Privacy Policy

What we collect

We collect account and business details, such as your name, work email, company, invitations, and workspace membership If you request a trial or contact support, we receive the information you provide

Signup uses email and password through our authentication provider Your saved business setup can include a description of your business, priorities, customer scenarios, caller briefs, questions and evaluation criteria Authorized operators can review that setup to coordinate your pilot

We also save your business profile, optional website address, approved destinations and calling schedules, trial dates and usage Website addresses are not currently fetched or analyzed

For call tests, we collect phone numbers, location or department names, approval details, caller instructions, customer scenarios, questions, and evaluation criteria

Calls can generate recordings, transcripts, call times and outcomes, scores, supporting excerpts, reports, and operator review notes, where applicable Information someone shares during a call may appear in the transcript or report

For abuse protection, the trial form creates a keyed identifier from an IP address when a trusted address is available The app stores that identifier with the request Hosting and service providers may also process technical request information

How we use it

We use this information to place company-approved test calls, evaluate responses against the business’s criteria, generate reports, and track performance over time

We also use it to manage accounts and invitations, respond to trial requests, provide support, prevent abuse, and troubleshoot the service.

Who sees it

Authorized users within the customer’s business can access their workspace’s scenarios and results MysteryShopper AI operators can access customer records to onboard businesses, run tests, provide support, and review evaluations Trial requests go to the operator inbox

We share information with the service providers needed for the features being used These include Supabase for accounts and database storage, Retell for voice AI, transcription, and call analysis, and hosting and email providers Some grading workflows also use OpenAI.

Providers receive information needed for their part of the service Their own terms, data controls, and retention settings also apply

AI processing and call recordings

For a live call, Retell receives the approved phone number and the shopper’s scenario, questions, and instructions The scorecard is sent separately for post-call analysis Call audio is processed to run the conversation and produce a transcript and evaluation

Recording retention is off by default In that mode, the app requests Retell’s basic-attributes-only storage setting and discards temporary recording links This does not mean call audio is never processed or temporarily recorded by the provider Transcripts and results received by our app can still be saved in the workspace

When recording retention is enabled for an approved line, the setup requires an approved opening disclosure The app requests seven days of Retell storage and signed recording links Authorized workspace users and operators can play an available recording through a protected route The app stores a recording reference rather than a separate audio file in its database

For the optional OpenAI grading workflow, the app sends transcript text and the saved rubric It requests that the response not be stored through the API’s response-storage option That setting does not determine all provider logging, retention, or training practices

When business suggestions are enabled, OpenAI receives the business description to suggest an editable profile The app also requests response storage to be disabled for that operation Review suggestions before using them

AI evaluations can be wrong Operators can correct a result with a reason; the original grade and review history are retained with the report Simulated calls use fixtures rather than dialing a business

Cookies

The app uses cookies to keep you signed in and refresh your Supabase session Private trial links also use a seven-day access cookie and a short-lived cookie to return you to the trial after email sign-in

The website code does not currently include an analytics SDK, advertising tracker, or marketing cookie tool Hosting services and external services you open may have their own technical logs and cookies.

You can manage cookies in your browser Blocking account or trial cookies may prevent those features from working

Deleting your data

Use our Contact page to request deletion of an account, trial request, or call data Tell us which business or account the request concerns We may need to verify your identity and authority to request removal of business records

Workspace transcripts and reports do not currently expire automatically Deletion is handled by an operator Removing a live call from our database and removing its provider copy are separate steps

Provider logs, backups, and any separately authorized exports may remain subject to their own retention settings Some records may need to be kept to meet an applicable legal or accounting obligation We will explain any known limits that affect your request rather than promise an immediate deletion from every system

Changes

Updates to this policy will be posted on this page with a new “Last updated” date Please check this page when you want to see the current policy

Questions

If you have a question about this policy or how your information is handled, please contact us.