Privacy Policy

1. What we collect

Account information. When you sign in with Google we receive your name, email address and profile picture. We keep the time of each sign-in, the IP address and browser used, and which workspaces you belong to.

Business information. The business name, industry and business type, time zone, service area, a description of what the business does, the phone numbers calls are forwarded to, who is invited to the workspace and with what role, and the email addresses that receive alerts.

Call information. For every call to a tracking number: the caller's phone number (or “anonymous” when it was withheld), the city, state and ZIP code the carrier associates with that number, the caller-ID authentication status the network reported, the tracking number dialed, the number the call was forwarded to, start and end times, how long it rang and lasted, whether it was answered, missed or sent to voicemail, whether the caller had called before, and which marketing source the tracking number belongs to.

Recordings and voicemails. Where a customer has recording on, the audio of the call, with the recording announcement inside it, and any message a caller leaves. Healthcare workspaces don't record or take messages.

Text messages. Texts sent to a tracking number: the sender's number, the text, any photos, and when it arrived. Healthcare workspaces keep only that a text arrived, never what it said, and the text is deleted from the carrier.

Transcripts and classifications. Where enabled, a text transcript of the recording and an automated label (for example new lead, existing customer, spam) with a one-line summary.

Visits to customers' websites. Where a customer installs our number swap code, it reports each visit, except on healthcare customers' sites, where it reports nothing: the site's address, the pages viewed and when the visitor left them, the referring website, campaign tags and ad click identifiers in the page address, the marketing source we classified the visit as, the phone number shown, a general device type (phone, tablet or computer), and when a phone link or email link is tapped or a form is submitted. Each report carries random identifiers kept in first-party cookies (section 8). It does not collect what a visitor types into a form, the address in an email link, or anything else in the page address. We use the visitor's IP address and browser details as a report arrives, to limit abuse, to leave out bots and to recognize the customer's own team, and we do not store them with the visit. The code uses no advertising cookies.

Matching visits to calls and texts. We automatically compare reported visits with calls and texts, mostly by timing and the number shown, to work out which visit may have led to which call or text, and a customer's team can correct the result. A match can be a best guess, and it can be wrong. Visit records use random identifiers rather than names, but they are not anonymous: once a visit is linked, the business sees it next to the caller's phone number.

Requests from ringtracker.io. When you ask for a spot, the name, email address, phone number, business name, town and website you give us, what you tell us about your calls and the plan you're interested in, plus the page you arrived from, any campaign tags in its address, your IP address and browser.

Visits to ringtracker.io. Google Analytics records the pages viewed, how a visitor arrived, and general device and location information, using first-party cookies. It doesn't tell us who you are.

Use of the app. Google Analytics also counts which sections of the app are viewed (Overview, Calls, Settings and so on), how people arrived, and general device information. It never receives your workspace, a call, a caller's number, a transcript, a message or anything shown on a page, and visits by our own staff aren't counted.

Billing. Plan, usage (minutes and numbers), and invoices. Card details are held by our payment processor; we never see the full card number.

Operational records. Raw carrier webhooks about calls, an audit log of who changed which setting (with IP address), and the version, time, IP address and browser for each acceptance of our Terms.

2. How we use it

• To provide the Service: route calls, record and transcribe where enabled, take messages, send alerts, report attribution.
• To keep the Service safe: detect toll fraud and abuse, validate carrier requests, investigate incidents.
• To bill customers and keep the records the law requires.
• To support customers and answer their questions.
• To reply to requests from our website, and to understand how people find it.
• To measure, improve and report on the Service using aggregated, de-identified statistics, including across the websites that run our code: for example, how often visits lead to calls by marketing source or device. These statistics leave out phone numbers, visitor and ad click identifiers, and anything that names a person or business, and we may publish them as benchmarks.
• To comply with law, and to enforce our Terms.

We do not sell personal information, we do not use it for advertising, and we do not use recordings, transcripts or any customer data to train AI models. Our AI provider is contractually barred from training on it too.

We keep de-identified data in de-identified form and do not try to re-identify it, except to test that our de-identification works, and we require anyone we share it with to do the same.

3. Recording and health information

• Recording is a customer's choice and responsibility. By default the Service announces the recording at the start of every recorded call, and the announcement is inside the audio.
• Calls that ring out without being answered are recorded briefly because recording starts before the call is connected; that audio is deleted without being stored.
• Ring Tracker doesn't serve healthcare businesses and doesn't sign Business Associate Agreements. A workspace in a healthcare or health-related industry can't add numbers, and any it already has keep call metadata only. If we find health information in a recording, transcript or message, we may delete it.

