How we handle your data

Where it's stored

Your account, call logs, transcripts and recordings are stored with our database and file-storage provider, in the United States (Northern Virginia). Our website and dashboard are hosted in the United States too (the Washington, D.C. area).

Who handles it

These are the kinds of service providers that handle your data or your callers' data to run Pivot Assist:

• Cloud hosting for the website, the dashboard and the code that runs during your calls.
• Database and file storage for your account, sign-in, call logs and call recordings.
• Voice infrastructure that answers your calls: it turns speech into text, runs the AI that replies, and speaks the reply.
• Large-language-model providers, the AI models that write the agent's replies, used through our voice infrastructure.
• Phone and text-message delivery for your numbers, call routing and texts.
• Email delivery for the emails we send.
• Payment processing. You enter card details on our payment processor's own pages, so they never reach our servers.
• Google Calendar, only if you connect it.
• Bot protection on our sign-up, log-in and password-reset pages.

Calls and recordings

• Every call opens with a notice that the call may be recorded and that the caller is speaking with an automated assistant.
• Our voice provider is set not to keep call content. It deletes each call's recording, transcript and logs shortly after the call, and keeps only basic details such as the time and length.
• We keep our own copy of the recording and transcript so you can play and read them in your dashboard. Recordings sit in private storage that only our server can open. When you press play, you get a link that stops working after 10 minutes.
• We don't use call recordings or transcripts to train AI models.

Google Calendar access

Only if you connect Google Calendar. These are the permissions we ask Google for:

• openid
• email
• profile
• https://www.googleapis.com/auth/calendar.events.owned

The first three show which Google account is connected. The last one lets us see, create, change and delete events on calendars you own. What we do with it:

• We read only the start and end times of events on your primary calendar, and whether each one is busy, so the agent offers only open times.
• We never ask Google for, or store, your events' titles, descriptions, locations or guests.
• We create an event when a caller books, and we move or delete only the events Pivot Assist created. No invitations are sent.
• We store Google's access tokens encrypted.
• You can disconnect any time under Integrations. We revoke our access with Google and delete the stored tokens.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. More detail is in the Google Calendar section of our Privacy Policy.

Encryption

• In transit: the website and dashboard are served only over HTTPS, and browsers are told to always use it.
• At rest: our database provider encrypts our database, file storage and backups (AES-256, per its documentation).
• Google tokens: we also encrypt them ourselves (AES-256-GCM) before they're stored.

Who can see call data

• You, signed in to your dashboard. Each business's data is kept apart by the database itself: an account can read only its own calls.
• At Pivot Assist, people with administrator access can open calls, recordings and transcripts. We use your data only to provide, operate, maintain and secure the service for you, as our Terms of Service say.

How long we keep it

• Recordings and transcripts: 12 months after the call, then deleted.
• Our voice provider's copy: deleted shortly after each call.
• Call logs (the time, length and outcome of each call, and the caller's number): for as long as you have an account.
• Records of a caller agreeing to texts, and of the texts we exchange: up to 4 years after the last text, to show consent.
• Records of accepting our terms: while your account is open and for 4 years after it closes.

Asking us to delete it

To ask us to access, correct or delete your information, email support@getpivotassist.com or use our contact page. We may need to verify your identity first. You can disconnect Google Calendar yourself at any time under Integrations.

Your account

• Passwords must be at least 8 characters.
• Repeated sign-in attempts are limited, both per network and per email address.
• Requests from our call, text and payment providers are checked for a valid signature before we act on them.

Health information

Pivot Assist isn't built for protected health information. We don't offer a HIPAA Business Associate Agreement, and our Acceptable Use Policy doesn't allow use by HIPAA covered entities or business associates.

Security questions

Questions about security, or something to report? Email support@getpivotassist.com, or call (949) 844-2169. Our AI answers first. Ask for Andrew and you'll be transferred.