Storm Mode is active, the AI receptionist uses a Storm-specific agent and a Storm-specific opening sequence that identifies the AI, notifies the caller that the call is being recorded, and, depending on the account's configured opening, names the storm event or states that the business is in storm mode due to current weather conditions (the verbatim disclosure scripts are published in our Messaging Compliance FAQ). Depending on the configured opening, the sequence uses a combined AI greeting or a prerecorded recording notice followed by the AI greeting. Accounts using the indexed intake or Asher/Clara opening use the weather and storm-mode wording as their standing opening, independently of the timed Storm Mode setting. Storm Mode may also enable additional outbound SMS workflows (engagement messages, scheduled engagements, surge digests) to opted-in contacts only. Storm Mode does not change the categories of personal information we collect or disclose; it changes the cadence and presentation of how that information is processed.
Completed inbound calls appear as callback tasks using transcripts, summaries, and factual intake supplied by ElevenLabs or, for accounts configured for Telnyx voice, by Telnyx and the speech and language-model services configured through it. When the post-call summary feature described in Section 4 is effective and enabled for an account, Home may display an OpenAI-derived service summary, extracted address, and address-confidence estimate instead. Original ElevenLabs or Telnyx data remains available. Home shows a separate task for each completed inbound call. AI Receptionist presents recorded calls chronologically. In scheduling mode, its queue groups calls by caller. Waiting callbacks are presented in chronological order. We do not assign urgency, vulnerability, demographic, lead-value, or sentiment classifications to these calls or use those classifications to rank callback tasks. Authorized account users review call information and decide what action to take.
Historical classification records may remain subject to the retention and deletion provisions in Section 6. They are not used to rank current callback tasks. Callers may continue to request information about historical classification processing by emailing support@callbackorelse.com with the subject line "ADMT Request." The retirement of classification does not limit the privacy rights described in this policy.
When a callback task is created, the Service may notify authorized account users with call metadata and a summary through enabled browser callback alerts. These notifications do not depend on urgency, vulnerability, or lead-value classifications. Configured SMS workflows and transactional email remain separate service communications. The channels used for these communications are listed below and are also disclosed in Section 5 as subprocessor relationships:
A browser callback alert contains only the callback category and, when the receptionist confidently captured it, the caller's name; otherwise it says "Unknown caller." It does not contain the caller's phone number or address, a call recording or transcript, an AI summary, or free-text notes. The alert includes an opaque callback identifier so an authenticated account user can open the matching record in the dashboard. The Web Push protocol encrypts the notification payload for the subscribed browser. The browser-selected push service receives the destination endpoint, delivery timing and other routing metadata, and the encrypted payload.
The in-dashboard AI assistant lets a business account owner review and act on their own account data through a conversational interface. When you use it, the content of your requests and the account data needed to answer them — for example, call and lead records, contacts, message drafts, and revenue or operational data — are sent to OpenAI on a per-request basis to generate a response, under the same no-training terms described in Sections 3 and 4 (OpenAI does not use API-submitted data to train its models by default, and may retain it for up to 30 days for abuse monitoring). The assistant operates only within your own account, surfaces only data you already have access to, and requires your explicit confirmation before it sends any message to your customers or takes other customer-facing actions. It does not create new categories of personal information; it changes how existing account data is processed and surfaced.
Assistant conversations are also stored on our servers so your chat history and the assistant's saved context survive across sessions and devices. This includes your messages, the assistant's responses, a record of the actions you asked it to take, and durable "memories" — business facts and preferences the assistant keeps so it does not re-ask what you have already told it (including details collected during setup, and summaries of calls your AI receptionist handled). Conversation history is retained for 400 days and then deleted automatically; memories are retained until you delete them. You can view and delete individual conversations and memories — or clear all memories at once — from the assistant's History panel in your dashboard. This stored history is separate from the per-request OpenAI processing described above: OpenAI receives conversation content per request under the no-training terms; the stored copy lives in our database under the safeguards in Section 7.
The technician field assistant lets an authorized field worker ask for information about their assigned schedule, jobs, parts, and workflow. When a technician uses it, the technician's request, limited recent conversation context supplied by that phone, and the account or job data needed to answer are sent to OpenAI on a per-request basis under the no-training and retention terms described in Sections 3 and 6. The field assistant is restricted to the technician's business account and assigned field tools. Technician actions that change job state require an explicit confirmation where the product presents one.
