Privacy policy.

1. Introduction

Safi IT Consulting, operating as iSada (“we”, “our”, “us”), is committed to protecting your privacy. This policy explains, in plain English, how we collect, use, and safeguard your information when you use our AI receptionist service. We follow applicable data-protection laws in the jurisdictions where we operate, and we give you control over your data — export it or delete it anytime.

If you have questions at any point, email [email protected]. We respond to every privacy request within 30 days.

2. Information We Collect

• Account information: Name, email, business name, phone number, billing details.
• Call data: Audio recordings, transcripts, caller phone numbers, call duration, AI responses, and disposition (booked, transferred, voicemail).
• Usage data: IP address, browser type, pages visited, dashboard interaction patterns.
• Integration data: Calendar events, CRM contacts, and customer notes from systems you connect (Google Calendar, HubSpot, etc.).
• Cookies: Session maintenance, preference storage, and aggregated usage analytics.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the iSada service.
• Process incoming calls and generate AI receptionist responses.
• Send transactional communications (receipts, security alerts, product updates you've opted into).
• Analyze aggregated, de-identified usage patterns to improve performance.
• Detect, prevent, and investigate fraud or security incidents.
• Comply with legal obligations.

We do not sell your personal information. We do not use your call recordings to train third-party AI models without your written consent.

4. Data Sharing

We share data only with:

• Service providers: Hosting (AWS, Cloudflare), payment processing (Stripe), telephony carriers (Twilio, Telnyx), and AI providers (OpenAI, Anthropic, Google) under strict data processing agreements.
• AI processing: Call audio is processed by speech-to-text providers (e.g., Deepgram, Google Cloud Speech) to transcribe conversations. Text responses are generated by large language model providers (e.g., OpenAI, Anthropic, Google). Text-to-speech (e.g., ElevenLabs, Google Cloud TTS) converts AI responses to audio. Training opt-out is enabled with all providers; call data is not used to improve third-party models.
• Legal requirements: When required by valid legal process (court order, subpoena), we may disclose information after reviewing the request.
• Business transfers: In connection with a merger, acquisition, or sale of assets — with notice to you.

Google User Data — Limited Use

iSada's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

iSada accesses Google Calendar data solely to provide the user-facing calendar-sync and booking feature — verifying the connection and writing confirmed appointments to the calendar you connect (one-way — iSada does not read your existing events). Google user data is not sold or transferred to any other party (except as needed to provide this feature at your direction), is not used for advertising, and is not read by humans except (a) with your consent, (b) for security purposes such as investigating abuse, or (c) where required by applicable law. You can revoke iSada's access at any time at myaccount.google.com/permissions or by disconnecting the integration in your iSada dashboard.

5. Cookies

We use three categories of cookies:

• Essential cookies: Session and authentication. Required for the service to work.
• Preference cookies: Theme, language, dashboard settings.
• Analytics cookies: Aggregated usage measurement via Google Analytics 4 — loaded only if you accept analytics cookies in our cookie banner. No advertising or cross-site tracking.

Google Analytics. If you accept analytics cookies, we use Google Analytics 4 to measure aggregated, anonymized usage — such as pages visited, approximate location (country and region), device and browser type, and the source that referred you. Google Analytics 4 does not log or store IP addresses, and we do not use it for advertising or cross-site tracking. This data is processed by Google LLC under the Google Privacy Policy. If you decline analytics cookies in our banner, Google Analytics is never loaded and collects nothing. You can also install the Google Analytics Opt-out Browser Add-on to opt out everywhere.

You can manage or disable cookies via your browser settings. Disabling essential cookies will break parts of the service.

6. Data Security

We use industry-standard security measures to protect your data:

• TLS 1.3 encryption in transit, AES-256 encryption at rest.
• API keys hashed with bcrypt; passwords never stored in plain text.
• Cloudflare DDoS protection and Web Application Firewall.
• Regular third-party penetration testing and security audits.
• Role-based access controls and multi-factor authentication for staff.
• Continuous monitoring with 24/7 alerting.

For more detail, see our Security page.

7. Data Retention

We retain data for as long as your account is active. Specific retention periods:

• Call recordings: Per your plan settings (default 90 days; configurable).
• Transcripts and metadata: 12 months by default; longer on Enterprise.
• Account & billing data: Active during the lifetime of your account, plus 7 years for tax/audit retention.
• Post-cancellation: Personal data is deleted within 30 days of account closure unless a legal hold applies.

You can request earlier deletion at any time by contacting [email protected].

8. Your Rights

We give you control over your data. You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete information.
• Erase your data (“right to be forgotten”) subject to legal exceptions.
• Port your data to another provider in a structured machine-readable format.
• Restrict or object to certain processing activities.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a data protection authority.

Email [email protected] to exercise any of these rights. We respond within 30 days, no fee.

9. International Transfers

Data may be transferred to and processed in countries other than where you live, including the United States and the European Union. When we transfer data outside Canada or the EU, we use appropriate safeguards including Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

The iSada service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, contact us immediately.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page and, where required, communicated by email at least 30 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.

12. Contact

Questions or requests? Email [email protected].

Safi IT Consulting
Toronto, Ontario, Canada
Data Protection Officer: [email protected]