EveryRing Privacy Policy

Effective October 13, 2026.

1. About EveryRing

EveryRing provides custom AI receptionist services and a client portal for onboarding, business information, integrations, scheduling, and service administration. The portal supports an agency-led setup: submitting information does not automatically build or activate a receptionist.

This policy explains how EveryRing handles information through its website, portal, and configured receptionist services. Contact us at everyringco@gmail.com with privacy questions or requests. The client business is responsible for its own customer notices and instructions concerning information processed for that business.

2. Information we collect

Depending on the features you use, we collect:

• Account and contact details: name, email address, business identity, sign-in and session information, and support communications.
• Business setup information: websites and public listing links; hours, locations, services, prices, FAQs, approved answers, transfer contacts, and receptionist instructions you provide.
• Integration information: provider name, account identifiers, selected calendars or booking targets, connection status, API credentials or OAuth authorization tokens you supply or authorize.
• Scheduling information: staff/resource profiles, appointment dates and times, service details, attendee contact details, booking identifiers, and appointment notes needed for the requested action.
• Receptionist information: when configured, caller contact details, call metadata, summaries, transcripts, recordings, and workflow results. Recording and transcription availability depends on the client's setup.
• Service and security records: technical request information, errors, sign-in activity, and audit records of relevant changes and agency credential access.
• Billing information: agreed pricing, usage, invoices, subscription status, and payment references when billing is enabled. Card information is entered through the payment provider's hosted interface, rather than a portal form that stores full card numbers.

Please do not put account passwords, API keys, or private login links in business-description or FAQ fields. Use the designated secure integration flow. Avoid unnecessary medical, financial, identity, or other sensitive customer information.

3. How we use information

We use information to operate accounts; prepare and maintain the receptionist according to your instructions; answer configured questions; carry out authorized booking and CRM actions; provide support; send service notifications; manage billing when enabled; and investigate security issues. We may research your public website and business listing to produce a draft for you to check and correct.

Business briefs and approved instructions may be processed with AI tools during agency-led preparation and service operation. Public website/listing research can be sent to OpenAI. AI drafts may contain mistakes and should be reviewed before use. Authorization tokens and API secrets are not business knowledgebase content and must not be pasted into AI prompts.

4. Google and Microsoft connections

Connecting an account is optional and grants only the permissions presented in that provider's consent screen. It does not give EveryRing your Google or Microsoft password, ownership of the account, or unrestricted access to unrelated products.

For direct calendar scheduling, EveryRing uses authorized calendar-list information to let you choose a calendar, availability information to check times, and event permissions to create, update, reschedule, or cancel appointments. Event information can include dates, titles, descriptions, and attendee details. Provider permissions may cover more calendars than the target you select; EveryRing's scheduling workflow uses the selected staff/resource mapping.

A separate Google Sheets connection requests spreadsheet access for a configured spreadsheet workflow. Calendar authorization does not itself grant spreadsheet, Gmail, Drive, or CRM access. Additional connections require their own applicable permissions.

We store encrypted authorization tokens and connection metadata to perform authorized actions without asking you to sign in for every call. Necessary appointment details are exchanged with the scheduling provider and participants as part of booking. Google-sourced availability and event information is used for the requested scheduling function, not as general business knowledge or general-purpose AI training material. Authorized staff may access specific Google data with your affirmative permission for setup/support, or where necessary for security or legal obligations.

EveryRing's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data or use it for advertising, credit decisions, or general-purpose AI model training.

You can revoke access in Google Account third-party connections or the applicable Microsoft account or organization controls. Contact us to disconnect a portal integration or request deletion of its stored information. Removing a portal credential does not necessarily revoke the original provider permission or remove copies separately configured in another service. Revocation does not automatically delete appointments already created.

5. Service providers and sharing

We use service providers to deliver the features you enable. These include Netlify for the marketing website; Vercel for portal hosting and logo storage; Neon for the portal database; Resend for service email; OpenAI for AI-assisted research or preparation; Retell for configured voice-agent services; and Google, Microsoft, Cal.com, CRM providers, and Stripe where those integrations or payments are enabled. Each receives information necessary for its role. Their own policies also govern information they receive directly from you.

Cal.com or a native Retell integration may hold its own authorization independently of the EveryRing portal. A portal connection does not automatically authorize Retell, and disconnecting one service does not necessarily disconnect the other.

Authorized agency personnel access client information to deliver and support the service. The portal restricts client access to the relevant client account and records agency credential reveals. We may disclose information where required by law or necessary to protect security and legal rights. We do not sell personal information.

6. Security, retention, and deletion

The portal encrypts stored integration secrets and OAuth refresh tokens, uses authenticated access and client-scoped permissions, and records relevant administrative activity. Business answers are stored in the managed database; not every field is separately encrypted by the application. No system can guarantee absolute security.

We retain information as needed to provide services, support accounts, keep appropriate security and financial records, and meet legal obligations. Request correction, a copy, disconnection, or deletion by emailing everyringco@gmail.com. We may verify your identity and authority before acting. Some information may need to be retained for legal obligations, dispute resolution, or security; backup copies are handled under the applicable backup retention process. Deleting portal information does not automatically delete independent records held by a CRM, calendar provider, payment service, or the client business.

7. Cookies, international processing, and sensitive uses

The portal uses session cookies for sign-in and necessary functionality. Hosting and integrated providers may process technical information to deliver and secure their services. Information may be processed in countries where our service providers operate.

The portal is intended for business representatives, not for children to create accounts. Clients should not submit children's information or sensitive customer records unless necessary and covered by an appropriate service arrangement and lawful instructions. EveryRing's standard portal setup is not a representation of HIPAA compliance or suitability for regulated medical information. Recording, transcription, and sensitive-data workflows require appropriate notices, permissions, and service arrangements before activation.

8. Changes and questions

We may update this policy as our services change. The published policy will show its effective or updated date. Material changes to connected-account data uses will be communicated and additional consent requested where required. For privacy questions or requests, email everyringco@gmail.com.