Privacy Policy

1. Introduction

Welcome to NextCall Technologies ("NextCall," "we," "us," or "our"). We operate the NextCall AI Receptionist platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service in compliance with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). By using NextCall, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

• Account Information: Name, email address, business name, business type, and phone number provided during onboarding (processed via Clerk).
• Call Data: Incoming and outgoing phone call audio, metadata (caller ID, duration, timestamps), AI-generated transcripts, call summaries, and sentiment analysis.
• Payment Information: Billing details and transaction history processed securely through Paddle (our Merchant of Record). We do not store raw credit card numbers on our servers.
• Usage Data: Log data, IP addresses, browser type, and interaction patterns with the dashboard.
• Google Account and Integration Data: When you choose to connect a Google service (Google Calendar or Google Business Profile) through the NextCall dashboard, we may receive the information necessary to provide that integration — including Google Calendar authorization and integration details needed to create appointment events, and Google Business Profile information such as customer review content and ratings. Google data is not collected unless you choose to connect the applicable Google service, and we do not read the contents of your existing calendar.

3. How We Use Your Information & Legal Basis

We use your data for the following purposes, based on the corresponding legal bases required by GDPR:

• To provide and maintain the Service: Processing transactions, routing calls, and delivering core functionality (Contractual Necessity).
• To configure and personalize the AI agent: Using your provided Knowledge Base to route calls and generate responses (Contractual Necessity).
• To send critical notifications: Emergency escalations, appointment reminders, and account alerts (Legitimate Interest).
• To monitor usage and prevent fraud: Enforcing our Terms of Service and securing the platform (Legitimate Interest & Legal Obligation).

4. Google API Data & Limited Use

NextCall offers optional integrations with Google services. These integrations are enabled only when a business owner explicitly chooses to connect their Google Account through the NextCall dashboard.

Google Calendar

Authorized Google Calendar access is used to create calendar events for appointments confirmed through the NextCall AI receptionist. Events are created in the connected business owner's primary calendar, and may include the appointment/customer name, the scheduled start and end time, the business owner's company name as the event location, a short AI summary of the call, and limited context such as the customer's phone number and a brief excerpt of the call transcript.

NextCall uses this access only to create events for new appointments. The application does not use the Google Calendar integration to read, list, modify, or delete existing calendar events, and does not access the contents of your other calendars.

Google Business Profile

If you connect your Google Business Profile, NextCall may retrieve customer review content and ratings from your profile. This information is used for the AI-assisted review-response feature, in which a suggested response is generated and may then be published back to the connected business's Google Business Profile on your behalf.

AI Processing

To generate review responses, Google Business Profile review content and rating information may be processed by OpenAI, a third-party AI provider. This processing exists solely to provide the review-response functionality you requested, and is used for no other purpose. Google user data is not sold, is not used for advertising, and is not used to train or improve generalized AI/ML models.

Limited Use

NextCall's use and transfer of information received from Google APIs complies with Google's User Data Policy, including the Limited Use requirements.

User Control

Connecting Google services is optional. You can disconnect your Google integrations at any time from the NextCall dashboard (Settings → Integrations). Disconnecting removes the stored Google refresh token and stops the creation of new appointment events and automated review responses. When you disconnect, we do not automatically revoke the Google OAuth authorization on Google's side; you can also remove NextCall's access from your Google Account's third-party app permissions.

6. Sharing of Information

We do not sell your personal information. We share data only with Third-Party Service Providers who perform services on our behalf:

When you enable a Google integration, information obtained through Google APIs may be processed by the service providers necessary to provide the functionality you requested. In particular, Google Business Profile review content and rating information may be sent to OpenAI to generate an AI-assisted response, which is then published back to your Google Business Profile on your behalf.

7. Data Retention & Deletion

For active subscriptions, we retain Call Data (audio, transcripts, summaries) for the duration of your subscription to provide historical insights and improve AI context. Usage Data is retained for up to 12 months for analytics and security purposes.

Upon cancellation of your subscription, your account will enter a 30-day grace period. During this time, data is retained to allow for reactivation. After 30 days, all associated business data, call logs, and configurations are permanently scheduled for deletion from active systems.

Certain records may be retained in an anonymized format, or where required for legal, security, fraud prevention, accounting, or compliance purposes.

Google Integration Data: Google OAuth credentials are retained while the integration is connected and are removed when you disconnect the integration; no separate retention period applies. Calendar events created by NextCall may remain in your Google Calendar after they are created; we do not maintain a copy of your existing calendar contents. You can disconnect your Google integrations at any time from the dashboard.

8. Security Measures

We implement industry-standard technical and organizational safeguards to protect your data:

• Encrypted data transmission (TLS/HTTPS) for all API and web traffic.
• Strict access controls and authentication mechanisms via Clerk.
• Secure, isolated cloud infrastructure utilizing DataStax AstraDB.
• Ring-fenced Twilio sub-accounts to isolate telephony data per business.

Google OAuth credentials are handled server-side and are not exposed to the client-side application. Access to connected Google services is restricted to the authenticated business account associated with the integration.

9. Your Privacy Rights

Depending on your location (e.g., EU/UK or California), you have specific rights regarding your personal data:

• Access & Portability: Request access to or an export of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data (subject to legal retention requirements).
• Objection & Restriction: Object to or restrict the processing of your data.
• Withdraw Consent: Withdraw consent for AI processing at any time (which may limit Service functionality).

Right to Complain: You have the right to lodge a complaint with your local Data Protection Authority (DPA) or supervisory authority (e.g., the ICO in the UK) if you believe our processing of your personal information violates applicable law.

To exercise these rights, contact us at support@getnextcall.com.

10. International Data Transfers

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. Where we transfer personal data outside the European Economic Area (EEA) or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other recognized transfer mechanisms to ensure appropriate safeguards are in place.

11. Cookies & Tracking

We use cookies and similar tracking technologies to maintain user sessions (via Clerk), analyze usage patterns, and improve the Service. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

12. Age Requirements

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently gathered personal data from someone under 18, we will take steps to delete that information.

13. Changes To This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and, where practical, sending an email or in-app notification. You are advised to review this Privacy Policy periodically for any changes.