CallBackOrElse does not store the technician field-assistant transcript as server-side chat history. The phone holds recent conversation context only in the current app process, and it is lost when that process closes or reloads. We store aggregate daily usage counts and token totals, without prompt or response content, for rate limiting, cost control, and security monitoring.
Calls handled by our AI receptionist may be recorded. All calls include an automated disclosure that: (1) the call may be recorded, and (2) the caller is speaking with an AI assistant. Call recordings are accessible only to authenticated users authorized for the business account. Recordings are retained for the duration of your account; see Section 6 for details on what happens after account deletion. You may request earlier deletion of any specific recording or all recordings at any time by contacting support@callbackorelse.com.
Depending on the account's configured voice provider, receptionist audio and call information are processed through ElevenLabs or Telnyx and their configured speech and language-model providers. Existing accounts may remain on the ElevenLabs path. New Telnyx accounts use the model and speech services configured for that receptionist, currently Moonshot AI's Kimi K2.6 language model and Deepgram's Nova-3 transcription model, selected through Telnyx's assistant configuration. For those accounts, Telnyx provisions the voice number, routes the call, runs the AI receptionist, records the call from the moment it is answered, produces the transcript and a structured post-call analysis (caller name, callback number, service address, reported issue, a factual call summary, and whether the SMS consent question was asked and answered), and carries out the enabled tools: reporting a clear spoken yes to the SMS consent question so that the existing first opt-in message can be sent through SignalHouse, transferring a server-authorized trusted caller, and ending the call. Telnyx is not used to send this Service's SMS messages; SignalHouse continues to provide SMS using a separately assigned sender. Signed Telnyx event receipts are stored encrypted and scheduled for deletion after seven days. Normalized copies of a Telnyx call follow the retention rules in Section 6; when we purge a copy, we request deletion of the corresponding Telnyx recording and conversation through a retrying process, and that request remains pending until Telnyx confirms it.
For accounts on the ElevenLabs path, ElevenLabs supplies receptionist transcripts, summaries, and factual intake; for accounts configured for Telnyx voice, Telnyx supplies them. OpenAI processes account data submitted through the assistant features described in Section 3A. The optional automatic post-call processing described below does not assign caller classifications or rank callback tasks. By default since March 2023, OpenAI does not use API-submitted data to train its models. OpenAI may retain submitted data for up to 30 days for abuse monitoring, unless longer retention is required by law. Disabling stored Responses API results does not eliminate provider abuse-monitoring retention. For details, see OpenAI's data usage policies.
Upcoming post-call summary feature. The post-call summary and audio alignment provisions in Sections 3, 3A.2, 4, 5, 6, and 9A are not yet effective. We will announce their effective date and notify affected account users by email at least 30 days before that date under Section 12. The feature will remain disabled until that date and verification of the provider data-use settings described below.
Once these provisions are effective, an account may be enabled for post-call summaries. Only inbound calls that begin during an enabled period for that account are eligible. Earlier calls and calls begun during disabled periods are not backfilled. OpenAI may automatically process the call transcript, including the caller's and receptionist's words, to extract the caller's name, reported problem, and stated service address into a concise service summary. It may also produce a whole-number estimate of confidence in the address extraction. This is an AI-generated estimate, not a calibrated probability, assessment of audio quality, address validation, or verification that an address exists. It is not used to rank callers or make service decisions. Missing or conflicting address evidence is shown without a confidence percentage.
To locate an address passage for playback, we may send the full stored call recording and plain transcript text to ElevenLabs' forced-alignment service after the call. This additional processing depends on an extracted address without unresolved uncertainty, an available recording, and processing limits. A playback shortcut is shown only when reliable timing is available. It selects the address passage with up to five seconds of context before and after; the original recording is not altered. Provider corrections or processing retries may result in more than one request for an eligible call. Closing an enabled period does not erase earlier eligible results.
Original ElevenLabs data remains available in the account and in exports. Staff edits override extracted fields; a staff address correction removes the AI estimate and address playback shortcut. We store derived summaries, estimates, and address timestamps encrypted with the call record and remove them when the associated call or transcript is purged, subject to Section 6. Authorized account users review call information and make service decisions.
Before enabling this additional ElevenLabs processing, we require verification that optional model-training use is disabled for the account and that the provider's terms and data-use settings cover forced alignment. Training opt-out and provider retention are separate. We do not promise zero provider retention or retroactive removal of previously submitted data from training.
