Privacy Policy

1. Who we are

Harkbell is a product of Softech Ops LLC, a Wyoming limited liability company, registered at 30 N Gould St 40767, Sheridan, WY 82801, USA. Where these pages say "we", that is who they mean.

Harkbell provides an AI front desk to businesses. This policy covers harkbell.com, the dashboard, the website widget, calls on a connected phone number — the ones your agent answers, and the ones it places at your instruction — and the messages it answers or sends on channels you connect.

For your own account details we are the controller. For your callers' details, you are the controller and we act on your instructions as a processor — section 4 explains what that means for you.

2. What we collect

What you give us

• Your name, email address and a hashed password.
• Your business: name, location, industry, opening hours, services, prices, and the knowledge you upload or write.
• Contacts you import or type in, and the payment handles — a Venmo or Cash App name, a Stripe or Square link — you give the agent to read out to callers.
• Team members you invite, and their role.
• Billing details. Card numbers go to Stripe directly — we hold only a customer reference, the plan and its status.
• If you sign in with Google: your name, email address and profile picture, sent to us by Google, plus the sign-in tokens Google issues to prove it is you. They create and sign you into your account, and do nothing else.
• If you connect a Google or Outlook calendar: the account's email address and name, the names of your calendars, and the times they are busy. We cannot see event titles, attendees or details — only that a time is taken. Section 6 explains this in full.

What calls produce

• Audio of calls your agent answers or places, and transcripts of them.
• Whatever a caller tells the agent: their name, phone number, email address, what they wanted, and anything else they choose to say.
• Bookings, callback requests, contacts and the questions your agent could not answer.
• Call time, duration, outcome and which number was involved.

What we record automatically

• A session cookie so you stay signed in. It is strictly necessary.
• Server logs: IP address, browser, and which requests were made. Used for security and debugging.
• Requests your browser makes to two other companies when it loads our pages: Google, which serves the fonts on harkbell.com, and Cloudflare, which checks that the contact form is used by a person (Turnstile). Each sees your IP address and browser the way any web server does. We set no advertising or analytics cookies; the only cookie of ours is the session cookie above.
• If you call a business through the talk button on its website, your browser asks Google's public STUN server (stun.l.google.com) for the public address of your network when the call starts, which a voice call in the browser needs to reach our voice servers. The request carries your IP address and nothing from the conversation; Google handles it under its own privacy policy.
• If you turn on push notifications in the dashboard, your browser's push service — Google's, Apple's or Mozilla's, depending on the browser — carries each notification to you. The content is encrypted so that service cannot read it.

3. Why we use it

• To run the service you asked for — this is the bulk of it.
• To bill you, and to meet our tax and accounting obligations.
• To keep the service secure, investigate abuse and enforce our Terms.
• To email you about your account: sign-in links, invitations, and notices such as your minutes running out. These are not marketing and you cannot unsubscribe from them while you have an account.

Where the GDPR applies, our bases are performance of a contract, our legitimate interest in a secure and working service, and legal obligation.

4. Calls, recordings and consent

Calls your agent answers or places are recorded and transcribed. That is how the product shows you what was said and extracts bookings and contacts from it.

Your business must give callers the notices required for its use. You decide what your agent says when it answers, and the calls it places are made at your instruction. Recording and transcription law varies — some places require every party to consent before a call may be recorded. Whether your agent tells the caller that it is an AI assistant and that the call is recorded, on calls it answers and calls it places, is your choice: it is off unless you switch it on during setup or in your agent settings, and we record who switches it off and when. Disabling a spoken disclosure does not remove any consent requirement. Take advice on what your agent needs to say; Harkbell retains its own obligations under applicable law.

A cloned voice is a copy of a real person's voice. Where cloning is switched on for your business, you may make your agent speak in the voice of someone who has agreed to it. The person reads a short script that begins with their consent, and you confirm that it is them and that they agreed; we keep that confirmation, who gave it and when. The recording is sent to our speech provider to make the copy. Remove the voice when they ask you to, and stop using it if you cannot show they agreed.

When somebody your agent calls asks not to be called again, we record that with the number and the call it was said on, and Harkbell will not dial that number for your business again.

If one of your callers contacts us directly about their data, we will point them to you and tell you about it, because it is your record and not ours to change.

On a website, the Harkbell widget's panel shows this notice directly above its start button: “You'll talk to an AI assistant. Calls are recorded and transcribed.” There is no separate consent dialog. When a call is started from that panel, pressing the start button is how the visitor agrees, and until it is pressed the widget opens no voice session and does not ask for the microphone. Where a business has switched the spoken disclosure on, the agent's greeting says aloud, once the call connects, that it is an AI assistant and that the call is recorded. That spoken disclosure is off by default; a business may switch it on in its agent settings, as described above, and the written notice in the widget's panel is shown either way. A browser's microphone permission is separate from agreeing to be recorded.

