Privacy Policy

Optional Google Maps address suggestions

When address suggestions are configured, focusing the location field loads Google Maps and typing sends your search and technical connection information to Google. Select Use without Google before typing to disable suggestions. Manual text is accepted without selecting a result. We save the selected address only when you save your business profile. Google processes this feature under its privacy policy: https://policies.google.com/privacy.

1. Controller and scope

Gibbor Technologies LLC operates Gibbor Calls. We determine how account, security and billing information is used to administer our service. When a business uses Gibbor Calls to handle calls, contacts and appointments, we process that information on its behalf and according to its instructions. The business determines the purpose of those interactions and is responsible for its own notices and permissions. This policy applies to account users and people whose information is processed through the service. Contact hello@gibbortechnologies.com for privacy questions.

2. Information we process

Depending on each organization’s use and configuration, we process:

• Account, organization, role, session, and audit-log data.
• Contact and call data received from Retell, such as phone numbers, duration, transcript, summary, analysis, and recording links.
• Appointment data, such as name, email, phone number, time, time zone, and booking status.
• Billing records, such as Stripe customer, subscription, Checkout, invoice and payment-status identifiers, included-minute balance, call measurement, and metered overage events. Stripe processes payment credentials; Gibbor Calls does not store complete payment-card numbers.
• Technical and security data needed to authenticate requests, prevent abuse, and diagnose errors.

3. Google Calendar data

Connecting Google Calendar is optional and requires authorization through Google. We request calendar.events to create appointments and retrieve an existing app-generated event when retrying a booking, and calendar.events.freebusy to check busy intervals. These permissions do not give us access to Gmail or Google Drive.

Availability results, including busy start/end times, are sent to Retell and its AI processing providers to answer scheduling requests. Booking details supplied during a call, such as name, email, phone, title and requested times, are processed to create the appointment. Google may send invitations to the supplied attendee email. We do not intentionally retrieve unrelated event descriptions or attendee lists when checking availability.

We store the connected calendar identifier, event identifiers, appointment records and an encrypted refresh token for ongoing authorized access. Google-derived information can also appear in call transcripts, summaries and tool-response records.

We do not use, sell or transfer Google Workspace data, including raw, aggregated, anonymized or derived data, to create, train, retrain or improve foundational or generalized AI/ML models, or for advertising, commercial profiling or credit evaluation. We require AI providers processing this information on our behalf to exclude it from model training. Generating a response or summary for the requested service is inference, not permission to train models.

4. AI-assisted calls, recording, and consent

Gibbor Calls uses automated AI voice agents, not human receptionists. Depending on the business configuration, calls may be recorded, transcribed and summarized, and the business can review those records. AI outputs can contain mistakes. Do not provide passwords, full payment-card details or information unnecessary for your request.

The business must configure appropriate AI and recording disclosures and obtain the permissions required for the interaction. A greeting or continued participation does not by itself establish valid consent in every jurisdiction. If you object to recording, tell the agent, end the call and contact the business through a non-recorded channel. Do not assume recording can be paused during an active call.

Human access to Google-derived information is limited to cases permitted by Google Limited Use: documented explicit agreement to view specific information, qualifying aggregated and anonymized internal operations, necessary security investigations, or legal obligations. General quality review is not blanket authorization to read Google data. We do not use call content to train generalized AI models.

5. How we use information

We use information to provide and secure the service: authenticate users, organize calls and contacts, check availability, create requested appointments, show operational results, provide support, maintain audit records, and comply with applicable legal obligations.

6. Service providers and disclosure

We use Vercel for application hosting, database infrastructure for application records, Retell and telecommunications providers for voice processing, Google for Calendar and optional account sign-in, Stripe for payments, and browser push providers for optional notifications. Providers receive information relevant to their service function, subject to applicable processing terms.

Retell has identified Google Cloud / Vertex AI for model inference, Deepgram for speech recognition, Cartesia / ElevenLabs for voice generation, Microsoft Azure Speech for voice fallback, and AWS for storage in its written account-specific disclosures. Actual routing depends on the configured model, voice and fallback. These are Retell-managed subprocessors, not separate subscriptions purchased by each Gibbor Calls user. Retell has confirmed no-training protections for our Pay-As-You-Go account, including when call data is retained for 30 days.