We share information with the subprocessors below to deliver the Service. The "Processing location" column reflects each provider's primary processing region as disclosed by the provider; some providers operate global infrastructure and may route traffic through additional regions for redundancy. Where a provider processes outside the United States, see the international-transfers paragraph below this list.
Each subprocessor processes data under its own privacy policy and applicable contractual terms. Transfers of caller information to a Field Service Management provider you have connected (HouseCall Pro or ServiceTitan) are made at your direction as the controller of that data and are governed by your relationship with that provider; under CCPA/CPRA those transfers are not "sales" or "sharing."
International processing. Some subprocessors listed above (notably OpenAI, ElevenLabs, Telnyx, Stripe, Google, and Apple) operate global infrastructure and may process data outside the United States. The Service itself is operated and hosted in the United States by a US-incorporated company; we are not established in, and do not direct the Service to, the European Economic Area, the United Kingdom, Switzerland, or Canada. See Section 11 for international-user disclosures (including how the CCPA/CPRA disclosures in Sections 9 and 9A apply to California residents who interact with the Service).
Telnyx voice cleanup. Deletion of provider-held recordings and conversations is requested separately from deletion of our stored call copies. Automated retries are bounded; unresolved provider failures require operational follow-up and do not establish that the provider copy has been erased. We retain call identifiers and cleanup status needed to track that process. Provider retention obligations and applicable consent-evidence holds may also affect deletion timing.
The account-closure, automated-deletion, export, and deletion-receipt disclosures in this Section 6 take effect August 14, 2026.
While your account is active, we retain the data we collect (call recordings, transcripts, AI-generated summaries, derived address-confidence estimates and playback timestamps when enabled, SMS message content, contact records, technician records, field workflows, and job-proof records) to provide ongoing service: lead history, revenue attribution, dispatcher review, field operations, dispute resolution, and product improvement. Business owners may request deletion of specific call recordings at any time by contacting support@callbackorelse.com. We periodically review our retention practices to align with applicable data minimization requirements.
Browser callback-alert retention: a browser push subscription and its delivery-attempt records remain until the account user disables alerts for that browser, the browser push service reports the endpoint as expired or invalid, the subscription or related alert is otherwise deleted, or the business account is deleted. Delivery-attempt records contain delivery status, attempt and timing data, provider response status, and a bounded error message used to retry and troubleshoot delivery. A pending alert expires after 24 hours and is attempted no more than three times; expiration stops delivery but does not by itself delete the delivery-attempt record. The underlying in-dashboard callback alert follows the active-account and account-deletion retention rules in this Section 6.
In-app human-support case retention (Section 2.7). We keep two tiers of records for an in-app human-support case at different lengths:
Both tiers are included in account deletion, together with associated Chatwoot contacts and conversations and separate Notion support records. We remove active records promptly through a retryable process. Notion pages first move to trash; that action alone is not permanent erasure. Where manual provider erasure is needed, a restricted operator task records the deletion receipt ID, provider-record references, remaining actions, and verification evidence. It does not copy your support content. The request remains pending until required permanent provider erasure is verified. We then send the completion receipt. Minimal deletion receipts and the lawful-retention and backup exceptions described below may remain.
When paid Service ends, the account enters a 30-day closure window. Operational access is disabled during that window, but an account owner may request an account export, reactivate through a successful payment, or choose immediate deletion. If the account is not reactivated, deletion begins automatically when the closure window ends. Choosing immediate deletion starts the same process without waiting for the remainder of the closure window.
When deletion begins:
Account exports are ZIP archives assembled from the account's available records and private job-proof objects. A ready export may be downloaded for 24 hours. The stored export object is deleted no later than 7 days after it is created. Exports are limited to 100 MB; if an account exceeds that limit, contact support@callbackorelse.com for a supported transfer method.
Deletion removes data from active production systems. Encrypted infrastructure backups may retain residual copies until they expire through the hosting provider's ordinary backup cycle. Backups are access-restricted, are not used to provide the Service after deletion, and any restored data remains subject to the original deletion request.
