Where your call data goes.

• Transcripts, caller names and numbers, bookings, call outcomes — stored in our database, run by Supabase in Sydney, Australia. Your business settings and the answers you teach the AI live there too.
• Call recordings — calls are recorded. The audio is kept by Vapi, the service that runs our calls, on its storage in its US region. We save a link to each recording in our database so you can play it in your dashboard.
• Bookings in Google Calendar — if you connect Google Calendar, each booking (the caller’s name, phone number and booking details) is also written to your calendar, which Google stores in its own data centres.

These services touch call audio or text while we answer a call:

• Vonage — the phone carrier that connects the caller to our system.
• Vapi — runs the call, records it, and keeps its own copy of the recording and transcript. We use Vapi’s US region.
• Deepgram — turns the caller’s speech into text, through Vapi. Deepgram’s standard service is hosted in the United States.
• ElevenLabs — turns the AI’s reply into a spoken voice, through Vapi. ElevenLabs stores data in the United States by default.
• Anthropic (Claude) — the AI that reads the conversation and decides what to say. We also send batches of past transcripts to Claude to spot patterns and suggest improvements. Anthropic stores data in the United States, may process it in other countries, normally deletes it within 30 days, and does not train its models on it.
• ClickSend — sends the booking confirmation text to the caller. ClickSend is an Australian company hosted on Amazon Web Services, and may route messages through other countries.
• Resend — sends emails to you, such as weekly summaries and alerts that quote a question a caller asked. Resend stores data in the United States.
• Render and Vercel — host our call-handling server and our website and dashboard. Neither has a data centre in New Zealand.
• Sentry — receives error reports from our server and website so we can fix problems. Sentry stores data in the United States or Germany.
• Stripe — handles your subscription payments. It never receives caller information.

We do not sell call data.

Honestly: we don’t yet delete call data on a schedule. Transcripts, caller details and bookings stay in our database, and recordings stay with Vapi for as long as its plan keeps them, until someone deletes them. Anthropic normally deletes what we send it within 30 days.

If you or one of your callers wants something removed, email us and we’ll delete it. Your rights are set out in our privacy policy.

Not straight away, unless you ask for it. The standard greeting is “Hi, thanks for calling [your business]. How can I help you today?” It doesn’t say the caller is talking to an AI, or that the call is recorded. If a caller asks whether they’re talking to a person, the AI is instructed to say it’s a virtual assistant.

We can change your greeting to say both. We recommend it, because it covers the transparency point below.

Your callers’ details are personal information, so the Privacy Act’s 13 information privacy principles (IPPs) apply. The ones that matter most here:

• Tell people (IPP 3) — when you collect someone’s information, they should know what’s being collected, why, and who will see it. The Privacy Commissioner expects businesses using AI to explain it in plain language before collecting information. A greeting that says “AI” and “recorded” does a lot of this work.
• Keep it safe (IPP 5) — take reasonable steps to protect it, and check that the services you rely on do too. Your dashboard is behind your login.
• Let people see and fix it (IPPs 6 and 7) — callers can ask what you hold about them and ask for corrections. We’ll help you find it.
• Don't keep it longer than needed (IPP 9) — since we don’t delete automatically yet, tell us if you want old calls removed.
• Sending it overseas (IPP 12) — IPP 12 covers sending personal information outside New Zealand. The Privacy Commissioner’s guidance is that using a provider only to store or process information on your behalf is usually not a “disclosure” under IPP 12, but you stay responsible for how it’s handled. Because the services above are overseas, it’s worth telling callers their information may be processed outside New Zealand.

This is general information, not legal advice. For your own situation, see privacy.org.nz or talk to your adviser.

Ask us anything about this page at cayden@keaconcepts.com.