Legal
Last updated 22 October 2026 · Gintii AI Inc., Ontario, Canada
PhonePick answers phone calls and text messages on behalf of businesses, and runs other parts of their front office: deposits, reminders, forms, a chat on their website, their receipts, and the calls they ask us to make. That means we handle recordings of conversations and the contact details of people who deal with those businesses. This page explains what we hold, why, and what we will never do with it.
Gintii AI Inc. ("we") operates PhonePick. A business that subscribes is our customer. A person who calls or texts that business is a caller. Someone who uses the business's website chat, fills in its intake form, pays it through a link we sent, or is on its invoice list is treated exactly like a caller. So is someone PhonePick calls for the business, someone who fills in the business's website form, and anyone on a call list the business adds. For all of their information, the subscribing business is the controller and we are its processor — we handle that data on their instructions, not for our own ends. For a health practice in Ontario, that makes us the practice's agent under the Personal Health Information Protection Act (PHIPA): we act only on its behalf. What changes for clinics and insurance offices is set out below.
| From customers | Name, business name, email, phone number, business hours and service details, billing information (held by Stripe, not by us). |
|---|---|
| From callers | Phone number, anything said during the call, an audio recording of the call, a written transcript and summary, and any name, email or address given during the conversation. Where the business takes reservations, the size of the party and any note the caller asked us to pass on in their own words — an allergy, an occasion, a high chair. |
| From text messages | The phone number, message content, delivery status, and whether that number has opted out. |
| Automatically | Call times and durations, message counts, and ordinary server logs. |
Each of these is off until a business switches it on. When one is on, this is what it holds and who else touches it. All of it is kept in the business's own account in our database (Google Cloud / Firebase), except where a row says otherwise.
| Deposits and invoice payments | The amount, what it was for, the payer's phone number and whether it was paid. The card is typed into Stripe's own payment page and the money goes straight to the business's own Stripe account, which the business connects itself. We never see a card number, and the assistant never asks for one. From the business's Stripe connection we keep its account ID and Stripe's status for it — whether it can take payments, and what Stripe still needs from it. The details Stripe asks for to verify a business are given to Stripe directly, not to us. |
|---|---|
| Invoices and reminders | What the business types in, imports or sends through the PhonePick API for each invoice: the customer's name, mobile number and email, the invoice number, what it was for, the amount and due date; the payments recorded against it; which reminders have been sent; and when the customer opened the invoice's page. Reminders go out by text through Twilio and link that page, which shows the invoice to whoever has the link. |
| Confirmation, waitlist and review texts | The texts sent and the replies. A reply of Y or N is recorded against the booking; anything else goes to the business's inbox. For the waitlist, the name, mobile number, the days the person asked for and any note they gave. For review requests, when each number was last asked, so no one is asked twice in 90 days. All of these are sent through Twilio. |
| Intake forms | The answers a customer types into the business's form, kept on their appointment for the business to read. The form is not offered to health businesses, because it is exactly where medical history would be typed. |
| Website chat | What the visitor types, what the assistant replied, and any name, phone number or email they leave with a message. Each message is sent to Anthropic to write the reply. To limit abuse we count messages per visitor under a keyed one-way hash of their internet (IP) address, never the address itself. The chat window keeps its own copy of the conversation in the visitor's browser tab until the tab is closed. It sets no cookies and loads no analytics. |
| Receipts (expenses by text) | Photos of receipts texted in from the owner's phone or a staff phone the business lists, or attached (a photo or a PDF) on the Expenses page, and what was read from them: the vendor, date, total, tax and any GST/HST number. A photo attached there is shrunk in the browser before it is sent; one attached and never saved with an expense is deleted after a day. A photo is shrunk, and its hidden data, including any GPS location it was taken at, is removed before it is kept; a PDF, or the rare photo that can't be opened, is kept as it arrived, so the receipt isn't lost. It is stored for that business in Google Cloud Storage, never public, and sent to Anthropic to be read. A texted photo that turns out not to be a receipt is deleted rather than kept. Texted photos arrive through Twilio as picture messages. |
| Your till (Clover or Square) | When a business connects its till, we read its item list so the assistant quotes the business's own prices: items, categories, modifier groups, prices, tax rates, what is out of stock, and the business's own name, address, hours and currency. When a caller places a phone order on a Clover till we write that order onto the till, with the items ordered, the caller's name, phone number and pickup time, and we add or cancel it if the caller changes their mind on the call. If the business has no record of that caller, we add one with their name and phone number so the order attaches to it. A Square connection is read-only: we read its items, stock and business profile and write nothing to it. We do not take payment through the till, and we ask for no payment permission on it. The key that lets us do any of this is encrypted before it is stored, is never shown in the app and never leaves our servers; disconnecting the till deletes it. The item list we already read stays, so the assistant can still answer, until the business deletes it. |
| On-call rota | The name and phone number of each person on it, and their shifts. |
| Morning brief and the "haven't been back" list | Nothing new is collected. Both are built from calls, bookings and customers the business already holds. The brief is sent to the business owner by text (Twilio), email (Resend) or both. |
A business with outbound calls can have PhonePick ring people for it: returning calls, reminding people about appointments, and on the Growth plan making sales calls to people who agreed to hear from it. Every one of these calls starts by saying it is an AI calling for that business. This is what they add.
