What we collect, why, and how we keep it safe.

Plain-English summary

Who we are

Ahoy ("we", "our", "us") provides AI receptionist software to service businesses. We are based in Victoria, British Columbia, Canada. This policy applies to data collected through hireahoy.com and through our products.

What data we collect

From the website

• Contact form: business name, your name, email or phone, business type, any message you provide.
• Server logs: IP address, user-agent, timestamp — retained for 30 days for security purposes only.
• No analytics or tracking: we do not use Google Analytics, Facebook Pixel, advertising cookies, or any third-party trackers. Period.

From customers using Ahoy

• Phone call audio and transcripts (configurable retention; default 30 days)
• Booking data we pass through to your calendar system
• System logs and usage metrics (anonymised)

Why we collect it

• To respond to your enquiry
• To configure, operate, and support your AI receptionist
• To improve service quality through review of anonymised usage patterns
• To comply with legal obligations (anti-spam laws, tax, etc.)

Where it's stored, who has access

• Contact form submissions: processed by Resend (email delivery, US/EU regions, SOC 2 Type II) and forwarded to our internal address. Not stored long-term elsewhere.
• Call audio and transcripts: processed by Retell AI on SOC 2-aligned infrastructure (US or EU region depending on customer location). Encrypted in transit and at rest.
• Telephony: Twilio (carrier-grade, SOC 2 Type II, ISO 27001).
• Calendar integration: data passed directly between your AI receptionist and your calendar (Google Calendar, Outlook, Square, Jane App, etc.). We do not retain a separate copy.

Only authorised members of the Ahoy team and the service providers above have access to your data, under data-processing agreements that mirror your rights.

What we do not do

• We do not sell your data.
• We do not use customer call data to train external models (OpenAI, Anthropic, ElevenLabs, etc.).
• We do not use third-party advertising or analytics trackers on hireahoy.com.
• We do not transfer data outside the regions you select without explicit consent.

Your rights

Depending on where you live, applicable laws include the EU/UK GDPR, the California CCPA / CPRA, Canada's PIPEDA, the Australian Privacy Act, and equivalent regional regulations. You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data ("right to erasure")
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any right, email privacy@hireahoy.com. We respond within 30 days. We do not charge for these requests.

Data retention

• Contact form submissions: retained for 30 days unless we're actively in conversation; then for the duration of that conversation plus 30 days.
• Active customer call audio and transcripts: as configured by the customer; default 30 days.
• Server logs: 30 days.
• Anonymised aggregates: retained indefinitely for service-quality analysis.

Cookies

hireahoy.com uses no cookies for tracking or advertising. We may use a single first-party cookie or localStorage entry to remember your language preference (EN/FR). You can clear this any time via your browser settings.

Children

Ahoy is a B2B product not intended for individuals under 16. We do not knowingly collect data from minors. If you believe we have, contact us and we'll delete it.

International transfers

Where your data crosses borders (e.g., processing in US-East infrastructure for a Canadian customer), we rely on Standard Contractual Clauses (SCCs) and the receiving party's certifications. EU/UK customers can request EU-region-only processing.

Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the most recent change. Material changes will be emailed to active customers at least 30 days before they take effect.