← Back to MyCalla

Privacy Policy

Effective Date: March 24, 2026 · MyCalla LLC, New Jersey

1. Information We Collect

  • Account data: Name, email address, phone number, and preferred name provided at signup.
  • Call data: Caller phone numbers, call duration, timestamps, AI-generated transcripts, call summaries, credibility scores, and caller intent classifications. Call data may be retained in anonymized form after account deletion to support community scam intelligence.
  • Voice and audio data: Incoming calls are processed in real time by Calla, MyCalla's AI voice assistant. Audio is transcribed using Deepgram and responses are synthesized using ElevenLabs. Audio is processed transiently — no raw audio files are stored after a call ends. If you record a custom voice greeting, that recording is processed by ElevenLabs and deleted after synthesis is complete.
  • Billing data: Payment details are handled exclusively by Stripe (web) and Apple App Store / RevenueCat (mobile). MyCalla does not store raw credit card numbers. We retain billing event records (plan, amount, date) for accounting.
  • Device data: Device type, OS version, and push notification tokens (Expo Push and APNs VoIP tokens for iOS). Used to deliver call alerts and notifications.
  • Usage data: Features used, settings configured, and app session events. Used to improve the service.
  • Caller intelligence data: Phone numbers, anonymized call patterns, and scam reports from all users are aggregated into a community threat intelligence database. No personally identifiable user data is included.

2. How We Use Your Information

  • To operate the call screening and AI receptionist service
  • To generate call summaries, credibility scores, and caller intelligence
  • To send push and email notifications about calls, scam alerts, and account activity
  • To process billing and manage your subscription
  • To improve scam detection using anonymized, aggregated community data
  • To comply with legal obligations

We do NOT sell your personal information, use your call data to train AI models without your explicit consent, or share your data with advertisers.

3. Call Recording, AI Disclosure, and Consent

AI disclosure: Every call answered by MyCalla begins with an AI disclosure. Calla identifies herself as an AI assistant at the start of every call, before any substantive conversation begins. This satisfies the requirements of California AB 2905 (effective January 1, 2025) and similar AI disclosure laws in other states.

Call recording and transcription: All calls are transcribed in real time. Transcripts and AI-generated summaries are stored and accessible only to the account holder.

All-party consent states: Twelve states require all parties to a phone call to consent before recording. These states are: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. MyCalla's AI disclosure at the start of every call serves as the notification mechanism in these jurisdictions. Callers who continue the conversation after the disclosure have provided implied consent.

Your responsibility: You are responsible for ensuring your specific use and configuration of MyCalla complies with applicable recording and AI disclosure laws in your jurisdiction. MyCalla provides the disclosure mechanism; you bear responsibility for any additional jurisdiction-specific requirements.

4. Voice and Biometric Data

Voice audio processed during calls is treated as sensitive data. In Illinois, voice data may constitute biometric information under the Illinois Biometric Information Privacy Act (BIPA). MyCalla processes voice audio transiently for AI-assisted call screening and does not store raw voice recordings or create biometric voice profiles. If you have questions about biometric data handling in your jurisdiction, contact privacy@mycalla.ai.

5. Third-Party Data Processors

We share data only with the following service providers to operate and deliver the MyCalla service. All providers are contractually bound to protect your data.

  • Supabase — database hosting (account data, call records, settings)
  • Vapi — AI voice infrastructure (call audio, transcripts)
  • OpenAI — real-time call AI, GPT-4o-mini (call transcripts)
  • Anthropic — post-call summaries, Claude Haiku (call transcripts)
  • Deepgram — speech-to-text (call audio)
  • ElevenLabs — voice synthesis (text responses)
  • Twilio — phone number provisioning (phone numbers)
  • Stripe — payment processing, web (billing info, email)
  • RevenueCat — subscription management, mobile (user ID, entitlement status)
  • Apple App Store — in-app purchases, iOS (purchase receipts)
  • Resend — transactional email (email address, notification content)
  • Sentry — error monitoring (anonymized error traces)

We share anonymized scam intelligence with the MyCalla community threat database — no personal data included. We do not share data with advertisers and do not sell personal information.

6. Automated Decision-Making

MyCalla uses automated AI systems to screen calls, generate credibility scores, classify caller intent, and flag potential scam activity. These decisions affect how calls are routed and presented to you. They do not produce legal or similarly significant effects on callers. You may review, correct, or override any automated classification within the app.

7. Data Retention

  • Call records and transcripts: 12 months, then deleted.
  • Account data: Retained until account deletion.
  • Community scam intelligence: Anonymized call records retained after account deletion; no personal identifiers retained.
  • Caller profiles: Retained in anonymized form after account deletion.
  • Billing events: 7 years for accounting compliance.
  • Voice recordings (custom greeting): Deleted after processing.

8. Your Rights

All users may exercise the following rights through Settings or by contacting privacy@mycalla.ai: access your data, correct inaccurate data, delete your account and personal data, request a data export, and opt out of automated call scoring.

State-specific rights: Residents of states with comprehensive privacy laws have additional rights. We honor all applicable rights for residents of California (CCPA/CPRA), New Jersey (NJDPA — opt-out requests processed within 15 days), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Tennessee (TIPA), Maryland (MODPA), Minnesota (MCDPA), Indiana (ICDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA), Iowa (ICDPA), Delaware (DPDPA), Utah (UCPA), New Hampshire (NHCDPA), and Nebraska (NDPA). Common rights include: access, correct, delete, portability, and opt out of sale or profiling.

We do not sell personal information. California and New Jersey residents may request written confirmation at privacy@mycalla.ai.

Right to appeal: If we deny a privacy request, you may appeal by emailing privacy@mycalla.ai with the subject “Privacy Request Appeal.” We will respond within 60 days.

9. Children's Privacy

MyCalla is not directed to children under 13. We do not knowingly collect data from users under 13.

10. Data Security

We use encryption in transit (TLS), encryption at rest (AES-256), row-level database security, and field-level encryption for sensitive data. We conduct regular security audits. In the event of a breach affecting your personal information, we will notify you as required by law.

11. Changes

We may update this Privacy Policy. Material changes will be communicated by email and an in-app notice. The effective date at the top reflects the most recent update.

12. Contact

privacy@mycalla.ai · MyCalla LLC, New Jersey

© 2026 MyCalla LLC. All rights reserved.