Privacy policy

1. Two kinds of information

Account information is about the people who use Ringin: a customer company’s administrators, supervisors and agents. We are responsible for it.

Customer data is what a customer company puts into Ringin about the people it calls, such as its leads and their calls, including calls its AI agents make. We handle it on that company’s behalf and only to provide Ringin to them. The company decides why and how its contacts are called, and is responsible for having a lawful basis and any consent needed to do so. If Ringin was used to call you, please contact that company first; we will help them answer your request.

2. What we collect

• Account details: name, email address, role, a securely hashed password, and when you last signed in.
• Sign-up details: your company’s name and website, what it will use Ringin for, its team size and phone setup, and any message you add, so we can review the company before it may call. We email a code to confirm the address. To give each business one free trial, the browser you sign up from keeps a private random number, and we keep only a scrambled (hashed) form of it and of your network address, never the number or the address themselves; a sign-up from the same browser as an earlier one may be offered a paid plan instead of a second free trial.
• Company details: company name, plan, free trial and packages, minutes used, payment records (card payments are handled by Stripe; we do not store card numbers), the phone accounts the company connects (such as RingCentral or Twilio) and their credentials, and the phone numbers it uses, whether its own or obtained through Ringin.
• Lead details a customer imports, enters, or sends from its own systems (such as its website forms, through Ringin’s API or webhooks): names, phone numbers, email and postal addresses, state or region, time zones, the consent the lead gave, and any extra columns from an imported file.
• Consent records: each consent a lead gave, as it arrived (its type, date, source, proof, the IP address it came from when sent, and what sent it). When a company confirms that every lead of a campaign gave a certain consent, we record that confirmation, who made it and when. Ringin may visit a consent’s source page to check it, and keeps the page’s address, title and a fingerprint of its content.
• Call details: numbers called, times, call status and duration, call outcomes, notes, scheduled callbacks, appointments, do-not-call entries, and incoming calls to the company’s numbers.
• Call recordings, when a customer turns call recording on for its agents’ calls: the audio its phone provider recorded.
• AI agent calls, when a customer uses AI agents to call or to answer its calls: the call’s recording and transcript, a summary and sentiment written after the call, and what the agent recorded, such as the outcome, a requested callback time, an appointment, notes, or a message a caller left (their name, the number to call back and why). Also the scripts companies write for their agents, which we review before an agent may call.
• Free trial test calls: the phone numbers a company’s administrator adds to try Ringin, and whether each was confirmed with a code (we keep only a scrambled form of the code, never the code itself), and the test calls, recorded and transcribed like AI agent calls. When a trial user calls Ringin’s demo number from a confirmed phone, we keep that call like any test call; a call from any other number is answered with a short message and not kept, beyond a count of such calls.
• Questions typed to the assistant in Ringin’s Help or on our website. A conversation is kept for an hour at most so it can continue, and its messages are not logged.
• Voicemail detection, when a customer turns it on for a campaign: the first seconds of each answered call are converted to text to recognise a voicemail greeting. We do not store that audio or text.
• Live compliance monitoring, when it is on for a company’s browser calls: what the person called says is converted to text as the call happens, to recognise a request not to be called again or a complaint. We do not keep the transcript; a phrase that triggered a detection is kept with that compliance record and erased after a set period (90 days unless Ringin sets otherwise).
• Compliance records: each check made before a call and its result, do-not-call lists, and the risk score each company’s calling activity is given.
• National do-not-call registries: the phone numbers on a country’s registry, as downloaded from the registry to check calls against it.
• Security records: an audit log of actions taken in Ringin, including the IP address and browser used.
• Messages you send us, for example by email, phone or WhatsApp, and the emails and notifications Ringin sends you.

3. How we use it

We do not sell personal information, we do not use customer data for advertising, and we do not use customer data or call content to train AI models.

