CallFlow
by Serverlys
Last updated: August 24, 2026
CallFlow, operated by Serverlys LLC ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI voice agent platform, website, and related services (collectively, the "Service").
By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
Which privacy obligations apply to us depends on whose data is involved, and it is important to be precise about this.
We are a controller for account data
When you sign up, browse the site, contact us, or pay us, we decide why and how that information is used. This policy governs that processing.
We are a processor for call data
When your AI agent answers a call, the caller's personal information belongs to your business. You are the controller and decide what is collected, how long it is kept, and what happens to it. We process it on your documented instructions in order to deliver the Services. If you are a caller who spoke with an agent and want your data corrected or erased, contact the business you called; if you contact us, we will refer you to them.
Because the Services operate on the telephone, the data involved is more sensitive than a typical web product. We are explicit about it:
Voice cloning and biometric law
A voice model derived from a recording of a specific person may qualify as a biometric identifier under laws such as the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act. Those laws generally require written notice and consent before collection, and they provide for statutory damages. If you use voice cloning, you must obtain and retain that consent from the speaker before submitting a sample. We use a submitted voice sample only to build and operate the voice on your account, we do not use it to build any general-purpose model, and we delete the sample and derived model when you remove the voice or close your account.
We use the information we collect to:
We do not use your call content to train general-purpose AI models. Call recordings, transcripts, uploaded knowledge base content and voice samples are used to deliver the Services to you, and for no other purpose, unless you instruct us otherwise in writing.
We do use operational data — such as error rates, latency measurements, call volumes and aggregate statistics that do not identify any individual or business — to monitor reliability and improve the product. You cannot be re-identified from that data.
Some of the third parties described in section 6 operate their own model-improvement programmes. We configure our accounts with those providers to exclude customer content from training wherever that option is offered. If a provider changes its terms in a way that affects this commitment, we will update this policy and tell affected customers before the change takes effect.
CallFlow is built on specialist infrastructure rather than operated end to end by us. We use the following categories of provider, each bound by a written agreement that limits them to processing data on our instructions and requires appropriate security:
| Category | What they handle |
|---|---|
| Voice AI infrastructure | Real-time speech recognition, language understanding and speech synthesis during a call. |
| Telecommunications carriers | Connecting calls, provisioning numbers, and delivering messages. Carriers act as independent controllers for their own network, billing and fraud-prevention purposes. |
| Language model providers | Generating agent responses and post-call summaries. |
| Cloud hosting and storage | Running the application and storing recordings, transcripts and account data. |
| Payment processing | Taking subscription payments. We never see or store your full card number. |
| Email and support tooling | Sending transactional email and handling support requests. |
A current list naming each provider, its location and its role is available on request from support@serverlys.com, and is provided as a matter of course to customers who sign a Data Processing Agreement with us. We will give notice of a new provider handling call content before it begins processing, so that you have an opportunity to object.
We implement industry-standard security measures to protect your data, including:
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
You control retention of your call data and can delete recordings and transcripts from your dashboard at any time. Absent an instruction from you, our defaults are:
| Data | Retention |
|---|---|
| Call recordings | Retained while your account is active; deleted within 30 days of deletion by you or closure of your account. |
| Transcripts, summaries and call logs | Retained while your account is active; deleted within 30 days of account closure. |
| Voice samples and cloned voice models | Deleted within 30 days of you removing the voice or closing your account. |
| Account and profile data | Deleted within 30 days of account closure. |
| Billing and tax records | Retained for seven years, as required by law. |
| Website enquiries and support correspondence | Retained for two years from the last contact. |
We may retain data beyond these periods where we are required to do so by law, or where it is needed to establish, exercise or defend a legal claim. Backups are overwritten on a rolling cycle and data deleted from the live system is removed from backups within 90 days.
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to receive a portable copy, to object to or restrict certain processing, to withdraw consent you previously gave, and not to be discriminated against for exercising any of these rights. Residents of the EEA, the UK and Switzerland hold these rights under the GDPR; residents of California and other US states with comprehensive privacy laws hold equivalent rights, including the right to opt out of the sale or sharing of personal information.
We do not sell your personal information
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.
To exercise a right, email support@serverlys.com with the subject line "Privacy Request". We will acknowledge your request and respond within 45 days, and will tell you in advance if we need a further 45 days for a complex request. We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting, and an authorised agent must provide written authority to act on your behalf.
If we decline your request you may appeal by replying with the subject line "Privacy Appeal", and we will review the decision. You also have the right to complain to your data protection authority — in the EEA your national supervisory authority, in the UK the Information Commissioner's Office, and in California the California Privacy Protection Agency.
We are based in the United States and process data there. If you are located in the EEA, the UK or Switzerland, transferring your data to us involves an international transfer. Where that happens we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary technical measures such as encryption in transit and at rest. A copy of the clauses we rely on is available on request. Telecommunications carriers route calls across their own international networks under their own transfer arrangements.
No system is perfectly secure. If we become aware of a breach affecting your personal information or your call data, we will notify you without undue delay and in any event within 72 hours of becoming aware of it, unless a law enforcement authority directs us to delay. Our notice will describe what happened, what data was involved, what we are doing about it, and what we recommend you do. Where we act as your processor, we will notify you promptly so that you can meet your own notification deadlines to regulators and to affected individuals.
Healthcare organisations may only use the Services with Protected Health Information once a Business Associate Agreement is signed by both parties and a HIPAA-eligible configuration has been enabled on the account. That configuration restricts which providers may process call content, enables audit logging and access controls, and applies stricter retention defaults. Until a BAA is in force, you must not configure an agent to collect PHI, and any PHI reaching the Services is handled under the terms of this policy rather than under HIPAA safeguards. Contact support@serverlys.com to begin that process.
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or our data practices, contact us at: