Privacy Policy

1. Introduction

Pingally Inc. ("Pingally," "we," "us," or "our") is committed to protecting your privacy and the privacy of your customers. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our AI receptionist services.

This policy applies to:

• Business Customers: Companies that subscribe to Pingally's AI receptionist services
• End Users: Individuals who call our business customers and interact with Pingally's AI receptionist
• Website Visitors: Anyone accessing pingally.com or related websites

2. Legal Framework & Compliance

Pingally complies with the following Canadian privacy laws and international standards:

• PIPEDA (Personal Information Protection and Electronic Documents Act) - Federal Canadian privacy law
• PHIPA (Personal Health Information Protection Act) - Ontario healthcare privacy law for healthcare providers
• SOC 2 Type II Certified - Third-party audited security and privacy controls
• Privacy by Design - Privacy protections built into all systems from the ground up

3. What Information We Collect

3.1 Business Customer Information

When you create a Pingally account, we collect:

• Account Information: Business name, contact name, email address, phone number, billing address
• Payment Information: Credit card details (processed securely through Stripe - we do not store full card numbers)
• Business Configuration: Business hours, appointment types, service offerings, staff availability, custom AI instructions
• Integration Data: Credentials for calendar systems (Google Calendar, Outlook), practice management software (Dentrix, PS Suite, etc.)

3.2 Call Data & Recordings

When someone calls your business and interacts with Pingally's AI receptionist, we collect:

• Call Metadata: Caller phone number, call duration, timestamp, call outcome (appointment booked, message taken, etc.)
• Call Transcripts: Text transcription of the entire conversation between the caller and AI receptionist
• Call Recordings: Audio recording of the full call (retained for 90 days for quality assurance, then automatically deleted)
• Caller Information: Name, phone number, email address, appointment preferences, reason for calling
• Personal Health Information (PHI): For healthcare customers, callers may disclose symptoms, medical conditions, or other health information during calls

3.3 Technical & Usage Data

• Website Analytics: IP address, browser type, device information, pages visited, time spent on site
• System Logs: API requests, error logs, performance metrics, system health data
• Cookies: Essential cookies for authentication, analytics cookies (Google Analytics), preference cookies. See our Cookie Policy for details.

4. How We Use Your Information

4.1 Primary Service Delivery

• Answer incoming calls and interact with callers using AI technology
• Book appointments in your calendar system
• Capture lead information and route urgent calls to staff
• Send appointment confirmations and reminders via SMS/email
• Provide call transcripts and analytics dashboards

4.2 Service Improvement

• Analyze call transcripts to improve AI accuracy and response quality
• Identify common customer questions to enhance AI training
• Monitor system performance and uptime
• Develop new features based on usage patterns

4.3 Business Operations

• Process billing and payments
• Provide customer support and technical assistance
• Send service updates, new feature announcements, and important notices
• Detect and prevent fraud or abuse
• Comply with legal obligations and respond to legal requests

4.4 Marketing (with consent)

• Send promotional emails about new features or services (opt-out available)
• Share case studies or testimonials (only with explicit permission)
• Conduct customer satisfaction surveys

5. Data Storage & Security

5.1 Canadian Data Residency

• Primary Storage: AWS Canada Central (Montreal) region
• Database: PostgreSQL hosted on AWS RDS in Canada
• Call Recordings: AWS S3 buckets in Canada Central region
• Backups: Encrypted backups stored in Canada with 30-day retention
• No Cross-Border Transfers: Your data NEVER leaves Canadian jurisdiction

5.2 Security Measures

• Encryption in Transit: TLS 1.3 encryption for all data transmission
• Encryption at Rest: AES-256 encryption for all stored data
• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA) required for all staff
• Network Security: Firewalls, intrusion detection systems, DDoS protection
• Regular Audits: SOC 2 Type II audits annually, penetration testing quarterly
• Incident Response: 24/7 security monitoring, documented breach notification procedures

5.3 Data Retention

• Call Recordings: 90 days, then automatically deleted
• Call Transcripts: 2 years for quality assurance and legal compliance
• Account Information: Duration of service + 7 years for tax/legal requirements
• System Logs: 12 months for security and debugging
• Deleted Account Data: Anonymized within 30 days, fully purged within 90 days

6. Data Sharing & Disclosure

6.1 We DO NOT Sell Your Data

Pingally does not sell, rent, or trade personal information to third parties for marketing purposes. Period.

6.2 Third-Party Service Providers

We share data with trusted service providers who help us operate our business. All providers are contractually bound to protect your data:

• OpenAI: AI model provider for natural language processing (data sent to Canadian API endpoints when available)
• ElevenLabs: Voice synthesis for AI receptionist speech
• Twilio/Telnyx: Phone service providers for call routing
• Stripe: Payment processing (PCI DSS compliant)
• AWS: Cloud infrastructure (Canada Central region only)
• Google Workspace: Calendar integration for appointment booking
• Postmark: Transactional email delivery

6.3 Legal Obligations

We may disclose information when required by law:

• Compliance with Canadian court orders or subpoenas
• Cooperation with law enforcement investigations
• Protection of Pingally's legal rights
• Prevention of fraud or illegal activity

6.4 Business Transfers

If Pingally is acquired, merged, or sells assets, customer data may be transferred. We will notify you and ensure the new owner honors this Privacy Policy.

7. Your Privacy Rights

7.1 PIPEDA Rights (All Canadians)

Under PIPEDA, you have the right to:

• Access: Request a copy of all personal information we hold about you
• Correction: Request corrections to inaccurate or incomplete information
• Withdrawal of Consent: Withdraw consent for marketing communications (service-related emails cannot be opted out)
• Complaint: File a complaint with the Privacy Commissioner of Canada if you believe your rights have been violated

7.2 PHIPA Rights (Ontario Healthcare Customers)

For healthcare providers subject to PHIPA, end users (patients) have additional rights:

• Access to PHI: Patients can request call transcripts containing their health information
• Correction of PHI: Patients can request corrections to recorded health information
• Restriction of Use: Patients can request limitations on how their PHI is used

7.3 How to Exercise Your Rights

To exercise any privacy rights, contact us at:

• Email: privacy@pingally.com
• Mail: Pingally Inc., Privacy Officer, [Office Address], Ontario, Canada
• Response Time: We will respond within 30 days of receiving your request

8. Children's Privacy

Pingally's services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Pingally operates exclusively within Canada and does not transfer data outside Canadian borders. If you are accessing our services from outside Canada, please note that your data will be processed in Canada under Canadian privacy laws.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify business customers of material changes via email and update the "Last Updated" date at the top of this policy.

Continued use of Pingally's services after policy updates constitutes acceptance of the revised policy.

11. Contact Us

For privacy questions, concerns, or to exercise your privacy rights, contact us:

• Privacy Officer: privacy@pingally.com
• General Inquiries: support@pingally.com
• Phone: 1-800-PINGALLY
• Mail: Pingally Inc., [Office Address], Ontario, Canada

12. Regulatory Authorities

If you believe Pingally has violated your privacy rights, you may file a complaint with:

• Privacy Commissioner of Canada: 1-800-282-1376 | www.priv.gc.ca
• Information and Privacy Commissioner of Ontario (PHIPA complaints): 1-800-387-0073 | www.ipc.on.ca