Privacy Policy

Last updated: 28 July 2026

Callzy ("Callzy", "we", "us") provides missed-call text-back, message replies and appointment booking for local service businesses. This policy explains what personal data we handle, why, and your rights. Callzy is operated from the United Kingdom. Contact: theo@trycallzy.com.

Who we are handling data for

Callzy handles data in two roles:

• As a controller — for data about the business owners who sign up to Callzy (account details, billing, usage).
• As a processor — for data about a business's customers (callers, texters, web-chat visitors). The business you contacted is the controller of that data; we process it on their instructions to reply to enquiries and make bookings.

What we collect

• Business account data: business name, contact name, email, phone number, service and pricing details you configure, and payment details (handled by Stripe — we never see full card numbers).
• Customer conversation data: phone numbers, names given in conversation, message content, and booking details (service, date, time) — the minimum needed to reply and book.
• Calendar data: with the business's explicit Google consent, free/busy availability and the ability to create booking events. We request only the minimum Google Calendar scopes (create events, read free/busy). We do not read the content of unrelated calendar events.
• Website analytics: first-party, minimal funnel events (page visited, referrer) with a random anonymous identifier. No third-party ad trackers.

How we use it

• To reply to missed calls, texts, DMs and web chats on a business's behalf, and to book appointments into their calendar.
• To send appointment reminders and, where a business has confirmed a lawful basis, re-booking invitations to that business's own past customers. Every such message includes a way to opt out; replying STOP stops all further messages permanently.
• To show the business a record of real activity (bookings made, enquiries answered).
• To bill subscriptions, provide support, and keep the service secure (rate limits, spend caps, abuse prevention).

Lawful bases (UK GDPR)

• Contract — providing the service a business signed up for.
• Legitimate interests — replying to a customer's own enquiry; service security.
• Consent / soft opt-in (PECR) — reminder and re-booking texts to a business's existing customers, always with a working opt-out.

Google user data

Callzy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to check availability and create bookings for the connected business. It is never sold, never used for advertising, and never used to train AI models. Google refresh tokens are encrypted at rest (AES-256-GCM). You can revoke Callzy's access at any time at myaccount.google.com/permissions.

Who we share data with

Only service providers needed to run Callzy, under their own security terms: Stripe (payments), Twilio (phone/SMS), Google (calendar, with your consent), Anthropic (AI replies — conversation text only, not used to train their models per our API terms), Supabase (database hosting), Render (application hosting) and Resend (transactional email). We never sell personal data.

Retention

Business account data is kept while the account is active and deleted or anonymised within 90 days of closure (billing records kept as legally required). Conversation and booking data is kept while the related business account is active, so owners can see their history, and deleted with the account. Opt-out (STOP) records are kept permanently — deleting them would risk messaging someone who opted out.

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing — email theo@trycallzy.com and we'll respond within one month. If you're a customer of a business that uses Callzy, we may refer your request to that business (the controller of your data). You can also complain to the ICO at ico.org.uk.

Security

Data is encrypted in transit (TLS) and sensitive tokens are encrypted at rest. Access is restricted, webhooks are signature-verified, and messaging is rate-limited and spend-capped.

Changes

We'll post any changes to this page and update the date above. Material changes will be notified to account holders by email.