We do not sell personal or Google data or share it with advertising networks or data brokers. Any disclosure for security, legal requirements or a business transfer remains subject to applicable law and Google Limited Use, including consent where required.

7. Security

We use encryption in transit, organization-level access controls, protected sessions, auditing, and cryptographic verification for integrations. Google refresh tokens are encrypted before storage. No system eliminates all risk, so we also limit operational access to personnel who need it for support, security, or compliance.

8. Retention, disconnection, and deletion

Retell-hosted recordings, transcripts and logs follow the retention configured for the agent. For agents configured with Everything and 30-day retention, Retell schedules deletion of those artifacts after that period. This does not mean every copy across the service is erased at exactly 30 days. Audio links can expire or become unavailable; recordings are not a permanent archive.

Gibbor Calls separately stores call transcripts, summaries, analysis, contact and appointment records, recording references and webhook payloads in its database. These copies are not automatically deleted by Retell’s retention setting. We retain them while needed for the business account and the service purposes described here, subject to deletion requests and applicable obligations. Billing, security and audit records may be retained separately for accounting, fraud prevention, disputes or legal requirements. Backup copies can remain until their separate rotation or deletion process completes.

An OWNER or ADMIN can disconnect Calendar in Settings. This removes the stored connection and refresh token from Gibbor Calls; it does not delete existing Google events or call records. You can also revoke Gibbor Calls access from the third-party connections section of your Google Account. Subscription cancellation, Calendar disconnection and deletion of stored data are separate actions.

To request access, correction, export or deletion, email hello@gibbortechnologies.com with the business account and relevant record/date. Do not send passwords, tokens or full payment details. We verify identity and authority, coordinate with the business when it controls the data, and explain any legally required exceptions. We respond within applicable legal deadlines.

9. Google API Services User Data Policy

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

10. Payments, fraud, and disputes

Stripe receives payment-method and billing information directly. We receive customer and transaction identifiers, amount, currency, tax, payment status, invoice, refund, dispute, and subscription information needed to provide access, maintain the minute ledger, prevent duplicate credit, investigate fraud, resolve chargebacks, and meet accounting and legal obligations. Stripe’s own privacy notice also applies to its independent processing.

11. International processing and minors

Our providers may process information in the United States and other countries where they operate, subject to their contractual and legal safeguards. Gibbor Calls is a business service intended for authorized users who are at least 18 years old and is not directed to children. Contact us if you believe a child provided account information.

12. Changes and contact

We will update this policy when our handling of information changes materially and request new consent when required. Contact: hello@gibbortechnologies.com.

13. Optional device notifications

If you enable notifications, we store your browser push endpoint, subscription keys, language and notification preferences linked to your account session. We send encrypted, generic call and appointment alerts through your browser’s push provider. Alerts do not include names, phone numbers or transcripts. You can disable notifications in Settings; signing out removes subscriptions for that session. Expired delivery records are removed by our notification worker. The installed app caches only a public offline screen and icon, not private account data.

14. Cookies and device storage

We use session cookies for authentication and security and a language preference to remember your selection. Signing out ends the session. The installed app uses browser storage for its public offline assets. Disabling necessary cookies can prevent sign-in. These functions are distinct from advertising tracking.

15. Rights and requests made on behalf of a business

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your information, withdraw consent, object to or restrict processing, appeal a request decision, or complain to a competent authority. These rights can be subject to exceptions. Contact us using the process in section 8. If your information came from a call to one of our customers, identify that business so we can route your request appropriately.

16. Customer-authorized support

The business owner can authorize one hour of technical support access, specify a reason, optionally allow agent draft edits, and revoke access in the app. A new grant replaces earlier active grants. Support operates under its own identity and session, not the customer’s login. This workspace permits agent-configuration review and connection-status diagnostics, not billing, payment actions, transcripts, recordings, contacts or Google Calendar event content. Only business owners and administrators can publish agent changes.

We record the grant, reason, authorizing user, assigned operator, expiry, revocation and support actions. Draft-edit audit entries identify changed fields, not their contents. Agent drafts and published configuration are stored separately to operate the service. Do not place passwords or private customer records in agent instructions or support reasons. Revocation blocks further authorized requests; it cannot erase information already displayed during an authorized session. These controls do not remove separate hosting or infrastructure privileges, which remain subject to appropriate operational restrictions.