CallPayWall
Privacy Policy
Effective date: October 22, 2026
This Privacy Policy describes how Paywall Inc., a Delaware corporation ("Company", "we", "us", or "our"), collects, uses, discloses, and protects personal information in connection with CallPayWall (the "Service"), including our iOS app, Android app, and web app at callpaywall.com, as well as our in-app AI assistant, Paige, and our separate caller/telemarketer portal.
CallPayWall is an AI phone gatekeeper and virtual receptionist. The Service answers a user's inbound calls, screens callers live with artificial intelligence, classifies caller intent, charges commercial and sales callers a fee to reach the account owner, can capture and (where the owner directs) resell business leads, lets the owner take over a call, and offers an email-pitch channel, scheduling, and voicemail. Because the Service operates on live phone calls, it necessarily transcribes and AI-screens calls, and it records certain calls as described in Section 6. Please read this Policy carefully, including the sections on Call Recording & AI Screening and SMS / Messaging Data & Consent.
AI and Automated Processing (Plain-English Summary)
CallPayWall is an AI-powered service. To provide it, we and our service providers use automated systems and artificial intelligence ("AI") to:
- answer and screen your inbound calls;
- listen to, transcribe, and process caller audio while a call is handled;
- classify the intent of a call (for example: sales, spam, personal, a customer, a lead, or a payment-related call);
- generate summaries, labels, recommendations, and routing or screening decisions; and
- help protect the Service, prevent fraud and abuse, and improve quality and safety.
What this means for you:
- Callers may be interacting with an AI assistant. When the Service answers, a caller may speak with our automated assistant (Paige) rather than a person.
- Audio and related data may be sent to AI and other service providers as needed to operate these features. For example, our telephony, speech-to-text, and AI/LLM providers. See Section 5 ("How We Share Information") and our Subprocessors list.
- AI output can be wrong. Automated transcriptions, classifications, summaries, and screening decisions are generated automatically and may be inaccurate, incomplete, or delayed.
- Do not rely on AI output as professional advice. The Service and its AI features are not a substitute for, and should not be relied on as, legal, financial, medical, emergency, or other professional advice. Do not use the Service for emergencies or to reach 911 or other emergency services.
- You stay in control. Owners configure screening and decide how to act on AI output; the Service provides tools, not guaranteed outcomes.
We aim to describe our AI features accurately and not to overstate their capabilities. More detail on recording, transcription, and AI screening is in Section 6.
1. Scope and Roles
1.1 This Policy applies to personal information we process about:
- Account owners ("Owners"). Individuals and businesses who create a CallPayWall account to screen their inbound calls.
- Callers. People who call an Owner protected by the Service, including consumers, commercial callers, and sales/telemarketing callers who may use our caller/telemarketer portal.
- Website and app visitors. Anyone who interacts with callpaywall.com or our apps.
1.2 Controller vs. processor. For information we collect to provide, secure, bill, and improve the Service, the Company acts as a controller (or "business" under California law). For certain data that an Owner captures through the Service about their own callers and leads, for example, lead and contact details captured during a screened call, the Company generally acts as a processor (or "service provider") on the Owner's behalf, and the Owner is the controller of that data. Where the Company acts as a processor for a business customer, our Data Processing Addendum (data-processing-addendum.md) governs that processing and supplements this Policy.
2. Information We Collect
We collect the following categories of personal information.
2.1 Account Information
- Name, business name, and account credentials.
- Phone number (including numbers you rent from us and numbers you forward to the Service) and email address.
- Profile and configuration data, such as your greeting settings, caller-fee settings, screening preferences, and call-handling mode (for example, assist vs. screen).
- Authentication identifiers managed through our cloud authentication provider.
2.2 Call Data
When the Service handles a call, we collect:
- Call metadata. Caller and called numbers, timestamps, call duration, routing and forwarding information (including the forwarded-from number used to identify the intended business), call status and outcome, and similar signaling data.
- Audio recordings of the calls the Service records (see Section 6), and of voicemail and pitch messages that callers leave.
- Transcripts of calls produced by our speech-to-text provider.
- AI-generated summaries and classifications, including intent classification (for example, sales vs. personal), screening decisions, and post-call summaries and recommendations.
2.3 Lead Data
When an Owner uses lead-capture or lead-resale features, the Service captures lead data about callers. Such as caller name, phone number, email, company, stated purpose, and other details disclosed during the call. Lead data is captured under the Owner's control and configuration; see Sections 1.2 and 5.4.
