Privacy Policy
Effective date: October 26, 2026
Draft for review. This document is a starting template and is not legal advice. Have it reviewed by a qualified attorney before publishing.
This Privacy Policy explains how [Company Legal Name] ("we," "us," or "our") collects, uses, shares, and protects information in connection with Your Brand, our hosted business phone service, website at https://example.com, customer portal, and applications (the "Service").
The Service is sold to businesses ("Customers"). Individuals who use the Service through a Customer account, such as employees, are "End Users." People who call or are called by End Users are "Callers."
1. Information We Collect
1.1 Account information. Business name, contact names, email addresses, phone numbers, service address, user names, roles, and portal login credentials (passwords are stored in hashed form).
1.2 Billing information. Billing name and address, plan and add-on selections, invoices, and payment history. Payment card and bank details are collected and stored by our payment processor, Stripe. We receive limited information from Stripe, such as card type, last four digits, expiration date, and payment status. We do not store full card numbers.
1.3 Emergency address information. The registered 911 address (dispatchable location) you provide for each phone number or device.
1.4 Call detail records (CDRs). Information about calls, such as originating and destination numbers, date, time, duration, call direction, routing path, extension, caller ID information, and call result. CDRs do not include the content of calls.
1.5 Communications content. Voicemail messages, voicemail transcriptions if enabled, call recordings on plans where recording is enabled by the Customer, custom greetings, and IVR prompts.
1.6 Device and connection data. Device type, model, MAC address, firmware version, IP address, registration status, SIP user agent, app version, and network quality metrics.
1.7 Usage and log data. Portal activity, configuration changes, login history, feature usage, error logs, and security logs.
1.8 Support communications. Emails, chat messages, phone calls, and tickets you send to our support team, including any information you choose to include.
1.9 Website data. Information collected through cookies and similar technologies when you visit our website, such as browser type, pages viewed, and referring site. [Describe specific analytics or advertising tools used, if any.]
1.10 Number porting information. Information needed to port numbers, such as account numbers and authorized names with the losing carrier, and letters of authorization.
2. How We Use Information
We use information to:
- Provide, operate, and maintain the Service, including routing calls, delivering voicemail and voicemail to email, and provisioning devices and phone numbers.
- Route 911 calls and transmit your registered location to emergency services.
- Process payments, issue invoices, calculate taxes and regulatory fees, and manage subscriptions.
- Provide customer support and respond to requests.
- Monitor, detect, and prevent fraud, toll fraud, abuse, robocalling, and security incidents.
- Comply with legal obligations, including call authentication, traceback, law enforcement, and regulatory reporting requirements.
- Maintain and improve the Service, including troubleshooting call quality.
- Send service notices, such as billing alerts, suspension notices, security alerts, and policy changes.
- Send marketing communications to business contacts where permitted, with the ability to opt out.
We do not use the content of calls, voicemails, or recordings for advertising.
3. Customer Proprietary Network Information (CPNI)
3.1 What CPNI is. Under 47 U.S.C. § 222 and FCC rules, CPNI is information about the quantity, technical configuration, type, destination, location, and amount of use of telecommunications services a customer subscribes to, made available to us solely because of the customer relationship. Examples include call detail records, services subscribed to, and related billing information. CPNI does not include your name, address, and phone number listed in directories.
3.2 Our commitment. We do not sell CPNI. We protect CPNI and use it as permitted by law, including to provide and bill for the Service, to protect against fraud and unlawful use, to provide technical support, and to comply with law.
3.3 Access controls. We authenticate Customers before disclosing CPNI. For example, we disclose call detail information over the phone only after appropriate authentication, or by sending it to the account's address or email of record, or through the password protected portal. We may notify you when account credentials or the address of record change.
3.4 Restricting use. Where the law requires your approval to use CPNI for marketing services outside the categories you already purchase, we will ask for it. You may restrict or withdraw any such approval at any time by contacting support@example.com or +1 (555) 010-0000. Restricting use does not affect the Service you receive.
3.5 Breaches. If a CPNI breach occurs, we will notify law enforcement and affected Customers as required by FCC rules.
4. How We Share Information
We share information only as described below:
- Upstream carriers and telecom partners. To route and terminate calls, provision and port phone numbers, deliver caller ID and CNAM, support call authentication, and route 911 calls with your registered location.
