Privacy Policy

For personal information about our account holders (business owners and their team members) — such as your name, email, and billing details — Figment Imaginative is the “controller” (or “business,” under U.S. state laws) and this Policy governs how we handle it.

For personal information contained in the calls we answer on your behalf — including your callers' phone numbers, audio, and transcripts — you (the business) are the controller and CoveCall acts as your “processor” (or “service provider”). We process that information only on your instructions and as described in our Data Processing Addendum, which prevails over this Policy for that data.

Account and business data: your name, email address, phone number, business name and details, agent configuration, team members you invite, and authentication identifiers (including passkeys and multi-factor settings).

Call data: audio, transcripts, summaries, caller phone numbers, call outcomes, and related metadata for calls we handle for you.

Booking and calendar data: appointment details and availability from a calendar you connect (via Cronofy), used to schedule on your behalf.

Payment data: your billing contact and subscription details. Card payments are processed by Stripe; we do not store full card numbers.

Usage and device data: log data, IP address, browser/device information, and product analytics used to operate, secure, and improve the Service.

Communications: messages you send us (e.g., support or sales inquiries) and records of notifications we send you.

If you sign in with Google, we receive basic profile information from Google (your name, email address, profile picture, and Google account identifier) using the email, profile, and openid scopes, solely to create and authenticate your CoveCall account.

CoveCall's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not use or transfer Google user data to serve advertising; to determine creditworthiness or for lending purposes; we do not sell it or share it with data brokers; and we do not use it to train, fine-tune, or improve generalized or standalone AI/ML models. We use it only to provide the sign-in and account features you request.

To provide the Service: answering and routing calls, transcribing and summarizing them, screening spam, scheduling appointments, and sending you notifications.

To handle billing: processing subscriptions, metering usage, and preventing payment fraud.

To secure and improve the Service: authentication, fraud, spam, and prompt-injection prevention, debugging, and aggregated or de-identified analytics.

To communicate with you: service, security, and transactional messages, and — where permitted — product updates you can opt out of.

To comply with law: meeting legal, tax, and regulatory obligations and enforcing our agreements.

We do not sell your personal information, and we do not use it for third-party or cross-context behavioral advertising.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you sign up for); our legitimate interests (to secure, operate, and improve the Service and prevent abuse), balanced against your rights; your consent (where required, e.g., certain communications — you may withdraw it at any time); and compliance with a legal obligation.

Calls are processed by automated speech-to-text, language, and text-to-speech models (self-hosted by us or provided by contracted subprocessors listed on our Subprocessors page). CoveCall answers in a synthetic (AI) voice.

Caller speech is treated as untrusted input and is never used to alter your agent's instructions. Any optional model tuning uses only your own business's call data, subject to your configured retention and controls — never Google user data, and never to train generalized third-party models.

You are responsible for any AI-disclosure or call-recording notice your jurisdiction requires; see “Call recording and AI-voice notice” below.

We use Twilio to send you and your designated recipients SMS text messages and other notifications about calls (for example, when a call needs a human). Message and data rates may apply. You can opt out of non-essential texts by replying STOP or adjusting your notification settings; essential service and security messages may still be sent.

We share personal information only with the infrastructure and AI subprocessors that help us deliver the Service (hosting, telephony, voice/AI models, payments, calendar, and email), under contracts requiring appropriate confidentiality and security. Our current list is published at our Subprocessors page.

We may also share information with professional advisors, in connection with a merger, acquisition, or asset sale, or where we believe disclosure is required by law or necessary to protect rights, safety, or the security of the Service. We do not sell personal information.

We retain account data for as long as your account is active and as needed to provide the Service. We retain call data according to the retention settings you configure, and delete it on request, except where we must keep limited records to comply with legal, tax, accounting, or security obligations or to resolve disputes.

We protect personal information with encryption in transit and at rest, least-privilege access controls, database row-level security, audit logging, multi-factor authentication, and prompt-injection defenses for the AI agent. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and any affected parties of qualifying incidents as required by law.

Depending on where you live, you may have the right to access, correct, update, port, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email privacy@covecall.com. We will verify your request and respond within the time required by applicable law. You may also lodge a complaint with your local data-protection authority.

If your request concerns personal information contained in calls we process for a business customer, we will refer you to that business (the controller) or act on their instructions.

If you are a resident of California or another U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, and others), you may have rights to know/access, correct, delete, and obtain a portable copy of your personal information, and to opt out of “sales,” “sharing”/targeted advertising, and certain profiling. CoveCall does not sell or share personal information for cross-context behavioral advertising, and does not use or disclose sensitive personal information beyond the purposes permitted by law.

California residents may also request information under the “Shine the Light” law. You may use an authorized agent to submit a request, and we will not discriminate against you for exercising your rights. To exercise any of these rights, email privacy@covecall.com; if we deny a request, you may appeal by replying to our response.

You can delete your account at any time in Settings → Delete account, or by emailing privacy@covecall.com. Deletion removes your account, business profile, phone numbers, and associated call data, except where we must retain limited records to meet legal obligations.

Revoking Google access: you can also remove CoveCall's access to your Google account at Google Account permissions.

We use only essential cookies and browser storage required to keep you signed in, secure the app, and remember basic preferences. We do not use third-party advertising or cross-site tracking cookies. For details, see our Cookie Policy.

CoveCall answers calls in an automated voice and creates recordings, transcripts, and summaries. Recording, transcription, and AI-disclosure laws vary by jurisdiction, including “two-party” (all-party) consent states and laws requiring disclosure that a caller is interacting with an automated system. As the business, you are responsible for configuring an appropriate consent and/or AI-disclosure notice in your agent's greeting where required.

CoveCall is a business tool that is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@covecall.com and we will delete it.

We are based in the United States and process information there and in other countries where we or our subprocessors operate. Where we transfer personal information across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.

We may update this Policy from time to time. If we make material changes, we will notify you (for example, by email or in-app) and update the “Last updated” date above. Your continued use of the Service after an update means you accept the revised Policy.

Privacy questions or requests: privacy@covecall.com. Data-protection inquiries: dpo@covecall.com.

Postal: Figment Imaginative, [registered mailing address to be inserted], United States.