Privacy Policy

1. Information we collect

From Google sign-in

Your name, email address and Google account identifier (scopes: openid, email, profile). We use them to create and secure your CallWarden account.

From your Google Ads account

When you connect Google Ads (scope: https://www.googleapis.com/auth/adwords), we read:

• Account details: customer IDs, account names, time zone and currency, and your Local Services and Performance Max campaigns’ names and status.
• Local Services leads: lead type, category, dates, charge and credit status, the caller’s phone number and extension as Google provides them, call durations and recording links, and message text (with phone numbers, emails, card numbers and addresses masked when we receive it).
• An encrypted refresh token so CallWarden can keep reading your leads. We don’t store Google access tokens.

Call recordings (only if you install the Chrome Audio Bridge)

The extension downloads recordings of your Local Services calls with your own Google sign-in and uploads them to our storage. We transcribe them, keep a masked transcript, and delete the audio 35 days after the call. The extension checks whether Chrome is signed in to Google by cookie names only; it never reads cookie values.

Information you give us

• Your mobile number for text alerts, with a record of your consent (time, IP address and the consent wording).
• Notification settings, a bookkeeper’s email address, and Slack, Microsoft Teams, Discord or ntfy alert channels (stored encrypted).
• Feedback you send about our AI’s decisions, and support messages.

Billing and usage

Stripe processes payments; we keep your Stripe customer ID, plan and subscription status, not card numbers. We log notifications we send and the cost of the services we use for your account.

Cookies and ad measurement

In the CallWarden app (app.callwarden.ai) we use only the cookies needed to sign you in: no advertising cookies and no third-party analytics. Our public website (callwarden.ai) uses Google Tag Manager, Google Analytics and Google Ads to understand how visitors find and use the site and which of our ads bring them, and those Google tags may set cookies. They run with analytics and advertising storage off for visitors in the European Economic Area, the UK and Switzerland, and for any browser that sends a Global Privacy Control signal. Data we receive through Google APIs is never used for this.

2. How we use information

Only to provide and improve the features you see in CallWarden:

• finding invalid leads (repeat callers, robocalls, sales pitches, wrong numbers) and rating them with Google for credit, with your approval unless you choose Autopilot;
• replying to message leads;
• detecting bot-call floods and pausing or resuming your Local Services campaigns when you’ve turned that on;
• alerts, reports, monthly statements, billing and support;
• keeping CallWarden secure and fixing problems.

3. Our commitments for Google user data

Data we receive through Google APIs (sign-in and Google Ads, including lead details and call recordings):

• is used only to provide or improve the user-facing features described above;
• is transferred to others only as needed to provide those features (the service providers in section 4), for security, to comply with the law, or as part of a merger or sale with your prior consent;
• is never sold, never used for advertising (including retargeting or interest-based ads), and never used to decide creditworthiness or for lending;
• is not read by people at CallWarden unless you ask us to (for example, for support), it’s needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations;
• is not used to develop, improve or train generalized AI or machine-learning models. Our AI providers process it only to return results to us: the transcription provider is opted out of model training, and the classification provider doesn’t train on API data.

4. Who we share information with

We don’t sell personal information. These service providers process data for us under contracts that limit them to providing their service:

• Google Cloud: Application hosting, database and backups (United States)
• Cloudflare: DNS, network protection, and storage of call recordings for up to 35 days
• Deepgram: Speech-to-text transcription of call recordings (opted out of model training)
• Anthropic: AI classification of masked call transcripts
• Twilio: Text-message alerts and replies
• Resend: Email alerts and statements
• Stripe: Subscription billing and payments

If you connect Slack, Microsoft Teams, Discord or ntfy, alerts (with caller numbers shortened to their last four digits) go to the channel you choose. We may also disclose information when the law requires it, or to protect the rights and safety of our customers and CallWarden.

5. Retention and deletion

• Raw call audio: deleted automatically 35 days after the call.
• Masked transcripts, lead records and credit history: kept while your account is active, so you can see your history and statements.
• When you disconnect Google Ads, we revoke our Google access immediately and stop reading your account. When you close your account or ask us to delete your data, we delete it within 30 days, except billing records we must keep for tax and accounting.

6. Security

We encrypt Google tokens and alert-channel secrets with AES-256-GCM, isolate each customer’s data with database row-level security, mask personal data before AI review, and block our own software from changing your budgets, bids or targeting. Details are on our Security page.

7. Your choices and rights

• Disconnect Google Ads in Settings, or remove CallWarden in your Google Account permissions.
• Change or turn off alerts in Settings. Reply STOP to any text to stop texts.
• Ask to access, correct, export or delete your information by emailing [contact email]. Depending on where you live, you may have additional rights under local law.

8. Children, location and changes

CallWarden is for businesses and isn’t meant for anyone under 18. We operate in the United States, and data is processed there. If we change this policy, we’ll post the new version here; before using Google user data in a new way, we’ll ask for your consent.

9. Contact

[Company legal name], [mailing address]. Email: [contact email].