2.4 Payment Information
- For Owners and callers who pay fees, we use a third-party payment processor to process payments and, for Owner payouts, that processor's payout service. We receive limited transaction data such as payment status, amount, currency, the last four digits and brand of a card, and billing identifiers.
- Subscriptions purchased in our mobile app are processed by the app store you purchase through, under that app store's terms. We receive transaction and subscription status information from the app store, not your card details.
- The Company never stores full payment card numbers. Full card data is handled directly by our payment processor or the app store.
2.5 SMS / Verification Data
- Mobile phone numbers and verification codes used to verify your number and your identity.
- SMS message content and delivery metadata sent or received through the Service (for example, payment links, scheduling links, and notifications) via our telephony and SMS provider.
- Your consent records for messaging (see Section 7).
2.6 Device, Usage, and Log Data
- Device and app information, operating system, app version, and identifiers.
- IP address and approximate location derived from IP or network information.
- Log data, diagnostics, crash data, and usage events (features used, pages viewed, interactions, and timestamps).
- Cookies and similar technologies on callpaywall.com and in-app. See our Cookie Policy.
2.7 Communications and Support
- Records of your communications with us, including support requests sent to support@callpaywall.com and feedback.
2.8 California Categories of Personal Information (CCPA / CPRA)
The table below maps the information described above to the statutory categories under the California Consumer Privacy Act, as amended by the CPRA, the business purposes for which we use each category, and the categories of third parties (service providers) to which we may disclose it for those purposes. This section is intended to be consistent with the data categories disclosed in our app-store privacy labels.
| Statutory category | Examples in CallPayWall | Purpose | Disclosed to (service-provider categories) |
|---|---|---|---|
| Identifiers | Name, email, phone number, IP address, account/user ID, authentication identifiers | Provide and secure the Service; authenticate; verify numbers; communicate | Cloud hosting & authentication; telephony/SMS; email delivery; advertising partner Meta (our Facebook ads page only, email and phone hashed, see Section 5.6) |
| Customer records & commercial information | Fees, purchases, transaction and payout records, payment reference IDs (no card numbers) | Charge callers, pay Owners, billing, fraud prevention | Payment processor; cloud hosting |
| Internet / network & usage activity | App and site interactions, features/pages used, logs, diagnostics, device, browser, OS, referrer | Operate, secure, debug, and improve the Service; first-party analytics; website usage analytics (session replays and heatmaps, collected with consent where required, with form inputs and sensitive content masked) | Cloud hosting; analytics and session-replay provider; advertising partner Meta (our Facebook ads page only, see Section 5.6) |
| Geolocation (approximate) | Coarse location derived from IP address | Security, fraud prevention, localization | Cloud hosting |
| Audio, electronic & visual information | Call audio recordings, voicemail and pitch recordings, call transcripts | Answer, screen, record, transcribe, and summarize calls; post-call quality review; billing/dispute proof | Telephony (recording storage); speech-to-text; text-to-speech; AI/LLM screening and quality review |
| Professional / business information | Business name, business profile, hours, services, screening configuration | Operate the Service for business Owners; configure AI screening | Cloud hosting; AI/LLM screening |
| Inferences | AI intent classifications; spam/sales/lead labels; call summaries; lead quality scores | Screen and route calls; assist Owners | AI/LLM screening |
| Sensitive personal information * | Phone number; account log-in credentials; contents of communications (call audio and transcripts) | Provide the Service (call screening/recording) and authenticate. We do not use or disclose sensitive personal information to infer characteristics or for any purpose other than providing the Service and the purposes permitted by law. | Telephony; speech-to-text; AI/LLM screening; authentication |
* Some of this data, in particular, the contents of calls, may constitute "sensitive personal information" under the CPRA. We limit our use of sensitive personal information to the purposes permitted under Cal. Civ. Code § 1798.121 and necessary to provide the Service. You may exercise the right to limit described in Section 11.2.
Sale and sharing. We do not sell your personal information for money. On our Facebook ads page (callpaywall.com/fb) we share information with Meta for advertising, which California law may treat as "sharing" for cross-context behavioral advertising. Section 5.6 explains what we share and how to opt out. Apart from that page, we do not use third-party advertising trackers on our website or apps, and we do not share your personal information for cross-context behavioral advertising. We use a third-party analytics and session-replay provider (Microsoft Clarity) to understand website usage (session replays and heatmaps); it is configured to mask form inputs and sensitive content, and outside the ads page, where consent is required, it runs only with your consent as described in our Cookie Policy. Disclosures to the categories of service providers listed above and in our Subprocessors page are made under contract for the business purposes described and are not "sales" or "sharing" as defined by the CCPA/CPRA.