Technician field-app retention: job schedules, workflow answers, operational activity, job photos, and customer signature records are retained for the duration of the business account unless deleted earlier through an available product or support workflow. Technician usernames and password hashes remain while the login is active and are deleted when all app access is revoked, the technician is deactivated, or the business account is deleted. Passkey credentials and device records remain until revoked or the account is deleted. Technician activation acknowledgments are retained for the duration of the business account and its closure window, then deleted with the technician record. Automated cleanup removes expired passkey challenges and sessions; pseudonymous persistent rate-limit counters are removed within 2 days; single-use activation records are retained for up to 90 days; completed confirmation receipts are retained for up to 90 days; field-app authentication events are retained for up to 180 days; and aggregate field-assistant usage totals are retained for up to 400 days. The technician field-assistant transcript is not stored as server-side chat history. OpenAI may retain API inputs and outputs for up to 30 days under its API data retention terms, subject to legal and security exceptions.
Field Service Management data is treated separately and varies by provider. When you connect a third-party FSM, we sync job and invoice data to attribute revenue and maintain customer matching:
We implement industry-standard security measures including: encryption in transit (TLS 1.2+), access controls, rate limiting on authentication and registration endpoints, regular security audits, and secure hosting infrastructure. We apply application-level encryption-at-rest using AES-256-GCM with a master key managed in our production environment. As of June 2026, this application-level encryption covers: (a) OAuth refresh tokens and API keys for Field Service Management integrations (HouseCall Pro, ServiceTitan); (b) AI call transcripts and AI-generated summaries from voice calls; (c) customer service addresses associated with calls and scheduled appointments; and (d) SMS message bodies stored on conversation threads. We continue to extend application- level encryption to additional categories on a rolling basis (authentication provider tokens, additional subprocessor API keys, and webhook signing secrets). Database storage is additionally encrypted at the infrastructure level by our hosting provider.
Technician field-app passwords are stored as salted, one-way bcrypt hashes; session and activation credentials are stored as one-way token hashes; and passkeys are stored as public credentials. Private passkey keys and biometric unlock data remain on the technician's device. Job photos and signature images are stored in private object storage and are available only through authenticated application endpoints. Uploaded job photos are re-encoded before storage to remove embedded camera and location metadata.
No method of transmission over the Internet, or method of electronic storage, is 100% secure.
In the event of a confirmed data breach affecting your personal information, we will notify affected users without undue delay and in any event within the time required by applicable law, targeting notification within 72 hours of discovery where practicable, except where notification within that window is prohibited by law-enforcement instruction, would compromise an active forensic investigation, or where good-faith additional time is required to determine the scope and nature of the breach. The notification will describe (to the extent then known): the categories of information affected, the approximate number of users affected, the steps we have taken to contain and remediate the breach, and the steps you can take to mitigate harm. We will also notify relevant regulatory authorities and applicable State Attorneys General (including those of Florida, Georgia, and Alabama) as required by applicable law.
Internally, our incident-response process triggers an automated alert pipeline to the account owner and the security operator on duty within minutes of detection (via email and SMS), so that human investigation and customer notification can begin immediately.
You have the right to:
To exercise these rights, use the available account settings or email support@callbackorelse.com. Account owners can initiate an export or deletion through the account-closure controls. We send a completion notice to the account email when the automated deletion process finishes.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
To submit a CCPA request, email support@callbackorelse.com with the subject line "CCPA Request."
For the twelve months preceding the date of this Privacy Policy, we have collected the following statutory categories of personal information defined by Cal. Civ. Code § 1798.140. We provide this taxonomy as a transparency disclosure regardless of whether a given user is a California resident; the same data handling applies to all users. For each category we list the source of the data, the business purpose, the third parties with whom we disclose it, and the retention period.
Advertising choices. We do not sell personal information for money. With marketing consent, Google Ads receives website and conversion information as described in Section 5. Depending on the processing and applicable law, this may constitute sharing for cross-context behavioral advertising. Use Manage Cookies or Global Privacy Control to opt out. We do not knowingly sell or share personal information of consumers under sixteen. We do not use or disclose sensitive personal information beyond purposes permitted by applicable law.
In addition to California, more than twenty U.S. states have enacted comprehensive consumer data privacy laws as of the date of this Privacy Policy, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware, New Hampshire, New Jersey, Iowa, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Several of these laws — notably the Texas Data Privacy and Security Act and the Nebraska Data Privacy Act — apply to all businesses regardless of revenue or data-volume thresholds.