- Payment processor. Stripe processes payments and stores payment details under its own privacy terms.
- Hosting and infrastructure providers. Cloud hosting, storage, email delivery, transcription, and similar providers that process data on our behalf under contractual confidentiality and security obligations.
- Emergency services. Your registered location and callback number are provided to public safety answering points when a 911 call is made.
- Legal requirements and law enforcement. We may disclose information when required by law, such as in response to a valid subpoena, court order, warrant, or other legal process, and as permitted under laws such as the Communications Assistance for Law Enforcement Act. We review requests and disclose only what the law requires or permits.
- Traceback and anti-fraud. We may share call information with industry traceback groups, carriers, and regulators to investigate illegal robocalls, spoofing, and fraud, as permitted by law.
- Protection of rights. To protect the safety, rights, or property of our customers, the public, or us, as permitted by law.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
- With your direction. When you ask us to, such as when porting numbers to another provider.
We do not sell personal information, and we do not share personal information for cross context behavioral advertising. [Confirm with counsel and update if website tracking tools are used.]
5. Data Retention
We keep information only as long as needed for the purposes described in this Policy, to comply with law, to resolve disputes, and to enforce agreements. Retention periods by category:
| Category | Retention |
|---|---|
| Account information | Life of the account plus [X days] |
| Billing records and invoices | [X years] or as required by tax and accounting law |
| Call detail records | [X days], or longer where required by law |
| Voicemail messages | Until deleted by the Customer or End User, or [X days] after account closure |
| Call recordings | Per Customer configured retention settings, or [X days] after account closure |
| Device and connection logs | [X days] |
| Security and audit logs | [X days] |
| Support communications | [X days] after ticket closure |
| 911 registered location history | [X days] |
After the retention period, we delete or de-identify information. Backups are overwritten on a rolling basis within [X days].
6. Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit where supported, access controls, hashed passwords, logging, and monitoring for fraud. Customers can strengthen security by using strong passwords, restricting calling destinations, and protecting device credentials.
No system is completely secure. If we learn of a security incident affecting your information, we will notify you as required by law.
7. Customer as Controller and Our Role as Processor
7.1 For information about End Users and Callers that Customers submit or generate through the Service, such as voicemails, recordings, contact lists, and extension user details, the Customer generally decides why and how the information is processed. In those cases the Customer acts as the controller (or "business" under some state laws), and we act as a processor (or "service provider") on the Customer's behalf.
7.2 Customers are responsible for providing any required notices to and obtaining any required consents from End Users and Callers, including for call recording.
7.3 For information we use for our own purposes, such as account management, billing, CPNI compliance, fraud prevention, and legal compliance, we act as a controller.
7.4 If you are an End User or Caller and want to exercise rights over information a Customer controls, contact that Customer. We will assist Customers in responding as required by law. [A Data Processing Addendum is available on request.]
8. International Transfers
The Service is operated in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other locations where our providers operate. Data protection laws in those locations may differ from those where you live. Where required, we use appropriate safeguards for transfers.
9. Your Rights
9.1 Depending on where you live, you may have rights to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete information, subject to legal exceptions.
- Receive a copy of information in a portable format.
- Opt out of certain processing, such as marketing emails.
9.2 Several US states have comprehensive privacy laws, such as the California Consumer Privacy Act as amended (CCPA). Some of these laws provide limited rights or exemptions for business contact information and business to business data. We will honor rights that apply to you under applicable law.
9.3 To make a request, contact support@example.com or +1 (555) 010-0000. We will verify your identity before responding. You may use an authorized agent where permitted by law. We will not discriminate against you for exercising your rights.
9.4 Customers can access, export, and delete much of their account data, voicemails, and recordings directly in the customer portal.
9.5 Some information must be retained to comply with law, such as billing records, CPNI records, or information subject to a legal hold.
10. Children
The Service is intended for businesses and is not directed to children under 13 (or a higher age where required by law). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. For material changes, we will notify Customers by email or in the customer portal before the change takes effect.
12. Contact
[Company Legal Name] [Street address, City, State ZIP] Email: support@example.com Phone: +1 (555) 010-0000 Website: https://example.com