A web page can also start a call from a button of its own, without the widget's panel ever appearing. Harkbell's own demo and the test call in the dashboard work that way. The widget then shows no notice of its own: what a visitor reads before that call is whatever the page shows beside its button, and a business whose page starts calls this way must show the same notice there. On Harkbell's demo the disclosure is the agent's spoken greeting, which cannot be switched off there; the dashboard's test call is the business calling its own agent. Businesses must also give any notices and obtain any additional consent required for their use; Harkbell remains responsible for its own obligations under applicable law.

5. Text messages

Where a business has texting on, the agent asks a caller who books whether it may text them — “Is it OK if [the business] texts you on that number to confirm?” — and we record that answer alongside the number and the call it came from. Nothing is texted to a caller who did not agree. Consent to marketing texts is asked for separately and is never assumed from a booking.

What we send on your behalf: booking confirmations, appointment reminders, and, where you have configured them, your own deposit link and consent-form link — plus, where you have set a review page, one message after the appointment asking for a review. We also text you, the owner, a summary of a booking request the agent took, so you can confirm or decline it by replying. Message frequency varies: it follows the appointments a caller makes, and there is no recurring schedule. Message and data rates may apply.

A caller can reply STOP to any message to stop all of them, START to start again, or HELP for contact details. STOP takes effect immediately and ends both booking texts and marketing texts. Section 11 of the Terms sets out the same program from the recipient's side, including every keyword we honor.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. Phone numbers and message content are processed by our hosting, messaging and language providers as needed to operate the service. The same is true of messages and photos a caller sends in.

6. Connected calendars and Google user data

You can connect a Google or Outlook calendar so your agent stops offering times that something outside Harkbell already took. The connection reads three things: the connected account's email address and name, kept so you can tell two connected accounts apart; the list of your calendars — their names, so you can pick which ones count — and the intervals when those calendars are busy. Google answers through its free/busy endpoint, which cannot return event contents at all; from Microsoft we request only each event's start, end and busy status. Either way, event titles, attendees, locations and descriptions never reach us.

If you turn on write-back, we also create and update events in your calendar — only the appointments booked through Harkbell, so they sit alongside everything else. We never touch an event we did not create.

Signing in with Google is separate and smaller: Google sends us your name, email address and profile picture, along with your Google account's identifier and the sign-in tokens that prove it is you. We use them to create and sign you into your account — nothing else.

The calendar and sign-in tokens that make this work are encrypted at rest. Disconnecting a calendar deletes its tokens immediately, and the erasure section 10 offers covers them with the rest of your records when you leave. Nothing we receive from Google or Microsoft is used for advertising, sold, or used to train AI models — ours or anyone's — and no person at Harkbell reads it, except to help you when you ask us to, to keep the service secure, or where the law requires it.

Harkbell's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

7. WhatsApp, Instagram and Messenger

A business can connect its WhatsApp, Instagram or Facebook Page so that the same agent answers messages there. When it does, we receive from Meta only what is needed to hold that conversation:

• The messages in the connected conversation, and what the agent replied.
• The sender id the platform issues for that person — an identifier scoped to this app, which cannot be used to find them anywhere else.
• For WhatsApp, the phone number the message came from, which is how a person who also rings the business is recognized as the same client rather than becoming two records.

We never post as you and never read anything outside the conversations a business has explicitly connected. On Instagram and Messenger the agent only replies. On WhatsApp a business may also message a client first — with a template Meta has approved, and only after confirming that the client agreed to hear from it there — and a caller may ask the agent on a call to send something to their WhatsApp, which goes to the number they called from. Data received from Meta is used to answer the conversation it came from and for nothing else — never advertising, never model training, and never sold.

To have it deleted, or to revoke our access entirely, see Delete your data, which sets out both routes and how long each takes.

8. Who else sees it

We use the providers below to run Harkbell. The providers used for your business depend on the features and integrations you enable. We send data needed for those services. Provider processing, retention and model-improvement settings are governed by the applicable service agreements; contact us to confirm the arrangements for your use.

• Amazon Web Services, Inc. (Northern Virginia, United States (us-east-1)) — Servers, databases and the voice engine itself. Also the mail relay for some account email.
• Cloudflare, Inc. (Global) — DNS, TLS, website delivery, a request proxy carrying conversation text to our language-model host, and encrypted off-site database backups in R2.
• Telnyx LLC (United States) — Phone numbers, the carrier leg of every telephone call, and text messages where texting is on.
• Speech and language providers (United States) — Turning speech into text, text into speech, deciding what the agent says, and copying a voice a business chooses to clone. Speech to text is AssemblyAI, with Deepgram standing in when AssemblyAI is unavailable; speech out, and a voice a business chooses to clone, is ElevenLabs; OpenAI indexes a business's knowledge so the agent can search it.
• Fireworks AI (United States; service routing and subprocessors are governed by its processing terms) — Hosts the language model that generates agent replies, including MiniMax models. Receives conversation text, prompts and tool results through our Cloudflare proxy. After a call ends, the same model reads the transcript — the text, never the audio — to pull out the caller's name and number, a callback request and the questions the agent could not answer.
• Stripe, Inc. (United States) — Payments and subscriptions. Card details go to Stripe directly and Harkbell never sees or stores them.
• Resend, Inc. (United States) — Sign-in links, invitations and account email.