4. Who we share it with

We share information only with the providers that run the Service, each under its own terms, and only as needed:

• Twilio: the carrier. Provisions tracking numbers, connects and records calls, receives texts, and holds each recording and photo briefly until we copy it.
• Cloudflare: storage for recordings and voicemails (R2), and the bot check on the sign-in page (Turnstile).
• Railway: hosting for the application, its database and our own transcription service, in the United States (US East). Call audio is transcribed there; no other company receives it to transcribe.
• DigitalOcean: hosting for our website, ringtracker.io, and the requests made through it, in the United States.
• Amazon Web Services: email delivery (SES) for alerts, invitations and reports, and for passing website requests to our team.
• Google: sign-in, where we request only your name, email and picture and never access your Google data; and Google Analytics, which counts visits to ringtracker.io and which sections of the app are viewed.
• Anthropic: call classification. Transcripts (never audio) are sent to produce a label and summary for workspaces that turn classification on.
• Stripe: payments and invoices.

We may also disclose information when the law requires it, to protect the rights and safety of callers, customers or the public, to a successor in a merger or sale of the Service (under this policy), or with a customer's direction. Staff of Ring Tracker can see workspace data to support customers and operate the Service; access is logged.

5. How long we keep it

• Recordings, voicemails and photos sent by text: for the retention period the customer sets, 7 days by default and never more than 90. A storage rule deletes any audio that is still there at 92 days.
• Call details, texts, transcripts and classifications: for the life of the workspace.
• Visits to customers' websites: 90 days. A visit linked to a call or text stays as long as that call or text, and a visit with a form submission or email-link tap stays for the life of the workspace.
• De-identified statistics: with no time limit, since they can't identify anyone.
• Raw carrier webhooks: 30 days.
• Audit logs and Terms acceptances: for the life of the workspace, then as our records require. Records of our staff opening a workspace are kept for 2 years.
• Tracking numbers: held 30 days after release, then returned to the carrier.
• Requests from ringtracker.io: until 24 months after we last hear from you, or sooner if you ask us to delete them. If you become a customer, what you sent becomes part of your account.
• Closed workspaces: data is deleted within 90 days of closing, except what we must keep for billing, audit or legal reasons.

6. Security

Data moves over encrypted connections. Recordings are stored privately and served through short-lived links to signed-in members of the workspace they belong to. Each workspace's data is isolated from every other's in the application. Carrier requests are checked for a valid signature before they are trusted. No system is perfectly secure; if we learn of a breach affecting you, we will tell you as the law requires.

7. Your choices and rights

Customers control recording, the announcement and message taking per number; the audio retention period; who is in the workspace; and can export call data from the app. To close a workspace or delete an account, email support@ringtracker.io.

Callers and visitors to customers' websites should contact the business they called or visited; it decides what is kept. Visitors can also block or clear cookies in their browser, which stops their visits being linked together. Where a state privacy law (such as the California Consumer Privacy Act or Washington's My Health My Data Act) gives you rights over information a business holds, we act as that business's service provider or processor and help it respond. We do not sell or share personal information for cross-context advertising.

Anyone can ask us what we hold about them, or ask for a correction or deletion, at support@ringtracker.io. We will verify the request and answer within the time the law allows.

8. Cookies

The app uses a session cookie to keep you signed in, small preference cookies (theme, sidebar), and Cloudflare Turnstile on the sign-in page to block bots. Number swapping sets up to three first-party cookies on a customer's own website: rt_src remembers the marketing source for 90 days, rt_sid groups a visit's pages until 30 minutes after the last one, and rt_vid recognizes the browser for 90 days. They hold no name or contact details, and other websites can't read them. Our website, ringtracker.io, and the app use Google Analytics cookies to count visits and which sections are viewed. We use no advertising or cross-site tracking cookies.

9. Where data lives, and children

The Service is hosted in the United States and serves US businesses and their callers in the United States and Canada. It is a business tool and not directed at children; we do not knowingly collect information from anyone under 18.

10. Changes

We may update this policy. Material changes are shown in the app and require acceptance before it opens again; the version and effective date are at the top.

11. Contact

August SEO, LLC, Spokane, Washington. Privacy questions and requests: support@ringtracker.io.