| Outbound calls | The number called, the reason on record for calling it, the time and outcome of each try (reached, voicemail, no answer), and the transcript and summary of the conversation, with a recording of the call. Placed through Twilio; the conversation runs on ElevenLabs, and what is said is understood and answered by Anthropic's AI, as on the calls PhonePick answers. |
|---|---|
| Website forms and lead links | What the person types into the business's form (name, number, email, what they need), whether they ticked the box agreeing to be called, the exact wording beside that box and its version, and when. On PhonePick's own form we also keep the page it was on and the visitor's internet (IP) address and browser, as the evidence that they agreed. For leads a business sends us from its own form, we keep which tool sent them and the business's confirmation that its form shows our wording. |
| Call lists and their consent records | For each person on a list a business adds: their name, their number, and the consent record the business gives us — when they agreed, the words they agreed to, and where. Also the business's confirmation that everyone on the list agreed (the statement, who confirmed it and when), the list's name, what the calls are about, and how the calls went. Why: a sales call rests on that consent, so PhonePick refuses to call anyone without one, and the business can show it if asked. Who can read it: the business, signed in to its own account. These records are written only by our servers, so the business can read them but not change them: a consent record that can be rewritten afterwards proves nothing. Our staff look at them only to deal with a complaint, a carrier's request or a legal obligation. They are never used for any other business, never sold, and never used by us to contact anyone. |
| Do-not-call list | Numbers that asked not to be called — said on a call, or added by the business — with when and how. A business can add a number but cannot remove one. A number that replied STOP to a text is never called either. |
| Lead scores | On Growth, after a sales call, a score from 0 to 10, hot, warm or cold, and the next step in one line, written by the assistant (Anthropic) from what was said. They help the business decide who to ring first; we make no decision about anyone from them. A hot lead is sent to the business owner by email (Resend) and text (Twilio). |
If a business using PhonePick calls you and you don't want it to again, say so on the call. Your number goes on that business's do-not-call list there and then, and PhonePick won't call it for that business again.
Mobile phone numbers and SMS consent collected by PhonePick are not shared with, sold to, or rented to any third party for marketing purposes, and are not shared with any third party at all except the service providers listed below who are required to deliver the messages. Consent to receive text messages from a business is used only to send messages from that business.
Replying STOP to any message opts that number out immediately and permanently until it texts START. Replying HELP returns contact information. Message and data rates may apply. Message frequency varies.
We do not use call recordings, transcripts, chats, receipts, consent records or caller details for advertising, and we do not sell them. Callers' information is not used to train AI models: not by us, and not by ElevenLabs or Anthropic, whose AI handles the calls and chats. ElevenLabs' setting that would let it learn from calls is switched off.
PhonePick runs on a small number of service providers, each doing one job:
| Twilio | Carries the calls and text messages, including the calls placed for a business, and the confirmation, waitlist, review, intake-form, invoice-reminder and morning-brief texts, and the receipt photos texted in. |
|---|---|
| ElevenLabs | Runs the phone conversation itself: it turns what a caller says into text, speaks the replies in the voice the business picked, and passes the conversation to the AI model that decides what to say (Anthropic's Claude). It records every call and keeps the recording and transcript in its own systems as well as ours — except for a clinic or an insurance office, where its copy is deleted once the call has been written up. |
| Google Cloud / Firebase | Hosting, sign-in, the database, and storage for receipt photos. |
| Anthropic | Understands what a caller said and decides what to say back, on the calls PhonePick answers and the ones it places. It also writes the website chat's replies, scores sales calls and reads receipt photos. |
| Stripe | Takes subscription payments. Deposits and invoice payments are taken by Stripe on the business's own Stripe account, not ours. We never see full card numbers. |
| Clover | Only for a business that connects its Clover till. We read that business's own item list and prices from Clover, and send it the orders taken on the phone. Nothing about any other business is sent there. |
| Square | Only for a business that connects its Square account. We read that business's own item list, prices and what is sold out from Square. We send nothing to Square. |
| Systems a business connects | Only when a business makes an API key, adds a webhook address or connects an AI assistant to its own account: that business's customers, invoices and payments go to the system it chose, at its direction. The business chooses those systems, not us. |
| Resend | Sends the notification emails, including messages taken in the website chat and the morning brief. |
| Google Analytics | Counts visits to the public website only. It is not loaded on any signed-in page, so it never sees a call, a caller or a customer's data. |
We do not sell personal information to anyone, and we do not share it beyond the providers above except where the law requires it.
