Privacy Policy & Data Protection.

1. Commitment to Legal & Surety Confidentiality

CallCourty AI is engineered specifically for legal professionals and licensed surety bail agents whose communications are subject to strict professional confidentiality obligations, including ABA Model Rule 1.6, Texas Disciplinary Rule of Professional Conduct 1.05, and Texas Occupations Code Chapter 1704.

We treat all caller audio recordings, caller statements, case notes, and inmate booking information as strictly confidential Subscriber property. We do NOT sell, rent, monetize, or broker caller or customer data to data aggregators, advertisers, or lead brokers.

2. Information We Collect

In the course of providing our telephony and intake services, we collect and process the following categories of information:

• Subscriber Account Information: Managing partner name, law firm/agency business name, physical address, email address, billing information, and practice management credentials (OAuth tokens for Clio, Filevine, etc.).
• Inbound Voice Call Audio: Audio streams transmitted across carrier SIP trunks during inbound telephone calls placed to Subscriber's provisioned telephone numbers.
• Real-Time Transcripts & Structured Dossiers: Automated speech-to-text transcriptions and structured JSON dossiers generated during intake calls (e.g., caller name, incident date, adverse parties, detention facility, charges).
• Telephony & Network Metadata: Call connection timestamps, caller ID (ANI/CNAM), call duration, terminating carrier IP, SIP response codes, and packet latency metrics required for telephony routing.

3. Contractual Zero AI Model Training Covenant

WE DO NOT TRAIN PUBLIC OR FOUNDATIONAL AI MODELS ON YOUR DATA.

Unlike consumer AI chatbots or generic voice applications, CallCourty AI operates under strict enterprise data-privacy boundaries. Caller voice audio, intake transcripts, caller identity information, and case facts processed through our Services are never ingested into public training datasets, used to train foundation models, or accessed by third-party model developers for model improvement.

All speech recognition (STT) and natural language processing operations are executed via dedicated zero-retention API endpoints under binding enterprise data processing agreements.

4. How We Use Collected Information

We process collected information solely for the following legitimate business purposes:

• Connecting inbound telephone calls and generating sub-150ms conversational speech responses.
• Generating timestamped transcripts, evidentiary scorecards, and consultation appointment slots.
• Transmitting instant emergency SMS dispatch cards to Subscriber's designated on-call attorneys or surety runners.
• Synchronizing client matter data directly into Subscriber's CRM system via encrypted webhooks.
• Executing real-time adverse party conflict-of-interest cross-checks against Subscriber's database.
• Maintaining telephony audit logs for billing accuracy and carrier regulatory compliance.

5. Sub-processors & Hosting Infrastructure

CallCourty AI utilizes a vetted group of enterprise infrastructure providers ("Sub-processors") to deliver the Services. Each sub-processor is bound by strict contractual Data Processing Agreements:

• Cloud Hosting & Storage: Amazon Web Services (AWS) Tier-4 US data centers (US-East / US-West), maintaining independent SOC 2 Type II, ISO 27001, and PCI-DSS Level 1 certifications.
• Edge Routing & DDoS Protection: Cloudflare Enterprise, providing TLS 1.3 edge termination and web application firewall protection.
• Telephony Carriers: Tier-1 telecommunications carriers (Twilio, Telnyx, Bandwidth) for direct inward dialing (DID) and PSTN interconnectivity.
• Database Infrastructure: Dedicated PostgreSQL instances with automated encrypted point-in-time backups.

6. Encryption & Security Safeguards

We protect Subscriber data through rigorous technical safeguards:

• Data in Transit: All web traffic, API calls, and WebSocket audio streams are encrypted using TLS 1.3 with modern cipher suites. Insecure protocol fallbacks are disabled.
• Data at Rest: All audio recordings, database volumes, and backup archives are encrypted using industry-standard AES-256 bit encryption.
• Role-Based Access Control (RBAC): Access to production systems is restricted to authorized engineers on a least-privilege, need-to-know basis requiring multi-factor authentication (MFA) and hardware security keys.

7. Data Retention & Permanent Deletion Controls

Subscriber maintains complete administrative control over the retention lifecycle of its data:

• Configurable Archival: Subscribers can configure automatic audio purging rules (e.g., 30-day, 60-day, or 90-day retention) via the Agency Portal.
• On-Demand Matter Shredding: Subscribers may permanently cryptographically delete any individual call recording or transcript dossier at any time.
• Account Termination Wipe: Upon account cancellation, Subscriber has thirty (30) days to export its data. Following this window, all Customer Data is cryptographically shredded across production and backup environments.

8. Subpoenas & Law Enforcement Requests

We respect the attorney-client privilege and work-product protections that apply to Subscriber communications. In the event CallCourty AI receives a third-party subpoena, court order, or search warrant demanding disclosure of Customer Data:

• We will promptly notify Subscriber in writing within twenty-four (24) hours of receipt, unless strictly prohibited by applicable law or a sealed court order.
• We will provide Subscriber with a reasonable opportunity to seek a protective order, quash the subpoena, or assert attorney-client privilege before any disclosure is made.
• We will only disclose the minimum portion of Customer Data strictly required by compulsory legal process.

9. State Privacy Rights (CCPA / CPRA & Texas TDPSA)

Under state privacy laws such as the California Consumer Privacy Act ("CCPA"), California Privacy Rights Act ("CPRA"), and Texas Data Privacy and Security Act ("TDPSA"), CallCourty AI operates as a "Service Provider" or "Processor" on behalf of Subscriber.

We process personal information solely on Subscriber's behalf and pursuant to Subscriber's documented instructions. If an individual caller contacts CallCourty AI to exercise rights of access, correction, or deletion, we will forward that request directly to the applicable Subscriber firm.

10. Contacting Our Data Protection Officer

If you have any questions regarding this Privacy Policy or our security protocols, please contact our Data Protection Officer at: