Privacy Policy

Account information is about the people who use ACP: you and your team. We decide how it’s used, as this policy describes.

Client data is what our clients store in ACP about their own business and contacts: leads, calls, texts, emails, appointments and the rest. We handle it on the client’s behalf and follow their instructions.

If you’re a contact of one of our clients, for example you filled out a form on a company’s website, that company decides how your information is used. Contact them first. If you contact us instead, we’ll pass your request to them.

• Your name, email address, company and role, and, if added, your mobile number and the phone number ACP rings for your calls.
• Your password, stored only in scrambled (hashed) form. No one at ACP can see it.
• Your time zone, your settings, and drafts you haven’t sent yet.
• Sign-in records: when you sign in or try to, from which IP address, and whether it worked. When your password changes, we also record your IP address and browser.
• A history of changes made in ACP, such as who edited or deleted a lead, and when.
• Error and performance reports from your browser, so we can fix problems.
• Your messages to us.

Depending on the features a client uses, ACP stores:

• Leads: names, phone numbers, email addresses, companies, form answers, notes, stage, and where each lead came from, including ad details.
• Consent and opt-outs: when and how a person agreed to be contacted, the wording they saw, their IP address and browser, and any unsubscribe, STOP reply or do-not-call request.
• Calls: phone numbers, times, recordings, transcripts, and AI-written summaries and labels.
• Texts and emails: messages sent and received, attachments, and whether an email was opened or a link in it clicked.
• Appointments and meetings: bookings, meeting recordings and transcripts.
• Payments: payment records a client’s payment provider sends us.
• Website visits: when a client’s website reports visits to ACP, the pages viewed, the referring page and ad tags, the IP address and the approximate location worked out from it, and device and browser details.

Approximate locations are worked out on our own servers from phone numbers and IP addresses. No IP address is sent to an outside location service.

• To run ACP: sign you in, store client data, place and record calls, send texts and emails, and keep calendars in step.
• To set things up and give support when a client asks.
• To keep ACP secure, for example by limiting repeated sign-in attempts and looking into misuse.
• To find and fix problems and improve ACP.
• To send account emails, such as invites, password resets and security notices.
• To follow the law.

We don’t sell personal information, show ads in ACP, or use client data for our own marketing.

A client can connect a Google account to ACP. ACP then asks Google for permission to:

• See and edit their calendar, to add, move and cancel appointments and keep them in step with ACP;
• Send email from their Gmail, for meeting links and emails written in ACP;
• Read their Gmail, to show emails to and from their leads on each lead’s page;
• See their name and email address, to show which account is connected.

ACP checks for new mail every minute. When first connected, it also looks back 30 days. It saves only messages to or from one of the client’s leads: who sent and received each one, the subject, the text and the names of any attachments. Other mail isn’t saved. ACP fetches an attachment from Gmail only when someone opens it.

How Google data is used and shared

• It’s used only to provide the features above to the client.
• People on the client’s team see saved emails and appointments in ACP.
• We don’t sell Google data, use it for ads, or use it to develop, improve or train generalized AI or machine learning models.
• Our staff don’t read Google data unless the client asks us to for support, it’s needed for security or to investigate abuse, or the law requires it.

ACP’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A client can disconnect Google in ACP at any time, or remove ACP’s access at myaccount.google.com/permissions. Disconnecting stops new syncing. To delete emails ACP has already saved, email support@acp.cx.

ACP uses AI services from other companies:

• Transcription. Call and meeting audio is sent to Deepgram, which turns it into text. We tell Deepgram not to keep it to improve its models.
• Call labels. A call’s transcript, the lead’s name and the call length are sent to the AI provider the client picks, Anthropic or OpenAI, to label how the call went.
• AI voice calls. Retell AI runs AI phone calls. It receives the call audio and the lead details the client’s AI agent uses, such as name and appointment time.

We don’t use client data to train AI models.

ACP only sets the cookies it needs:

ACP also keeps a few settings and recent alerts in your browser’s storage. There are no advertising or analytics trackers in ACP. ACP’s phone connects to Twilio to place and take calls.

We share information only with companies that help us run ACP, and only what each needs to do its job:

Many of these are connected with the client’s own account, such as their own Twilio, Retell or Stripe account. Then the client’s agreement with that provider applies too.

Within a client’s account, team members see the data their role allows. Our staff can access accounts to set them up, give support and keep ACP secure. When a client sends leads to another business, such as a lead buyer, those leads go to that business.

We may also disclose information when the law requires it, to protect our rights or someone’s safety, or as part of a merger or sale of our business. We don’t sell personal information.

• Client data: while the client’s account is open, unless the client deletes it sooner. Deleting a lead removes it from ACP right away. To remove its call recordings from our servers too, email us.
• Closed accounts: we keep the data for 30 days so the client can ask for a copy, then delete it.
• Account information: while your account is open, and after that only as long as we need it for security, legal and audit records.
• Sign-in and error logs: 7 days.
• Backups: encrypted, and cleared within 12 months.

We may keep some records longer where the law requires it.

• Encrypted connections (HTTPS) for everything.
• Passwords stored only as bcrypt hashes.
• Keys and sign-in tokens for connected services, including Google’s, encrypted in our database.
• Sign-in limits that block repeated guessing.
• Sessions that end after 7 days, and right away when your password or role changes.
• Each client’s data kept separate from every other client’s.
• Encrypted nightly backups, stored away from our servers.
• Access to data limited to the people who need it.

No system is perfectly secure. If a breach affects your information, we’ll tell you, and the client it affects, as the law requires.

You can change your password and settings in ACP. To see, correct or delete other information about you, or to withdraw your consent, email support@acp.cx. We’ll reply within 30 days and may ask you to confirm who you are first. We may need to keep some records, like consent and billing records, where the law requires it.

If your information is client data, we’ll pass your request to that client and help them answer it.

If you’re in Canada and aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

We’re based in Canada. Our servers and service providers store and process information in other countries, including the United States, where courts, law enforcement and national security authorities may be able to access it under local law.

ACP is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect information from children.

If we change this policy, we’ll post the new version here with a new effective date. If a change is significant, we’ll email account admins before it takes effect.

Questions about this policy or your information: HS Ventures Inc. (ACP), Ontario, Canada, support@acp.cx.