Privacy Policy

1. Scope

This Privacy Policy explains how Agentalk ("Agentalk", "we", "us", "our") collects, uses, shares, and protects information when you:

• visit or use https://agentalk.io and related pages (the "Website" or "Service");
• create and operate assistants / bots for voice and/or text interactions;
• allow end users to interact with those assistants;
• contact us for billing, support, or other purposes.

Your use of the Service is also governed by our Terms of Service. If you do not agree with this Policy, please do not use the Service.

2. Key Definitions

Personal Data / Personal Information

Information relating to an identified or reasonably identifiable person.

Usage Data

Technical data collected automatically (e.g., IP address, device / browser type, pages visited, error logs).

Cookies & Similar Technologies

Small files or tags used for operation, security, analytics, and marketing.

Controller

The party that determines purposes and means of processing Personal Data.

Processor

The party that processes Personal Data on behalf of the Controller.

3. Who We Are & Contact

For any privacy request or question, contact support@agentalk.io · +972 3-381-8822.

If a local representative or Data Protection Officer (DPO) becomes applicable, we will update this Policy and can provide details upon request.

4. Information We Collect

A. Account & Business Information

Names, emails, roles, company details, billing information, and account preferences. Payment details are processed by third-party payment processors; we do not store full payment card details.

B. Assistant Data (Configurations)

Assistant prompts, templates, dialogue flows, knowledge sources, model parameters, routing rules, and integration settings (e.g., webhooks). We keep this while the assistant remains active or as required by contract / law.

C. Conversations & Calls

To provide real-time voice and chat:

Call / Conversation Metadata

Numbers or identifiers of parties, timestamps, duration, call status.

Audio

Call recordings only if you enable them or where required / permitted by law.

Transcripts

Speech-to-text results and text messages.

Interaction Logs

Intent recognition, assistant responses, outcomes (e.g., booking created), and diagnostic events.

Your responsibility as Controller

Provide required notices and obtain any necessary consents for recording / transcription and for processing your end users' data under applicable law.

D. Credentials & Integrations

API keys, OAuth tokens, webhook URLs - stored securely with access limited by role and necessity.

E. Phone Numbers & Messaging Setup

Numbers you port or that we provision, including number type, region, provider, and assignment.

F. Usage & Device Data

IP address, device and browser identifiers, pages viewed, referrers, performance metrics, and error diagnostics.

G. Support Communications

Content you send to support, including optional screenshots or logs you choose to share.

H. Sensitive or Special Categories

We do not intentionally collect sensitive categories unless you or your end users include them in content. Please avoid submitting such data unless it is necessary and lawful to do so.

5. How We Collect Data

• Directly from you and your end users.
• Automatically through the Service.
• From third parties that support the Service (telephony providers, cloud hosting, analytics, payment processors, STT / TTS / LLM providers, etc.).

6. How We Use Data

We use information to:

• provide, operate, and maintain the Service;
• create and manage accounts, billing, and customer support;
• secure the Service, prevent abuse / fraud, and fix issues;
• measure performance and usage for reliability and capacity planning;
• send operational notices and Service updates;
• comply with legal obligations and enforce our agreements;
• perform product research and development within contractual and legal limits.

Model training & improvements

We do not use your data to train generalized AI / ML models unrelated to your account.

14. Your Privacy Rights

A. EU / EEA / UK (GDPR / UK GDPR)

You may have rights to access, rectify, erase, restrict, object, port your data, and withdraw consent where processing is based on consent. You may lodge a complaint with your local supervisory authority.

B. California (CCPA / CPRA)

Subject to exceptions, you may have rights to know (categories and specific pieces of Personal Information), correct, delete, and to opt-out of "sale" or "sharing" of Personal Information.

C. Israel (Privacy Protection Law, 1981)

You may have rights to review, update, and delete Personal Data as provided by law. Contact support@agentalk.io · +972 3-381-8822.

15. Google User Data

When a business connects a Google account to Agentalk (Google Calendar, Sheets, Contacts, Gmail or Tasks), we access only the data needed for the actions that business enables for its assistant:

• reading free / busy times and creating appointments in the Google Calendar the business chooses;
• adding and reading rows in the one Google Sheets spreadsheet the business selects with the Google file picker;
• reading and creating Google Contacts to identify callers and save new ones;
• sending an email the caller asked for from the business Gmail account (send only; we do not read Gmail messages);
• creating Google Tasks follow-ups for the business.

AI processing. To answer a caller, the assistant's conversation model receives the result of a Google tool (for example free time slots or a contact's name) during that call only. These models are provided by OpenAI (OpenAI API, Enterprise plan) and Google (Gemini API, paid tier); under their API terms, this data is not used to train their models. Google tools are available only on assistants that use these providers. We do not use Google user data — raw, aggregated or derived — to develop, improve or train generalized AI or machine-learning models, and we do not transfer it to any third party for that purpose. We do not use self-hosted or offline AI models.

Google user data is used only to provide these features to that business. It is not sold, not used for advertising, and not used to train generalized AI / ML models. Access tokens are stored encrypted. The business can disconnect a Google account at any time from the Connections page, which revokes our access and deletes the tokens.

Sharing, transfer and disclosure of Google user data

We do not sell Google user data. We share, transfer or disclose it only as needed to provide the features described above, and only to:

• The business that connected the Google account. Results of the assistant's actions, such as a booked appointment or the call transcript, appear in that business's Agentalk account.
• The caller, at the caller's request. For example, the assistant tells the caller the available time slots or the booked time, and sends the confirmation email the caller asked for to the address the caller confirmed.
• Service providers that process the data on our behalf, only to run these features and under confidentiality and data-protection terms:
  • AI model providers that run the assistant's conversation: OpenAI (OpenAI API, Enterprise plan) and Google (Gemini API, paid tier). Under their API terms, they do not use this data to train their models.
  • Text-to-speech and telephony providers that turn the assistant's reply into speech and carry the call audio.
  • Our integration infrastructure provider, which stores the OAuth tokens and relays our requests to Google APIs.
  • Amazon Web Services, which hosts our servers and databases.
• Authorities, when the law requires it. If Agentalk is part of a merger, acquisition or sale of assets, we transfer Google user data only after we obtain the user's explicit prior consent.

We do not transfer or disclose Google user data to any other third party or for any other purpose. This includes advertising, data brokers, and training AI or machine-learning models.

How we protect Google user data

• Encryption in transit: all traffic between our services, Google APIs and our AI providers uses HTTPS/TLS.
• Encryption at rest: our databases and stored call data are encrypted at rest on Amazon Web Services (AES-256).
• OAuth tokens: Google access and refresh tokens are stored encrypted by our integration infrastructure provider. They are never sent to the browser, to the caller, or to an AI model.
• Data minimization: we request only the scopes each feature needs, and we trim every Google API response to the fields the assistant needs. For example, we read free/busy times, not the details of calendar events.
• Isolation: a business's Google connections can be used only by that business's own assistants.
• Access control: only authorized personnel who need access to operate the service can access production systems and data, under role-based permissions.
• Revocation and deletion: when a business disconnects a Google tool, we revoke our access and delete its tokens. Users can also remove Agentalk's access at any time from their Google Account permissions page (https://myaccount.google.com/permissions).

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

20. Contact Us

For questions, concerns, or to exercise your rights: support@agentalk.io · +972 3-381-8822