Privacy Policy

This policy applies to servicesetpoint.com, the Service Setpoint application at app.servicesetpoint.com, and the voice and messaging agents we operate for our customers.

Three different groups of people appear in this policy:

• Customers — the businesses that buy Service Setpoint and configure agents.
• Visitors — anyone browsing this website or requesting a demo.
• Callers — the people who ring or text a customer’s business and reach one of our agents. Most likely you are here because of this.

We handle personal information in two distinct capacities, and the difference determines who you should contact about it.

As a business in our own right

For our own website, demo requests, customer accounts and billing, we decide what is collected and why. Under laws that use the term, we are the controller or business. This policy governs that information and you can exercise your rights with us directly.

On behalf of our customers

When an agent answers a call for a roofing company, the information in that conversation belongs to the roofing company. They decide whether the agent runs, whether calls are recorded, and what happens to the resulting records. We process it on their instructions. Under laws that use the term, we are the processor or service provider and they are the controller.

From customers

• Account details: name, business name, email address, phone number, password hash.
• Configuration you enter: price lists, service areas, business hours, knowledge base answers, agent settings and escalation numbers.
• Credentials and tokens for the systems you connect, such as your CRM or calendar, held only at the scopes those integrations require.
• Usage and billing records: call minutes, message counts, invoices, payment status.
• Technical logs: IP address, browser, timestamps and error traces.

From website visitors

• What you type into the demo form: name, business name, email, phone and anything you write in the notes field.
• Standard server logs. This site does not run third-party advertising trackers and does not set advertising cookies.

From callers, on behalf of our customers

• Your phone number, and caller ID name where the carrier provides it.
• Anything you say or write during the conversation — commonly your name, property address, the work you need and when you are available.
• Call metadata: time, duration, which number you dialled, whether you were transferred.
• Audio recordings and written transcripts, where the business you called has enabled recording.

Voice data deserves its own section because it is treated differently by law and because it is the most sensitive thing we handle.

Call audio and transcripts

When recording is enabled, call audio is captured by our telephony provider and stored against the conversation record. Every call is converted to text so it can be searched, summarised and reviewed. Both belong to the customer whose line you called.

Voice clones

Customers may create a synthetic copy of a voice for their agent to speak with. A voice model of this kind may qualify as a biometric identifier under laws including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and the Washington My Health My Data Act. We treat it as one.

• A clone can only be created by the person whose voice it is. Our providers require the enrolling speaker to verify their own voice, and we enforce the same rule — a colleague or a hired voice actor cannot be enrolled on their behalf, even with written permission.
• Each clone stores the name of the person who enrolled it and the timestamp at which they confirmed it.
• We do not create voice models from caller audio. Callers are never cloned, and call recordings are not used to build voice models.
• Deleting a voice removes it from every agent using it and revokes it at the provider.

We use information to:

• Answer, transcribe, route and act on calls and messages as our customers configure.
• Look up prices, availability and service areas so an agent can answer a caller accurately.
• Create bookings, leads and records in the systems our customers have connected.
• Show customers what happened on their calls: transcripts, outcomes, and the questions their agent could not answer.
• Provide support, investigate faults, and prevent abuse and fraud.
• Bill for usage and maintain financial records.
• Meet legal obligations, including carrier and telecommunications requirements.

Conversations are processed by automated speech recognition, large language models and speech synthesis in order to run the agent. That processing is what the product is.

• We do not sell conversation data, and we do not use one customer’s conversations to benefit another.
• We do not permit our AI providers to train their models on customer conversations. We use enterprise or zero-retention arrangements where the provider offers them.
• We use aggregated, de-identified operational metrics — latency, transfer rates, unanswered-question counts — to improve the service. These contain no conversation content and no personal information.
• A customer may choose to use their own conversations to improve their own agent. That is scoped to their account.

Agents produce speech automatically. They can be wrong, and our customers remain responsible for what their agent says. Where an agent quotes a price, it reads from data the customer supplied.

