Privacy Policy

1. Who we are

Harkbell is a product of Softech Ops LLC, a Wyoming limited liability company, registered at 30 N Gould St 40767, Sheridan, WY 82801, USA. Where these pages say "we", that is who they mean.

Harkbell provides an AI receptionist to businesses. This policy covers harkbell.com, the dashboard, the website widget, and calls on a connected phone number — the ones your agent answers, and the ones it places at your instruction.

For your own account details we are the controller. For your callers' details, you are the controller and we act on your instructions as a processor — section 4 explains what that means for you.

2. What we collect

What you give us

• Your name, email address and a hashed password.
• Your business: name, location, industry, opening hours, services, prices, and the knowledge you upload or write.
• Team members you invite, and their role.
• Billing details. Card numbers go to Stripe directly — we hold only a customer reference, the plan and its status.
• If you sign in with Google: your name, email address and profile picture, sent to us by Google, plus the sign-in tokens Google issues to prove it is you. They create and sign you into your account, and do nothing else.
• If you connect a Google or Outlook calendar: the account's email address and name, the names of your calendars, and the times they are busy. We cannot see event titles, attendees or details — only that a time is taken. Section 6 explains this in full.

What calls produce

• Audio of calls your agent answers or places, and transcripts of them.
• Whatever a caller tells the agent: their name, phone number, email address, what they wanted, and anything else they choose to say.
• Bookings, callback requests, contacts and the questions your agent could not answer.
• Call time, duration, outcome and which number was involved.

What we record automatically

• A session cookie so you stay signed in. It is strictly necessary, and we set no advertising or analytics cookies.
• Server logs: IP address, browser, and which requests were made. Used for security and debugging.

3. Why we use it

• To run the service you asked for — this is the bulk of it.
• To bill you, and to meet our tax and accounting obligations.
• To keep the service secure, investigate abuse and enforce our Terms.
• To email you about your account: sign-in links, invitations, and notices such as your minutes running out. These are not marketing and you cannot unsubscribe from them while you have an account.

Where the GDPR applies, our bases are performance of a contract, our legitimate interest in a secure and working service, and legal obligation.

4. Calls, recordings and consent

Calls your agent answers or places are recorded and transcribed. That is how the product shows you what was said and extracts bookings and contacts from it.

Your business must give callers the notices required for its use. You decide what your agent says when it answers, and the calls it places are made at your instruction. Recording and transcription law varies — some places require every party to consent before a call may be recorded. Every agent is set up telling the caller that it is an AI assistant and that the call is recorded, on calls it answers and calls it places; you may switch that off in your agent settings, and we record who did so and when. Disabling a spoken disclosure does not remove any consent requirement. Take advice on what your agent needs to say; Harkbell retains its own obligations under applicable law.

When somebody your agent calls asks not to be called again, we record that with the number and the call it was said on, and Harkbell will not dial that number for your business again.

If one of your callers contacts us directly about their data, we will point them to you and tell you about it, because it is your record and not ours to change.

On a website, the Harkbell widget's panel shows this notice directly above its start button: “You'll talk to an AI assistant. Calls are recorded and transcribed.” There is no separate consent dialog. When a call is started from that panel, pressing the start button is how the visitor agrees, and until it is pressed the widget opens no voice session and does not ask for the microphone. Once the call connects, the agent's greeting says aloud that it is an AI assistant and that the call is recorded. That spoken disclosure is on by default; a business may switch it off in its agent settings, as described above, and the written notice in the widget's panel is shown either way. A browser's microphone permission is separate from agreeing to be recorded.

A web page can also start a call from a button of its own, without the widget's panel ever appearing. Harkbell's own demo and the test call in the dashboard work that way. The widget then shows no notice of its own: what a visitor reads before that call is whatever the page shows beside its button, and a business whose page starts calls this way must show the same notice there. On Harkbell's demo the disclosure is the agent's spoken greeting, which cannot be switched off there; the dashboard's test call is the business calling its own agent. Businesses must also give any notices and obtain any additional consent required for their use; Harkbell remains responsible for its own obligations under applicable law.

5. Text messages

When a caller books through your agent, the agent asks on the call whether it may text them, in those words, and we record that answer alongside the number and the call it came from. Nothing is texted to a caller who did not agree. Consent to marketing texts is asked for separately and is never assumed from a booking.

What we send on your behalf: booking confirmations, appointment reminders, and, where you have configured them, your own deposit link and consent-form link — plus, where you have set a review page, one message after the appointment asking for a review. We also text you, the owner, a summary of a booking request the agent took, so you can confirm or decline it by replying. Message frequency varies: it follows the appointments a caller makes, and there is no recurring schedule. Message and data rates may apply.

A caller can reply STOP to any message to stop all of them, START to start again, or HELP for contact details. STOP takes effect immediately and ends both booking texts and marketing texts. Section 11 of the Terms sets out the same program from the recipient's side, including every keyword we honour.

Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. Phone numbers and message content are processed by our hosting, messaging and language providers as needed to operate the service. The same is true of messages and photos a caller sends in.

6. Connected calendars and Google user data

You can connect a Google or Outlook calendar so your agent stops offering times that something outside Harkbell already took. The connection reads three things: the connected account's email address and name, kept so you can tell two connected accounts apart; the list of your calendars — their names, so you can pick which ones count — and the intervals when those calendars are busy. Google answers through its free/busy endpoint, which cannot return event contents at all; from Microsoft we request only each event's start, end and busy status. Either way, event titles, attendees, locations and descriptions never reach us.

If you turn on write-back, we also create and update events in your calendar — only the appointments your own receptionist booked, so they sit alongside everything else. We never touch an event we did not create.