A business's records in PhonePick — its calls, transcripts and summaries, texts, chats, leads, customers, appointments, invoices, receipt photos and settings — are stored in Canada, in Google Cloud's Toronto region, and so are our service logs.
Some of the work happens in the United States: signing in (Firebase Authentication, run by Google there); the software that runs PhonePick, which reads and writes the records in Toronto as it works; and the providers above that carry and understand calls, texts and chats — Twilio, ElevenLabs and Anthropic — as well as Stripe and Resend. As set out above, ElevenLabs also keeps its own copy of calls, except for a clinic or an insurance office. While information is in the United States it is protected by our contracts with those providers, and it may be accessible to courts, law enforcement and national-security authorities there under the laws there.
The public pages of phonepick.ai — the home page, the pages for each trade, the FAQ and this one — load Google Analytics, so we can see which pages people read and which ones bring us customers. It sets cookies and records the page address, the referring site, and rough location and device information.
It is not loaded anywhere behind the login. Not the call log, the leads, the inbox, the appointments, the calendar, the reports, the invoices, the expenses, the settings or the billing page. Those addresses carry identifiers belonging to a customer's own calls, and none of that reaches Google. Nor is it loaded on the pages a business's own customers see: the website chat window, intake forms and the page a payment returns to. The sign-in page itself is the one exception, because that is where we count how many people start an account, and its address says nothing about anyone.
If you are in the EU, the UK or Quebec we ask first. Analytics starts switched off for you and the Google tag is not even fetched until you say yes, so no cookie is set and nothing is sent before you choose. Everywhere else it runs on arrival, because those jurisdictions do not require opt-in for analytics. Advertising signals stay switched off for everyone — we run no ad tracking of any kind.
Whatever you chose, you can change your mind here. To opt out everywhere, Google publishes a browser add-on at tools.google.com/dlpage/gaoptout, and most browsers can block analytics cookies directly.
Every call is recorded, and the caller is told so at the start of the call, every time, and that announcement cannot be disabled. Some places require every party to agree before a call is recorded; the business is responsible for knowing the rule where it operates.
Recordings and transcripts are held by us and by ElevenLabs, the voice platform that answers the call, and the conversation is shared with Anthropic, whose AI understands it. A business can ask us to delete a recording at any time. For a clinic or an insurance office no audio is kept at all; see below.
When a business tells us it is a clinic or health practice, or an insurance broker or agency, its callers' information gets more protection, because health and financial details are among the most sensitive there are. Even the fact that someone rang a clinic is health information.
| Told, and given a choice | Every caller hears that the call is answered by an AI and recorded, and is offered a person instead. |
|---|---|
| Asked for as little as possible | The assistant takes who is calling, how to reach them, and what they need in their own words. It does not ask about symptoms, conditions, medications, policy numbers or dates of birth, and it gives no medical or insurance advice. |
| No call audio kept | Once a call has been written up, the voice platform's copy is deleted. The written transcript and summary stay in the business's own account. |
| Nothing about a caller in alerts | Emails and texts to the business's staff say only that a call or message arrived, with a link into the signed-in app. A calendar the business subscribes to shows appointment times, not who is coming. |
| Texts to callers | Appointment confirmations and reminders carry the business's name, the date and the time, and nothing about why someone is coming. Follow-up messages are never sent automatically: staff read each one and choose to send it. |
| Two-step sign-in | Everyone who signs in to the account needs the code from an authenticator app as well as a password, and its records cannot be opened without it. |
The clinic or insurance office stays responsible for its records and for telling its patients or clients how they are handled. Write to support@phonepick.ai for details of these safeguards.
Call records, transcripts and messages stay for as long as the account is open, because they are the record of what was said to that business's customers. Invoices, website chats, receipts and waitlist entries are kept until the business deletes them; deleting an expense deletes its photo too. Intake-form answers stay on their appointment for as long as the account is open, and a business can ask us to delete them sooner. Deposit and payment records stay for as long as the account is open, because they are the record of money that changed hands. Consent records, the do-not-call list and the record of each call PhonePick placed also stay for as long as the account is open, because they are the evidence for each call; a business cannot delete them. The item list read from a connected till is kept until the business reads it again, deletes it, or closes the account; the key that reaches the till is deleted the moment the till is disconnected. Close an account and we delete its data within 90 days, other than what we must keep for tax or legal reasons.
Depending on where you live you may ask for a copy of your information, ask us to correct it, or ask us to delete it. Callers should contact the business they rang, since it is their record; if you cannot reach them, write to us and we will help. The same goes for a call you received, or a list you were on. Email support@phonepick.ai.
Data is encrypted in transit and at rest, access is limited to people who need it, and every message and call record is written by our servers rather than by a browser. Any account can turn on two-step sign-in, and clinics and insurance offices must. No system is perfect, and we will tell affected customers promptly if something goes wrong.
PhonePick is a tool for businesses and is not directed at children under 13.
If we change this policy materially we will email account holders before it takes effect.
Gintii AI Inc., Ontario, Canada · support@phonepick.ai
PhonePick