• To provide Ringin: dialing, AI agent calls, campaigns, callbacks, call history, recordings, summaries and reports.
• To check every call against the law and the rules that apply to it before it is placed: consent, do-not-call lists and registries, calling hours and call limits where the person called is.
• To keep proof of consent, and to check the source pages consents name.
• To review new companies before they may call, and to run free trials and test calls, one free trial per business.
• To keep accounts and data secure, and to detect and stop misuse.
• To count usage, bill plans and packages, and meet our legal obligations.
• To support customers and answer questions.

4. Automated decisions

Before each call, Ringin’s compliance checks decide automatically whether it may be placed now, later, or not at all, and a risk score based on a company’s calling activity can limit or pause its calling. These decisions protect the people being called. Ringin’s AI also checks each AI agent script when it is submitted: a script it passes may be approved at once, and one it flags waits for a person at Ringin. A company that believes a decision is wrong can contact us and a person will review it.

5. Calls from AI agents

An AI agent tells the person it calls, or whose call it answers, at the start, that it is an AI assistant and that the call may be recorded, and it says so truthfully whenever asked. It never asks for payment card numbers, bank details, passwords or social security numbers. It may take a message, book an appointment or pass the call to a person at the company. If the person asks not to be called again, their number is added to the company’s do-not-call list during the call.

6. Google Calendar and Outlook

A company administrator can connect the company’s Google Calendar or Outlook calendar, so appointments booked in Ringin never clash with the team’s schedule and appear in that calendar. Ringin asks only for what this needs: the account’s email address, the list of its calendars, the times of events on the calendar a campaign follows, and permission to create, change and delete the events for appointments booked in Ringin.

Ringin uses this data only to show free times and to keep those appointment events in step. To know when the calendar is busy it reads only the times of other events, never their titles, descriptions or guests, and it changes only the events it created. It does not sell this data, share it with anyone except as needed to run this feature, use it for advertising, or use it to train AI models. People at Ringin do not read it, except with the company’s agreement to investigate a problem, for security, or when the law requires it.

Sign-in tokens are encrypted before they are stored. An administrator can disconnect a calendar at any time in Settings, which deletes its stored tokens and withdraws Ringin’s access; access can also be removed from the Google or Microsoft account itself.

What Ringin stores from a connected Google or Microsoft account: the account’s email address, its sign-in tokens (encrypted), which of its calendars each campaign follows, and the identifier of each appointment event Ringin created there. Busy times are read when free times are needed and are not stored. Disconnecting deletes the email address and tokens at once; the event identifiers stay with the appointments they belong to until the company deletes them or its account. A record that the calendar was connected or disconnected, with the account’s email address, stays in the company’s audit log.

When a campaign books appointments through an AI agent, the agent is given only the free start times worked out from the calendar, so it can offer them to the person on the call; it never receives the calendar’s events, titles, descriptions or guests. The AI providers that run the agent receive those free times only to run that call.

Ringin does not use data obtained through Google Workspace APIs, including Google Calendar, to develop, improve or train generalized AI or machine-learning models, and does not keep it for that purpose. Data from Google is not sold, not shared with anyone else except as described above, and not used for advertising. Only our hosting provider stores it, on our servers, encrypted where noted above. People at Ringin do not read it, except with the company’s agreement to investigate a problem, for security, or when the law requires it.

Ringin’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. HubSpot and Pipedrive

Where Ringin offers it, a company administrator can connect the company’s HubSpot or Pipedrive account, so its contact lists feed campaigns and its calls and appointments are recorded on the contacts. Ringin asks only for what this needs: to read contacts, their fields and the company’s lists (HubSpot lists, Pipedrive filters), and to create contacts and log calls and meetings on them.

Ringin reads a contact’s name, phone number, email and address, and the one field the company chooses to mark “do not call”; contacts in a list the company picks are added to that campaign, and a contact marked “do not call” goes on the company’s do-not-call list. Ringin writes to the CRM only the calls and appointments it handled, with their outcome, notes and summary and a link back to Ringin, and it creates a contact only for someone who called the company or booked an appointment. It does not change or delete anything else there.