3. How We Use Information
We use personal information to:
- Provide the Service. Answer, screen, classify, record, transcribe, summarize, route, and connect calls; operate Paige; capture and (where directed) deliver leads; provide voicemail, scheduling, and the email-pitch channel; and operate the caller/telemarketer portal.
- Charge and pay. Collect caller fees set by Owners, process number-rental package payments, and pay Owners through our payment processor.
- Verify identity and numbers. Perform phone-number verification and reduce fraud and abuse.
- Communicate. Send service messages, payment and scheduling links, security alerts, and (with consent where required) marketing.
- Secure and maintain. Monitor, debug, prevent fraud, enforce our terms, and protect the rights, safety, and property of users and the Company.
- Improve the Service. Analyze usage and call outcomes to improve screening accuracy and product quality, including the automated post-call quality review described in Section 6.5. We do not use the content of an Owner's calls or captured leads to train third-party public models, and we apply contractual restrictions on our subprocessors consistent with this Policy and our DPA.
- Comply with law. Meet legal, tax, accounting, and regulatory obligations and respond to lawful requests.
4. Legal Bases for Processing (GDPR / UK GDPR)
Where the EU GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service to Owners and processing payments | Performance of a contract (Art. 6(1)(b)) |
| Phone/number verification, fraud prevention, security, service improvement | Legitimate interests (Art. 6(1)(f)) |
| Recording and screening calls; SMS messaging where consent is required | Consent (Art. 6(1)(a)) and/or legitimate interests, subject to applicable call-recording and messaging law |
| Legal, tax, and regulatory compliance | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) or legitimate interests, as permitted |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object as described in Section 11. Where we rely on consent, you may withdraw it at any time without affecting prior processing.
5. How We Share Information
We share personal information only as described below. We do not sell personal information for money.
5.1 Subprocessors and Service Providers
We share information with vetted third parties that process data on our behalf to operate the Service. These service providers act on CallPayWall's behalf and under our instructions. They may use the data only to provide their services to us, and not for their own purposes. Analytics and content delivery providers may also process limited technical data (such as IP address and device information) under their own terms, as described in our Cookie Policy. We use the following categories of service providers:
- Telephony and call-recording providers: carry calls and SMS messages, stream live call audio to our systems, and store call recordings and voicemail and pitch recordings.
- Speech recognition (transcription) providers: turn call audio, voicemail and pitch messages, and recorded calls used in quality review into text.
- Voice synthesis (text-to-speech) providers: turn the text of Paige's replies into Paige's voice. They receive the words Paige speaks, which can include details a caller gave that Paige repeats back.
- AI and language-model providers: power Paige's real-time screening voice and conversation, classify caller intent, help with screening decisions, produce call summaries, and perform post-call quality review of call recordings and transcripts (see Section 6.5).
- Payment processors and app-store platforms: process payments, in-app purchases, and Owner payouts.
- Cloud hosting, storage, email, and authentication providers: host the Service, store data, send email, and sign users in.
- Push-notification services: deliver app notifications to your device.
- Mapping and business-listing data providers: look up public business information when an Owner sets up their business profile.
- Analytics and session-replay providers: help us understand website usage, as described in our Cookie Policy.
- Content delivery networks: deliver website files and fonts to your browser.
See subprocessors.md for more detail.
5.2 Payment Processing
Payment and payout data is shared with our payment processor to process transactions and Owner payouts.
5.3 Legal, Safety, and Corporate Transactions
We may disclose information to comply with law or legal process, to enforce our agreements, to protect rights and safety, or in connection with a merger, acquisition, financing, or sale of assets (subject to this Policy).
5.4 Owner-Controlled Sharing
Business-account Owners control data captured through their account, including lead data and the configuration of lead capture and lead resale. When an Owner directs the Service to deliver or resell a captured lead, the lead is shared as configured by that Owner, who is the controller of that data. The Company acts as a processor for such data under our DPA. Caller requests may be shared with other local service providers through the CallPayWall lead exchange.