CallBackOrElse honors the following consumer rights for residents of all states with applicable comprehensive privacy laws, not only California: access to personal data, correction of inaccurate data, deletion of personal data, data portability in a machine-readable format (JSON or CSV), and the right to opt out of targeted advertising, data sales, and profiling. The CCPA/CPRA disclosures in Sections 9 and 9A serve as our baseline transparency disclosure for all users regardless of state of residence. To exercise any of these rights, email support@callbackorelse.com with the subject line "Privacy Request" and your state of residence.
Where applicable state law provides a right to cure before enforcement action, we will cure any identified violation within the time period specified by that state's law. We honor applicable advertising opt-out rights through Manage Cookies and Global Privacy Control. Section 5 describes Google Ads processing and your choices.
The Service, including business accounts and technician field-app access, is intended only for adults aged 18 or older. Business account owners must enroll only workers who are at least 18 and legally authorized to perform their assigned work, and each technician must confirm being at least 18 before activating a phone. The business owner is responsible for compliance with employment, apprenticeship, workplace-safety, and worker-notice laws. We do not collect a technician's birth date or identity document, and the owner's responsibility does not eliminate our obligations to protect and process technician information as described in this Policy. We do not direct the Service to children. If we learn that a registered account or field-app user is under 18, we will disable that access and delete the associated registration information as required by law.
Inbound callers are a separate category. Because the AI receptionist answers a public phone line on behalf of our business customers, we cannot prevent a minor from calling that line. If, in the course of answering an inbound call, the AI captures information from a person who self-identifies as, or is reasonably apparent to be, under 13 years old:
To request deletion of information you believe was collected from a minor, contact support@callbackorelse.com with the subject line "COPPA Request" and the date and phone number of the call in question.
CallBackOrElse is a U.S.-based service. Our customers (the businesses that subscribe to the Service) operate in Florida, Georgia, and Alabama. We do not market to, target, or solicit users in the European Economic Area, the United Kingdom, Switzerland, Canada, or California, and we do not have establishments in those jurisdictions. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States and in the global processing regions of the subprocessors listed in Section 5. By using the Service from outside the United States, you acknowledge and consent to that transfer.
European Economic Area / United Kingdom / Switzerland. The Service is not intended for EEA, UK, or Swiss residents. We do not knowingly target or accept registrations from those jurisdictions. To the extent the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the United Kingdom General Data Protection Regulation, or the Swiss Federal Act on Data Protection applies to a visitor's data because that visitor accessed our public website or called a customer's phone line, our lawful basis for processing is (a) the legitimate interest of operating and securing our Service and the customer's legitimate interest in handling inbound calls (Art. 6(1)(f) GDPR) and (b) where applicable, the data subject's consent (Art. 6(1)(a) GDPR). EEA / UK / Swiss data subjects may request access, correction, deletion, restriction, portability, and objection by emailing support@callbackorelse.com with the subject line "GDPR Request" or "UK GDPR Request." We will respond within thirty (30) days. Cross-border transfers to the United States from these jurisdictions are made in reliance on (i) the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework, the UK Extension to the DPF, and the Swiss-U.S. DPF where the receiving subprocessor is a self-certified participant; or (ii) the Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to third countries, where applicable. Visitors who do not consent to U.S. processing should not use the Service. EU/UK residents have the right to lodge a complaint with their local supervisory authority.
Canada. The Service is not marketed to Canadian residents. If you access the Service from Canada, your information is transferred to and processed in the United States. To the extent the Personal Information Protection and Electronic Documents Act ("PIPEDA") or a substantially similar provincial law applies, you may request access, correction, or deletion of your information by emailing support@callbackorelse.com.
California. Although our customer base is in Florida, Georgia, and Alabama, callers calling our customers' phone lines or visitors to our website may occasionally be California residents. The CCPA/CPRA disclosures in Sections 9 and 9A apply to those California residents notwithstanding our service area, and the same data-handling commitments apply to all users regardless of state of residence.
Google Analytics and other US-routed analytics. Our website uses Google Analytics 4 (Section 5). When a visitor outside the United States loads our site, the GA4 SDK transmits truncated IP, device metadata, and event data to Google servers in the United States and Google's global cloud regions. Google self-certifies participation in the EU-U.S. Data Privacy Framework, the UK Extension to the DPF, and the Swiss-U.S. DPF. Visitors who do not want this telemetry can decline analytics cookies in our cookie consent banner (per-category controls), use browser-level Do Not Track or ad-blocking, or refrain from visiting the site.
We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before they take effect.
For privacy-related questions or to exercise your rights, contact: support@callbackorelse.com