What Ringin stores from a connected CRM: the account’s name and identifier, its sign-in tokens (encrypted), which lists feed which campaigns, and which CRM contact each Ringin contact is. Contacts brought in become the company’s contacts in Ringin, like contacts it imports. Disconnecting deletes the tokens, the list choices and the contact links at once and withdraws Ringin’s access, which can also be removed from the CRM itself. A record that the CRM was connected or disconnected stays in the company’s audit log.

CRM data is not sold, not shared with anyone else, not used for advertising, and not used to train AI models. People at Ringin do not read it, except with the company’s agreement to investigate a problem, for security, or when the law requires it.

8. Who we share it with

• The phone providers that carry calls: RingCentral or Twilio, through the account a company connects, and Twilio for numbers obtained through Ringin, for connecting AI agent calls, and for Ringin’s demo number and free test calls. Their own privacy policies apply to their services.
• Our AI voice service providers, only for AI agent calls and test calls: they carry the conversation, convert speech to text and text to speech, and run the language models that let the agent talk, and they produce the recording, transcript and summary. Some calls run on Ringin’s own voice engine, which uses such providers for speech and language. A current list of these providers is available on request.
• The AI model providers behind the Help assistant, AI setup and Ringin’s script checks (currently Google and OpenAI). They receive the question or the script, not a company’s leads. Questions typed on our public website may be used by the provider under its own terms, so please do not type personal information there.
• Stripe, which processes card payments under its own privacy policy.
• Google reCAPTCHA, where the sign-up page uses it to tell people from automated sign-ups. Google’s Privacy Policy and Terms of Service apply.
• Deepgram, which converts speech to text for voicemail detection and live compliance monitoring. Deepgram is asked not to use the audio to improve its services.
• Our email delivery provider, which sends account emails and notifications.
• Google and Microsoft, only when a company connects its calendar: Ringin reads busy times from it and writes the company’s appointment events to it.
• Hostinger, which hosts our servers and stores the data.
• WhatsApp (Meta), when you choose to contact us there.
• Authorities, when the law requires it.
• A buyer or successor, if our business is sold or merged, under the same protections.

9. Cookies and browser storage

Ringin does not use advertising or analytics cookies. The browser stores your sign-in session, a few display choices such as your light or dark theme, and a private random number used only to give each business one free trial, so the app works for you. Where the sign-up page uses Google reCAPTCHA, Google may set its own cookies there.

10. How we protect it

No system is completely secure, but we work to protect your information and fix problems quickly.

• Each company’s data is kept separate, and every request is limited to the signed-in user’s own company.
• Passwords are hashed, and phone account credentials and provider keys are encrypted before they are stored.
• Every action is checked on the server against the user’s role, and changes are recorded in an audit log.
• Recordings play only through short-lived links, and each play and download is logged.
• Messages from phone and AI providers are verified before Ringin acts on them.

11. How long we keep it

Account and company information is kept while the company uses Ringin. Call recordings of agents’ calls are deleted automatically after the number of days the company chooses. AI agent call recordings, transcripts and summaries, like other customer data, are kept until the company deletes them or asks us to. Phrases kept as compliance evidence are erased after the retention period. A national registry list is replaced each time a newer one is imported.

Consent records are kept as proof of consent: nobody can change them, and they stay when the lead they belong to is deleted. Free trial phones and test calls are kept with the company’s account. Help assistant conversations are kept for an hour at most.

Our AI voice service providers keep AI call data for as long as their settings allow; we can limit what they keep after each call.

12. Your choices and rights

Depending on where you live, you may have the right to see, correct, or delete your personal information, or to object to how it is used. Account users can ask their company administrator or contact us. For customer data, including AI agent calls, contact the company that holds it, or contact us and we will pass your request on and help the company delete what it holds about you; records kept as proof, such as of consent or of a request not to be called, stay. To stop being called, tell the caller, or the AI agent, that you do not want to be called again.

13. Children

Ringin is a business service and is not meant for anyone under 18.

14. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell customers about important changes before they take effect.

15. Contact us

Questions or requests about privacy:

• Phone: +1 (672) 702-3936
• WhatsApp: +1 (672) 702-3936
• Email: support@ringin.org