We rely on a small number of vendors to deliver the service. Each is bound by contract to process information only on our instructions and to protect it.

• Telephony and messaging. Telnyx carries our calls and messages and performs call recording and speech processing. Carriers involved in delivering a call necessarily see the numbers involved.
• Language models. Anthropic and OpenAI provide the models that understand and compose agent responses, under terms that prohibit training on our data.
• Speech synthesis and voice cloning. ElevenLabs generates agent speech and hosts customer-created voice models.
• Cloud hosting. Our application and database run on cloud infrastructure located in the United States.
• Payments. Our payment processor handles card details directly. We never see or store full card numbers.
• Systems you connect. When a customer connects a CRM or calendar, we send data to it as instructed. That system’s own privacy terms then apply.

A current list of sub-processors is available on request, and customers on a data processing agreement are notified before we add a new one.

Recording is off unless a customer switches it on. When it is on, an announcement plays at the start of the call before anything is recorded.

Some states require every party to a call to consent before it is recorded, rather than just one. Because a caller’s location is not reliably knowable, the announcement is designed to be played on every recorded call regardless of where the parties are.

Our customers decide whether to record, and are responsible for that decision being lawful where they and their callers are located. If you do not want to be recorded, say so — the agent will transfer you to a person, and you can ask that business to delete the recording.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding twelve months.

We disclose information only:

• To the customer whose business you contacted.
• To the service providers listed above, to run the service.
• To systems a customer has explicitly connected.
• Where required by law, subpoena or lawful request, or to protect rights, safety or property.
• To an acquirer in a merger or sale of assets, under terms that continue to protect it.

• Call recordings and transcripts: retained for as long as the customer keeps them, subject to a retention period they configure. Customers can delete individual conversations at any time.
• Lead and contact records: retained for the life of the customer’s account unless deleted sooner.
• Voice models: retained until deleted by the customer, then revoked at the provider.
• Account and billing records: retained while the account is active and afterwards as long as tax and accounting law requires.
• Demo requests: retained for up to twenty-four months, then deleted.
• Server logs: retained for up to ninety days.

When a customer closes their account we delete or return their data within thirty days, except where law requires us to keep it.

• Data is encrypted in transit. Stored data is encrypted at rest.
• Passwords are stored only as salted hashes and are never recoverable.
• API keys are stored as hashes; the full key is shown once at creation and never again.
• Access to production systems is limited to staff who need it and is logged.
• Integration tokens are held at the minimum scope the integration requires.

No system is perfectly secure. If a breach affects your information we will notify affected customers and, where required, regulators, within the timeframes the law sets.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to opt out of sale or targeted advertising (we do neither), and to appeal a refusal. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and a growing number of other states have some or all of these rights.

To exercise them for information we hold as a business in our own right, email [email protected]. We will verify your identity before acting, respond within forty-five days where the law sets that deadline, and will not discriminate against you for making a request.

For information we hold on behalf of a customer, we will refer your request to that business and assist them in responding.

If you are in the European Economic Area or the United Kingdom, our legal bases are contract performance, legitimate interests in operating and securing the service, and consent where required.

This section is for people who reached one of our agents rather than bought the product.

• Ask and it will tell you. Ask the agent directly whether it is an AI and it will say so, and offer to put you through to a person.
• You can always reach a human. Asking for one is enough.
• You can opt out. Say you do not want to be contacted again and the request is recorded and honoured. For text messages, reply STOP.
• Your record belongs to the business you contacted. Ask them to delete it, or email us and we will pass it on.

Service Setpoint is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under thirteen. If you believe a child’s information has reached us, contact us and we will delete it.

We update this policy when the product or the law changes. The date at the top always reflects the current version. Where a change materially affects how we handle personal information, we notify customers by email before it takes effect.

Privacy questions, requests and complaints: [email protected].

Customers who need a signed data processing agreement can request one at the same address.

See also our Terms of Service.