Signing in with Google is separate and smaller: Google sends us your name, email address and profile picture, along with your Google account's identifier and the sign-in tokens that prove it is you. We use them to create and sign you into your account — nothing else.

The calendar and sign-in tokens that make this work are encrypted at rest. Disconnecting a calendar deletes its tokens immediately, and the erasure section 10 offers covers them with the rest of your records when you leave. Nothing we receive from Google or Microsoft is used for advertising, sold, or used to train AI models — ours or anyone's — and no person at Harkbell reads it, except to help you when you ask us to, to keep the service secure, or where the law requires it.

Harkbell's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. WhatsApp, Instagram and Messenger

A business can connect its WhatsApp, Instagram or Facebook Page so that the same agent answers messages there. When it does, we receive from Meta only what is needed to hold that conversation:

• The messages in the connected conversation, and what the agent replied.
• The sender id the platform issues for that person — an identifier scoped to this app, which cannot be used to find them anywhere else.
• For WhatsApp, the phone number the message came from, which is how a person who also rings the business is recognised as the same client rather than becoming two records.

If you sign in with Continue with Facebook, we receive an app-scoped user id, your name and your email address. That is the whole of it — never your password, your friends, your posts, or any part of your profile beyond those three fields.

We never post as you, never read anything outside the conversations a business has explicitly connected, and never send anybody the first message. Data received from Meta is used to answer the conversation it came from and for nothing else — never advertising, never model training, and never sold.

To have it deleted, or to revoke our access entirely, see Delete your data, which sets out both routes and how long each takes.

8. Who else sees it

We use the providers below to run Harkbell. The providers used for your business depend on the features and integrations you enable. We send data needed for those services. Provider processing, retention and model-improvement settings are governed by the applicable service agreements; contact us to confirm the arrangements for your use.

• Amazon Web Services, Inc. (Northern Virginia, United States (us-east-1)) — Servers, databases and the voice engine itself. Also the mail relay for some account email.
• Cloudflare, Inc. (Global) — DNS, TLS, website delivery, a request proxy carrying conversation text to our language-model host, and encrypted off-site database backups in R2.
• Telnyx LLC (United States) — Phone numbers and the carrier leg of every telephone call.
• Speech and language providers (United States) — Turning speech into text, text into speech, and deciding what the agent says. Depending on configuration this may be Deepgram, OpenAI, Google, ElevenLabs or Cartesia.
• Fireworks AI (United States; service routing and subprocessors are governed by its processing terms) — Hosts the language model that generates agent replies, including MiniMax models. Receives conversation text, prompts and tool results through our Cloudflare proxy.
• DeepSeek (China, where enabled) — Optional extraction of business information from website content submitted during setup. Do not submit private customer information for website extraction.
• Stripe, Inc. (United States) — Payments and subscriptions. Card details go to Stripe directly and Harkbell never sees or stores them.
• Resend, Inc. (United States) — Sign-in links, invitations and account email.

We may also disclose data where the law requires it, or to a buyer if the business is sold — in which case we will tell you first.

We do not sell your data, we do not share it for advertising, and we do not use your calls to train AI models.

9. Where it is held

Your database, your recordings and your transcripts live on servers in Northern Virginia, in the United States. Encrypted backups are held in Cloudflare R2.

Our primary storage is in the United States. Cloudflare operates a global network, and processing by our service providers may occur in other countries under their applicable terms. We do not promise that every processing step remains in the United States. If your use requires a data-processing agreement or safeguards for international transfers, contact us before uploading personal data so the applicable arrangements can be agreed. A statement on this page is not a substitute for those agreements.

10. How long we keep it

• Contacts and knowledge — deleting them in the dashboard takes them out of your workspace, and the agent stops using deleted knowledge. The underlying records, and the calls and bookings a contact was linked to, are kept until you ask us to erase them.
• Account and business data — kept while your account is open. An Owner can delete a business from Settings → Billing, which stops its agent and closes it to the whole team; its calls, contacts and bookings are kept until you ask us to erase them, and we will.
• Call recordings and transcripts — kept for as long as the business exists, so that you can go back to a call months later. Ask us to erase them and we will.
• Backups — routine database backups use a rolling retention period of up to 14 days. Erased data expires from those backups with that rotation. A failed cleanup or a separately retained recovery snapshot can require manual deletion; we include those copies when handling an erasure request. Restoring a backup must also reapply recorded erasure requests.
• Billing records — kept as long as tax law requires, normally six years.
• Server logs — a short rolling window for security.

We do not delete your calls on a timer. If you would rather they were not kept indefinitely, tell us and we will erase them. Delete your data sets out exactly how to ask, what happens next, and the few things we are obliged to keep.

11. Your rights

Depending on where you live you may have the right to see the data we hold about you, correct it, delete it, take a copy elsewhere, object to a use of it, or ask us to restrict it. Most of this you can do yourself in the dashboard; for the rest, email us and we will answer within 30 days. Deletion has a page of its own — Delete your data — covering account holders, callers, and anyone who reached a business through Facebook, Instagram or WhatsApp.

In the EU or UK you may complain to your data protection authority. In California you have equivalent rights under the CCPA, and we do not sell or share personal information as that law defines it.

12. Security

Traffic is encrypted in transit. Passwords are stored as hashes; plaintext passwords are not stored. Access to production is restricted to the people who operate it, and the browser is never given credentials for the voice engine. No system is perfectly secure; if a breach affects you we will tell you and the relevant regulator as the law requires.

13. Children

Harkbell is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

14. Changes

We will update this policy as the service changes, and the date at the top will change with it. If a change materially affects you we will email you before it takes effect.

15. Contact

Any question about your data, or to exercise a right: hello@harkbell.com.