Privacy Policy

1. Introduction

Withn, operated by Read Laboratories ("we," "us," or "our"), offers the AI Receptionist service available at withn.tech/ai-receptionist. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our AI Receptionist product. By using the Service, you agree to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

2.1 Account Information

• Name and email address provided during registration
• Business information such as company name, industry, and greeting preferences
• Password (stored in hashed form)

2.2 Payment Information

• Payment details (credit card number, billing address) are processed and stored by Stripe. We do not store your full payment card details on our servers.
• We retain transaction records (plan type, amount, date) for billing and accounting purposes.

2.3 Call Data

• Phone call recordings when you enable recording with an audible consent notice. Recording defaults off.
• Call transcripts generated from live call audio, independently of whether a recording is retained
• Caller information such as phone number, name (if provided), and call duration
• AI-generated call summaries
• Connected account data such as calendar availability, booking details, synced contacts, and CRM delivery records when you connect those providers
• Company documents uploaded on Pro, including their text and search representations. Documents default to internal; only documents you explicitly approve for callers can inform phone answers.
• Optional website scans: The URL you submit and content from its public pages are processed to suggest receptionist details. The facts you review and apply, together with their source URLs, are saved in your receptionist instructions for use in calls.

2.4 Usage Data

• Pages visited, features used, and interactions within your dashboard
• IP address, browser type, device information, and operating system
• Log data and analytics information

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the AI Receptionist service, including answering calls and making transcripts and summaries available in your authenticated dashboard
• Process payments and manage your subscription
• Send service-related account and billing communications. Call summaries are available in the Call Log; they are not emailed.
• Perform calendar, contact, CRM, and custom webhook actions only through the connections and AI permissions you enable
• Improve the quality of our AI voice and response capabilities
• Provide customer support
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Third-Party Services

We use the following third-party services to operate the AI Receptionist. Each has its own privacy policy governing how they handle data:

• Vapi: Handles inbound phone calls and voice interactions. Call audio is processed through Vapi's infrastructure.
• ElevenLabs: Provides voice synthesis for your AI receptionist's spoken responses. Text is sent to ElevenLabs to generate audio.
• OpenAI: Powers AI conversation logic, company-document search, and extraction of suggested facts from website scans. Relevant call text, approved context, document text, and scanned public page content are processed to support those features.
• Firecrawl: Receives the website URL you submit and retrieves public page content for the optional onboarding scan.
• Stripe: Processes all payments. Your payment information is handled directly by Stripe and is subject to Stripe's privacy policy.
• Supabase: Provides database hosting, private file storage, and user authentication. Your account data and call records are stored in Supabase's infrastructure.
• Deepgram: Processes live call audio to produce transcripts.
• Connected providers: Google Calendar and Meet, Google or Apple Contacts, supported CRMs, and your custom webhook destinations receive the data needed for the connections and AI actions you authorize.

We do not sell your personal information to any third party. Data shared with the above providers is strictly for operating the Service.

5. Google User Data

If you choose to connect a Google account, the AI Receptionist requests only the following scopes, and only for the features you turn on:

• Google Calendar (calendar.events, calendar.freebusy): read your free/busy times so the receptionist can offer real openings to callers, and create the booking a caller confirms. We never read the contents of events we did not create.
• Google Contacts (contacts.readonly): read-only access used solely to recognize a known caller by their phone number and greet them by name.
• Email address (userinfo.email): identifies which Google account is connected so you can manage or disconnect it.

Google user data is used only to deliver these features to you. Specifically, we do not use it for advertising or serve ads against it, we do not sell or transfer it to third parties for advertising, market research, or any other independent purpose, we do not use it to train generalized or third-party artificial intelligence or machine learning models, and we do not allow humans to read it, except where you give explicit consent for a specific issue, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

Connection tokens are stored encrypted, scoped to your tenant, and never shared between accounts. You can disconnect a Google account at any time from Settings in your dashboard, which revokes our access and deletes the stored tokens. You can also revoke access directly at myaccount.google.com/permissions. Contact data retrieved for caller recognition is cached only for as long as the integration remains connected and is deleted when you disconnect or delete your account.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Retention

We retain your data as follows:

• Account data, call logs, and transcripts: Retained with your account until account deletion, subject to applicable retention requirements. Account deletion can be requested from the dashboard. Contact support with requests concerning specific call data.
• Optional call recordings: Availability is governed by the phone provider's retention settings, currently a 14-day window, and may end earlier after deletion. This is not a guarantee of recording availability. Recordings are not retained indefinitely with your account.
• Payment records: Retained for up to 7 years to comply with tax and accounting requirements.
• Usage and analytics data: Retained in aggregated, anonymized form indefinitely.

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request corrections to inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated data. We will process deletion requests within 30 days.
• Export: Request a portable copy of your data (call logs, transcripts, account information) in a standard format.
• Opt-out: Unsubscribe from marketing communications at any time.

To exercise any of these rights, contact us at jake@withn.tech.

8. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• No Sale of Personal Information: We do not sell personal information to third parties.

To submit a CCPA request, email us at jake@withn.tech with the subject line "CCPA Request."

9. Cookies and Tracking

Our website uses cookies and similar technologies for authentication, preferences, and analytics. Essential cookies are required for the Service to function (e.g., session management and login). Analytics cookies help us understand how you use the Service. You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Service.

10. Data Security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS/SSL), encrypted storage, secure authentication, and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The AI Receptionist service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: