Privacy policy

This policy explains what personal data AhoyDesk handles, why, who else handles it, how long we keep it, and what you can ask us to do. Questions and requests go to hello@ahoydesk.com.

Two roles

• For agencies and our own visitors we decide what happens to the data. This covers agency accounts, billing, our website, our contact inbox, and businesses that leave their details on our pages.
• For the callers and chat visitors of our agencies’ clients we act for the agency. We handle that data only to run the receptionist the agency set up. The agency, and the business it serves, decide what it is for. If you called or chatted with a business that uses AhoyDesk, that business is your first contact; we will help it answer you.

What we collect

• Agency accounts: names, email addresses, a password (stored only as a one-way hash), brand settings, team members, and sign-in sessions.
• Billing: the plans and credit you bought, the amounts, dates and payment references from OxaPay. We never see card or bank details.
• Client businesses: the public website we read to build each receptionist, and the details the agency adds (hours, services, areas, contacts for alerts).
• Callers and chat visitors:
  • the caller’s phone number;
  • the call recording and the written transcript;
  • chat messages;
  • what the receptionist noted for the business: name, phone, address, the problem and how urgent it is.
• Businesses on our own pages (for example /plumbing-answering-service): the name, email, mobile number and ZIP code you type, and your consent to be contacted by a partner agency.
• Our website: we count visits with self-hosted analytics that set no cookies and don’t follow you to other sites. The dashboard reports its own errors to us so we can fix them. Each report holds the error, the page address and the browser type.
• Emails you send us, including through the contact form.

Who else handles it

Company	What for	Where
Hetzner	Our servers and database	Finland (EU)
Vapi	Phone calls and web calls: speech recognition, the receptionist’s voice, call recordings, phone numbers. It uses its own speech and voice providers for this	United States
OpenAI	The language model that writes the receptionist’s replies and reads client websites. Under OpenAI’s API terms, this data isn’t used to train its models	United States
Twilio	Phone numbers, for agencies that connect their own Twilio account	United States
Bird	Sending email	—
Cloudflare	DNS, receiving email, and storing our nightly backups	Worldwide
OxaPay	USDT payments	—

When an agency runs on its own OpenAI, Vapi or Twilio accounts, those companies handle the data under the agency’s agreement with them.

We don’t sell personal data, and we don’t use callers’ data for advertising or to train AI models.

How long we keep it

• Calls, chats, transcripts and the leads the receptionist took: 24 months, then deleted automatically.
• Demos: a demo’s calls and chats are deleted 30 days after the demo expires or is deleted.
• Call recordings are stored by Vapi. We drop our link to them with the conversation after 24 months, and we will delete a specific recording at Vapi on request.
• Contact messages, and business details left on our pages: 24 months.
• Dashboard error reports: 90 days.
• Agency accounts: while the account is open. After you ask us to close it, we delete it within 30 days.
• Billing records: as long as tax and accounting rules require.
• Backups: we take one every night and keep it for 14 days, so deleted data leaves the backups within 14 days.

Your choices and rights

Wherever you live, you can ask us to:

• show you the personal data we hold about you;
• correct it;
• delete it;
• send it to you in a common format.

You can also object to how we use it. Email hello@ahoydesk.com from the address we know, or tell us the phone number you called from. We answer within 30 days. If the data belongs to an agency’s client, we pass your request to them and help them answer it. If you think we got something wrong, you can complain to your local data protection authority.

Security

• All connections are encrypted (HTTPS).
• Passwords are stored as one-way hashes.
• Agencies’ provider keys are encrypted at rest.
• Only the people who run AhoyDesk can reach the servers.
• If a breach affects your data, we tell you without undue delay.

Children

AhoyDesk is for businesses. We don’t knowingly collect data from children under 16.

Changes

If this policy changes in a way that matters, we update the date above and email agencies before the change applies.