Privacy and security
When AlloPlace answers your phone, your callers are trusting you with their name, their number and sometimes their address. You're trusting us with all of it. Here's how we handle that, in plain language. The full details are in our Privacy Policy.
Callers know they're talking to an AI
Every call starts with a short notice that the caller is speaking with an AI assistant and that the call is recorded and transcribed. It plays before the AI joins the call, every time, in English or French. TBD: this is planned, not built. Today the greeting comes from the AI model, which doesn't say it reliably enough for a legal notice.
If a caller would rather not be recorded, they can TBD: the alternative, for example leave a message or be put through to a person. Not built yet.
The website chat is labelled as an AI assistant too.
What we collect on a call
- The caller's phone number
- The recording and a written transcript
- A short summary
- Whatever the caller tells it, like their name, the reason for calling and the appointment they want
- Whether they agreed to a reminder text, and when
We don't build voiceprints and we don't identify people by their voice.
Who can see it
You and the team members you invite. Each business's data is kept separate from every other business at the database level, so one customer's account can't read another's.
Our own staff look at your data only when you ask for help or when we need to keep the service running or secure. TBD: internal access policy and logging.
Where it's processed
AlloPlace runs on services in the United States. That includes the AI that handles the conversation, the phone network and our servers. We can't offer Canadian data residency today, because the live voice AI isn't available from a Canadian region.
For customers in Canada, and Quebec in particular, we TBD: complete transfer impact assessments and publish a summary and protect the data by contract with each provider. The full list of providers, what they do and where they are is on our Subprocessors page.
Is my data used to train AI?
The AI provider we use doesn't train its models on data sent through its business API by default. We don't use your calls to train models either. TBD: confirm wording with counsel and check the current provider terms before publishing.
How long we keep it
Recordings and transcripts are deleted automatically after a set time, and you can delete a recording sooner yourself. TBD: retention periods.
One caveat: the AI provider keeps its own copy of each call recording for up to 30 days, and that copy can't be deleted early. TBD: confirm against the provider's current terms.
Changing an appointment
Anyone can call and claim to be someone else, so AlloPlace sends a one-time code by text to the phone number on the booking before it moves or cancels anything.
If AlloPlace goes down
TBD: an outage fallback that forwards calls to your own number or to voicemail, plus a public status page. Not built yet. Describe it here once it is.
Quebec's privacy law (Law 25)
If you're in Quebec, you're responsible for your customers' information, and we're your service provider. We can help with the paperwork:
- Our person in charge of protecting personal information is TBD: name, title, email.
- We provide a privacy impact assessment information pack: what we collect, where it goes, how long we keep it, and how it's secured. TBD: write the pack.
- If something important is decided automatically, like a failed identity check on a cancellation, the caller can ask a person to look at it.
Health clinics
We're not set up to handle health information under HIPAA or Canada's provincial health privacy laws yet, so we're not selling to clinics or dental offices. That will change only after the right agreements are signed with every provider in the chain.
Found a security problem?
Email TBD: security@alloplace.ai. We'll reply as quickly as we can and keep you posted while we fix it.