Privacy Policy

Last updated: October 28, 2026

Callnic is a virtual receptionist for small service businesses in the United States. It answers phone calls, replies to text messages (SMS), Facebook Messenger and Instagram Direct messages, books appointments, and sends the business owner a summary of each conversation on WhatsApp. Callnic is a product of Engage.

This policy explains what data we process, why, who we share it with, how long we keep it and how to request deletion. It applies to the website, the customer dashboard and every service channel.

1. Whose data we process

• Subscribers: the businesses and professionals who sign up for Callnic and use the dashboard.
• Customers served: people who call, text, or message a subscribing business on Messenger or Instagram. For this data, the subscribing business is the controller and Callnic processes it on the business's behalf.

2. Data we collect

From subscribers

• Name, email, password (stored only as a one-way cryptographic hash), WhatsApp number and a cell number for call transfers.
• Business details: name, type of business, address, service area, services, prices, hours and policies.
• Subscription data: plan, payment status and Stripe identifiers. Card data is collected and stored by Stripe; Callnic never has access to it.
• If the subscriber connects Facebook and Instagram: the Page name and ID, the username of the linked Instagram account, and the Page access token, stored encrypted.

From customers served

• Calls: the caller's phone number, date, duration and a text transcript of the conversation. Speech is converted to text in real time; Callnic does not store call audio.
• SMS: phone number and message content.
• Messenger and Instagram: the ID Meta assigns to the person for that Page, the public profile name, and the content of messages exchanged with the Page.
• Whatever the person shares during the conversation: name, address, requested service, appointment date and time, and notes.

From the website

• Your chosen language and a draft of the sign-up form, stored only in your browser.
• First-party visit measurement: a random identifier stored in your browser, the pages viewed, language, device type, where the visit came from (referring site and campaign parameters such as utm_campaign), and the approximate city, state, and country, derived from the IP address at the time of the visit. The IP address is not stored, and the measurement does not include your name or email; and is used to understand how many people visit the site and which campaigns bring customers.
• Advertising cookies (Meta and Google), only with your consent: if you accept in the cookie notice, the site loads the Meta Pixel and the Google Ads tag to measure which ads lead to sign-ups and subscriptions. If you decline, they are not loaded. When a subscription is paid, we also notify Meta through its Conversions API, sending email and phone in hashed (encrypted) form, so the sale is attributed to the right ad.
• Strictly necessary session cookies to keep you logged in to the dashboard.

3. How we use data

• To answer and reply to the subscribing business's customers, share the services and prices the business entered, and book appointments.
• To create a summary of each conversation and send it to the business owner on WhatsApp, in the language they chose.
• To show calls, conversations, appointments and contacts in the business's dashboard and let the owner reply.
• To bill the subscription, track plan limits and warn the business when they are running out.
• To keep the platform secure, prevent abuse and meet legal obligations.

The assistant identifies itself as the business's virtual assistant. Replies are generated by artificial intelligence based only on the information the business entered.

4. Facebook and Instagram data

When a subscriber connects their Page, we request from Meta only the permissions needed to receive and reply to messages sent to that Page and to the Instagram account linked to it. This data:

• is used exclusively to reply to messages received by the Page and to show the conversation to the owner in the dashboard;
• is never sold, rented, or used for advertising, profiling, or training artificial intelligence models;
• is not shared with third parties beyond the service providers listed in section 5, and only as needed to provide the service;
• stops being accessed as soon as the subscriber disconnects the Page in the dashboard, and can be deleted at any time (see section 8).

Messages are only answered within Meta's rules, including the 24-hour window after the person's last message.

5. Who we share data with

We share data only with service providers that operate the platform, under contract and only as needed for each function:

We may also disclose data when required by law or by order of a competent authority. We never sell personal data.

6. How long we keep data

• Conversations, transcripts, appointments and contacts stay available while the subscription is active, so the business can review its history.
• After cancellation, the US phone number is released within 7 days and the account data is deleted within 90 days, unless we must keep it to meet legal or tax obligations or to defend legal claims.
• Deletion requests are completed within 30 days.

7. Security

• All traffic uses encrypted connections (HTTPS).
• Passwords are stored with a cryptographic hash (scrypt), never in plain text.
• Facebook and Instagram access tokens are stored encrypted (AES-256).
• Each business sees only its own data in the dashboard. Internal access is limited to Engage staff with individual accounts.
• Webhooks from Twilio, Stripe and Meta have their signatures verified before any processing.

8. Your rights and how to request deletion

You can request access, correction, portability or deletion of your data, and information about how it is processed. These rights apply under applicable law, including US state privacy laws such as California's CCPA/CPRA and Brazil's LGPD.

• Subscribers can correct data under Settings in the dashboard, disconnect Facebook and Instagram at any time, and request account deletion.
• Customers served can request deletion of the conversations and data they shared with a subscribing business.

To make a request, use the Data deletion page. You will get a code to track your request. If you logged in with Facebook and removed Callnic in your Facebook settings, the deletion request reaches us automatically.

9. Children

Callnic is intended for businesses and is not directed to children under 13. If we learn we hold a child's data, we will delete it.

10. International transfers

Data is processed in the United States and in other countries where our providers operate, with the contractual safeguards required by applicable law.

11. Changes to this policy

We may update this policy. The date at the top shows the version in effect. Material changes will be announced to subscribers in the dashboard or on WhatsApp.

12. Contact

Questions about privacy or this policy: contact Engage on WhatsApp at +55 83 95278-6345 or through the Data deletion page.