Privacy Policy

Last updated: 2026-06-05 · Plain English version (the binding version is below).

1. Who we are

Call Copilot is operated by Oasis Techno Cloud ("we", "us"). The product is a real-time AI co-pilot for important conversations: it transcribes your call audio, generates real-time suggestions, and remembers context about your clients across calls.

2. What data we collect

We collect three categories of data, all of which you can see, export, and delete at any time.

2.1 Account data

• Email address (used to log you in and send important account emails)
• A bcrypt hash of your password (we never see your actual password)
• Your plan, trial status, and billing reference (if you subscribe)
• Account creation date

2.2 Call data (the actual product)

• Audio recordings of your calls (your microphone + system audio, when you start a recording — never automatically). Stored as WebM/Opus on our server.
• Transcripts of those calls, generated by the transcription provider you choose.
• Client memory — structured facts about the people/companies you talk to, automatically extracted from your call transcripts.
• Your private notes, playbooks, and prompts — what you type into the app.

2.3 Operational data

• Authentication tokens (JWT) stored in your browser/desktop client
• Per-month transcription minutes (so we can enforce the Free plan's 30 min/month limit)
• Standard server access logs (IP address, request path, status code, timestamp) — retained 30 days for security purposes

2.4 What we do NOT collect

• ❌ No third-party analytics (no Google Analytics, PostHog, Mixpanel, Segment, Amplitude, Fathom)
• ❌ No session replay (no FullStory, LogRocket, Hotjar)
• ❌ No error tracking with PII (no Sentry on the renderer)
• ❌ No advertising IDs
• ❌ No tracking pixels
• ❌ No fingerprinting

3. How we use your data

Strictly to deliver the product:

• Audio & transcripts → sent to your chosen transcription provider to convert speech into text. Then stored so you can review past calls.
• Transcripts → sent to your chosen LLM provider to generate real-time coaching suggestions and to build client memory.
• Client memory → loaded into the LLM context on subsequent calls to give better suggestions about the same person/company.
• Account email → to send you account-related emails (welcome, trial ending, password reset, billing receipts). We do not send marketing emails unless you opt in.

We do not use your call data to train our own models. We do not sell, rent, or share your call data with third parties for advertising or any purpose other than delivering the product.

4. Subprocessors

When you use the hosted version of Call Copilot, the following subprocessors may receive your data:

• DigitalOcean — server infrastructure (audio + transcript storage at rest)
• Groq, OpenAI, Mistral, or others (depending on your settings) — transcription and LLM inference. Your audio chunks and transcript text pass through these providers in real time. Each provider's policy governs what they do with the data:
  • Groq: groq.com/privacy-policy
  • OpenAI API: openai.com/policies/api-data-usage-policies (API data not used for training as of this writing)
  • Mistral: mistral.ai/terms
• Stripe — payment processing (we never see your card number; Stripe is PCI Level 1)
• SMTP provider (configured per deployment) — transactional emails
• Cloudflare — DNS and TLS

If you self-host (Team Self-Hosted plan), none of these except your chosen LLM/STT provider receive your data. You decide where audio is stored.

5. Retention & deletion

• Your call audio, transcripts, and memory are kept until you delete them or close your account.
• If you close your account, we delete your account data and call data within 30 days.
• You can export all your data anytime from Settings → Export.
• Backups are retained for 14 days, after which deletion propagates.
• Server access logs are retained for 30 days for security investigation.

6. Your rights

Depending on where you live, you have rights under GDPR (EEA, UK), CCPA / CPRA (California), LGPD (Brazil), and similar laws. These include:

• Right to access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your data
• Right to data portability — receive your data in machine-readable form
• Right to object / restrict processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

To exercise any of these, email hakimnmo@gmail.com. We respond within 30 days. No fee for reasonable requests.

7. Security

• TLS 1.2+ for all data in transit (Let's Encrypt managed)
• Passwords stored as bcrypt hashes (cost 10)
• JWT signed with HMAC-SHA256; tokens expire after 30 days
• Server runs as non-privileged user, hardened systemd unit
• No tracking SDKs in the client to be exploited for XSS data exfiltration
• Audio files stored with restricted filesystem permissions
• Stripe webhook signatures verified before any state change

We don't claim SOC 2 yet. We're a small team. If your organization requires SOC 2, contact us about the Self-Hosted plan.

8. Cookies & trackers

We use exactly one piece of client-side storage: a JWT token in your browser's localStorage, used to keep you logged in. No analytics cookies. No advertising cookies. No third-party cookies. The landing page sets no cookies at all.

9. Children's privacy

Call Copilot is not intended for users under 16. We don't knowingly collect data from children. If you believe a child has signed up, email us and we'll delete the account.

10. Changes to this policy

If we materially change how we handle your data, we'll email you and post a notice here at least 30 days before the change takes effect.

11. Contact

Data controller: Oasis Techno Cloud, attn: Hakim
Email: hakimnmo@gmail.com

For EEA/UK GDPR queries, the same address is the controller and there is no separate EU representative at this time.