5.5 "Sharing" Under California Law
We do not "sell" personal information for monetary consideration. Our use of the Meta Pixel and the Meta Conversions API on our Facebook ads page (Section 5.6) may be "sharing" for cross-context behavioral advertising. To the extent any disclosure constitutes a "sale" or "sharing" (including for cross-context behavioral advertising) under the CCPA/CPRA, you may opt out as described in Section 5.6 and Section 11. We honor opt-out preference signals (such as Global Privacy Control).
5.6 Advertising on Our Facebook Ads Page: Meta Pixel, Conversions API, and Microsoft Clarity
When you visit callpaywall.com/fb, the page people reach from our ads on Facebook and Instagram, we share information with Meta Platforms, Inc. ("Meta") for advertising. We do this in two ways:
- Meta Pixel. A small piece of code from Meta runs in your browser on that page. It tells Meta which steps you take there (for example, viewing the page, starting a demo, or leaving your contact details), together with Meta's own cookies, your IP address, and your browser details.
- Meta Conversions API. Our servers send Meta the same steps directly. If you give us your email address or phone number on that page, we send them to Meta only in hashed (scrambled) form, together with your IP address, your browser details, and the identifiers Meta adds when you click an ad.
Meta uses this information to measure how well our ads work, to show our ads to people who are likely to be interested, and to improve its advertising services, as described in the Meta Privacy Policy. We do not send Meta the content of your calls.
We also use Microsoft Clarity, described in our Cookie Policy. On the ads page, Clarity runs with its analytics and advertising signals turned on unless you opt out. On every other page of our website, Clarity follows the choice you make in our cookie banner, and both signals stay off until you make one.
How to opt out. Click "Do not sell or share my personal information" at the bottom of the ads page, our home page, or our other website pages. This saves a choice in your browser that turns off the Meta Pixel, stops our servers from sending your activity to Meta through the Conversions API, and turns off the Clarity signals on the ads page. We treat a Global Privacy Control signal from your browser as the same opt out, and an earlier choice to decline advertising cookies in our cookie banner has the same effect. Your choice is saved for each browser, so if you clear your cookies or use another browser or device, please opt out there as well. You can also email privacy@callpaywall.com.
6. Call Recording & AI Screening
6.1 Transcription, AI screening, and recording are core functions of the Service. When the Service answers a call, it transcribes the call via our speech-to-text provider and uses AI providers to screen the caller, classify intent, decide routing, and produce summaries and recommendations. Paige is the in-app interface for these AI functions. Not every call is recorded:
- Business and sales calls (for example, a caller pitching or offering business to the Owner) may be recorded, but only after the caller hears a spoken notice that the call may be recorded.
- Personal calls are never recorded.
- Owner Take Over conversations, where the Owner joins and speaks with the caller, are not recorded by default.
- Voicemail and pitch messages that a caller chooses to leave are recorded so the Owner can hear them.
6.2 Notice and consent. Call recording is regulated and, in some jurisdictions, requires the consent of one or all parties. The Service provides callers with notice that a call may be recorded and screened. Owners are responsible for ensuring that their use of recording and screening complies with the laws applicable to them and their callers, including any one-party or all-party consent requirements. Callers who do not consent may decline to proceed.
6.3 Human takeover. An Owner may take over a screened call. The Owner's conversation with the caller is not recorded by default. When an Owner is connected, the call continues to be subject to this Policy and to applicable recording-notice requirements.
6.4 AI limitations. Automated classification and screening may be imperfect. Screening decisions, intent classifications, and summaries are generated to assist Owners and may contain errors. Owners remain responsible for how they act on this information.
6.5 Post-call AI quality review. To improve the Service, after a call ends we may run an automated quality review of how Paige handled it, for example whether she understood the caller, said the right things, and sounded natural. For a recorded call, the recording is sent to our AI and speech-recognition providers for this review. Call transcripts may be sent to our AI providers for the same purpose. We use the results to improve Paige and the Service. These providers process the audio and transcripts on our behalf for this purpose only. We do not use the content of an Owner's calls to train third-party public models.
7. SMS / Messaging Data & Consent
7.1 We use a third-party telephony and SMS provider to send and receive SMS messages, such as phone-number verification codes, payment links, scheduling links, voicemail notifications, and service alerts.
7.2 Consent. By providing your mobile number and using messaging features, you consent to receive service-related messages at that number. Message and data rates may apply. Messaging frequency varies. You can opt out of non-essential messages by replying STOP to a message or by contacting support@callpaywall.com; reply HELP for help. Opting out of certain messages may limit functionality (for example, verification or payment links). We retain records of consent and opt-out requests.