We may also disclose data where the law requires it, or to a buyer if the business is sold — in which case we will tell you first.

We do not sell your data, we do not share it for advertising, and we do not use your calls to train AI models of our own. Whether a speech provider may use audio to improve its models is set in our agreement with that provider; ask us and we will tell you the current setting.

9. Where it is held

Your database, your recordings and your transcripts live on servers in Northern Virginia, in the United States. Backups are held in Cloudflare R2, encrypted at rest, and in Amazon's own automated backups of the database.

Our primary storage is in the United States. Cloudflare operates a global network, and processing by our service providers may occur in other countries under their applicable terms. We do not promise that every processing step remains in the United States. If your use requires a data-processing agreement or safeguards for international transfers, contact us before uploading personal data so the applicable arrangements can be agreed. A statement on this page is not a substitute for those agreements. If your business is in the United Kingdom or the European Economic Area, email us before you connect anything, so the transfer paperwork your law requires is in place first.

10. How long we keep it

• Contacts and knowledge — deleting them in the dashboard takes them out of your workspace, and the agent stops using deleted knowledge. The underlying records, and the calls and bookings a contact was linked to, are kept until you ask us to erase them.
• Account and business data — kept while your account is open. An Owner can delete a business from Settings → Billing, which stops its agent and closes it to the whole team; its calls, contacts and bookings are kept until you ask us to erase them, and we will.
• Call recordings and transcripts — kept for as long as the business exists, so that you can go back to a call months later. Ask us to erase them and we will.
• Dashboard notifications — the alerts your team sees in Harkbell are deleted a day, a week or a month after they are read, depending on the kind; alerts that your agent or a connection stopped working are kept with the business. An alert nobody reads is deleted after two years, and a team member's alerts 30 days after they leave the team. The booking, message or call an alert was about is kept as described above.
• Cloned voices — the recording a voice was made from and the copy at our speech provider are kept until the voice is removed or its business is deleted, and are then deleted. The record of who agreed to the copy, and when, is kept with the business.
• Backups — routine database backups are kept for up to 14 days (our off-site copies) and 7 days (the hosting provider's automated ones). Erased data expires from those backups with that rotation. A failed cleanup or a separately retained recovery snapshot can require manual deletion; we include those copies when handling an erasure request. Restoring a backup must also reapply recorded erasure requests.
• Billing records — kept as long as tax law requires, normally six years.
• Server logs — the host's system log for 30 days; the application's own logs rotate by size, oldest first. Both are kept for security.

We do not delete your calls on a timer. If you would rather they were not kept indefinitely, tell us and we will erase them. Delete your data sets out exactly how to ask, what happens next, and the few things we are obliged to keep.

11. Your rights

Depending on where you live you may have the right to see the data we hold about you, correct it, delete it, take a copy elsewhere, object to a use of it, or ask us to restrict it. Most of this you can do yourself in the dashboard; for the rest, email us and we will answer within 30 days. Deletion has a page of its own — Delete your data — covering account holders, callers, and anyone who reached a business through Facebook, Instagram or WhatsApp.

In the EU or UK you may complain to your data protection authority; in Canada to the Office of the Privacy Commissioner; in Australia to the Office of the Australian Information Commissioner. In California you have equivalent rights under the CCPA. For your callers' data we act as your service provider, and we do not sell or share personal information as that law defines it, and have not in the past twelve months.

12. Security

Traffic is encrypted in transit, and the database, the recordings and the backups are encrypted at rest. Passwords are stored as hashes, never in plain text, and the tokens that connect your calendars, booking systems and messaging channels are encrypted under keys we hold separately from the database. Access to production is restricted to the people who operate it, and the browser is never given credentials for the voice engine. No system is perfectly secure. If a breach affects you we will tell you without undue delay, and the relevant regulator as the law requires; if it affects your callers' data we will tell you what happened so that you can tell them.

13. Children

Harkbell is for businesses and is not directed at children; you must be 18 to hold an account. Your agent answers whoever rings or messages your business, and that can be a minor — a teenager booking for themselves, a parent booking for a child. Those are your callers and your records: you decide what your business may collect from them, and where the GDPR applies you decide whether a parent's consent is needed. We do not knowingly collect a child's data for our own purposes. If you believe a child's data has reached us in a way it should not have, tell us and we will delete it.

14. Changes

We will update this policy as the service changes, and the date at the top will change with it. If a change materially affects you we will email you before it takes effect.

15. Contact

Any question about your data, or to exercise a right: hello@harkbell.com.