7.3 We do not share mobile numbers or message content with third parties for their own marketing.
7.4 We do not sell, rent, or share SMS opt-in consent, phone numbers, or SMS data with third parties for marketing or promotional purposes.
SMS and Mobile Information
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding vendors acting on our behalf solely to deliver the messages, such as our SMS provider.
8. International Data Transfers
The Service is operated from, and data may be processed in, the United States and other countries where we and our subprocessors operate. When we transfer personal information from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we use appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum / IDTA where applicable) and supplementary measures as needed. You may request a copy of the relevant safeguards by contacting privacy@callpaywall.com.
9. Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Owners can configure certain retention settings and can delete data as described in Section 12. The following table reflects our default retention approach; specific periods may vary based on Owner configuration and legal requirements.
| Data category | Default retention |
|---|---|
| Account information | For the life of the account, then up to 90 days after deletion (longer where required by law) |
| Call metadata | Up to 24 months, then aggregated or deleted |
| Technical call logs kept by our call-handling servers (for troubleshooting and quality review) | Up to 90 days |
| Audio recordings | Up to 12 months by default, or as configured by the Owner; deletable on request |
| Transcripts and AI summaries/classifications | Up to 12 months by default, or as configured by the Owner |
| Lead data | Retained per the Owner's configuration; deleted on Owner instruction or account closure (subject to the DPA) |
| Payment/transaction records | As required for tax, accounting, and audit purposes (typically up to 7 years); full card numbers are never stored by the Company |
| SMS content and consent records | Consent/opt-out records retained as required by messaging law; message content retained up to 18 months |
| Device, usage, and log data | Up to 24 months |
When retention periods expire, we delete or de-identify the data.
10. Security
We implement technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls and least-privilege permissions, network and application security controls, logging and monitoring, secure software development practices, and vendor due diligence. Full card data is handled by our payment processor and is never stored by the Company. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and the relevant authorities as required by law.
11. Your Privacy Rights
Subject to applicable law and verification of your identity, you have the following rights.
11.1 EEA / UK / Switzerland (GDPR)
- Access a copy of your personal information.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten").
- Restriction of processing.
- Data portability in a structured, commonly used, machine-readable format.
- Object to processing based on legitimate interests or to direct marketing.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with your supervisory authority.
11.2 California (CCPA / CPRA)
- Right to know the categories and specific pieces of personal information we collect, use, disclose, and share.
- Right to delete personal information, subject to exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of any "sale" or "sharing" of personal information (including cross-context behavioral advertising). We honor recognized opt-out preference signals where required.
- Right to limit the use of sensitive personal information to permitted purposes.
- Right to non-discrimination for exercising your rights.
11.3 How to Exercise Your Rights
Submit a request in-app or by emailing privacy@callpaywall.com. We will verify your request and respond within the timeframes required by law. You may use an authorized agent where permitted. If your data is processed by the Company on behalf of an Owner (for example, lead data), we will refer your request to the relevant Owner or assist them in responding, as required by our DPA.
12. Account & Data Deletion
You can delete your account and associated data:
- In-app. Through the account settings / delete-account option in the iOS, Android, or web app; and
- By email. By contacting privacy@callpaywall.com.
When you delete your account, we delete or de-identify your personal information in accordance with Section 9, except where retention is required by law (for example, transaction records) or to resolve disputes and enforce agreements. Some data may persist in backups for a limited period before being overwritten.
13. Children's Privacy
The Service is not directed to, or intended for, children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact privacy@callpaywall.com and we will take appropriate steps to delete it.
14. California "Shine the Light"
California residents may request information about the categories of personal information (if any) we disclosed to third parties for those third parties' direct marketing purposes in the prior calendar year. We do not share personal information with third parties for their own direct marketing. To make a request, contact privacy@callpaywall.com.
15. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will update the "Effective date" above and provide notice through the Service or by other reasonable means. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.
16. Contact Us
Paywall Inc. Attn: Privacy 16192 Coastal Highway, Lewes, DE 19958
- Privacy inquiries: privacy@callpaywall.com (default: privacy@callpaywall.com)
- Support: support@callpaywall.com (support@callpaywall.com)
EU Representative (Art. 27 GDPR): eu@callpaywall.com UK Representative: uk@callpaywall.com