AcqoraGX · Legal
Privacy Policy
This Privacy Policy explains how the company operating AcqoraGX ("AcqoraGX", "we", "us") collects, uses and shares personal information in connection with the AcqoraGX CRM and dialer, our websites and related services (the "Service"). The Service is for businesses; it is not directed to consumers or children.
1. Our role
- We are the controller (the "business") for information about our customers' account holders and users: account, billing, support, security and usage information, and visitors to our websites.
- We are a processor (a "service provider") for personal information our customers store in the Service about the people they work with, such as property owners, sellers and leads, including contact details, notes, call recordings and messages. Our customers decide how that information is collected and used, and our Data Processing Addendum governs it. If you were contacted by one of our customers and have a question or request, please contact that business directly. If you contact us, we'll pass your request to the customer where we can identify it.
2. Information we collect
2.1 Information you give us
- Account information: name, work email, company name, password (we store only a salted Argon2 hash), role, team invitations.
- Billing information: plan, seats, invoices and payment status. Payments are processed by Stripe; we don't receive or store full card numbers.
- Identity verification: if a Workspace owner verifies their identity, Stripe Identity collects the ID document and selfie. We receive the verification status and, where available, the verified first and last name. We don't receive document images, document numbers or date of birth.
- Integration credentials: API keys, tokens and account identifiers for services you connect (for example your carrier or AI provider). They are encrypted at rest, never shown again after you save them, and never used for anything except the features you use.
- Support and communications: messages you send us and survey responses.
2.2 Information collected automatically
- Usage and device information: IP address, browser user agent, pages and features used, timestamps, session identifiers and error logs.
- Telephony and messaging metadata: numbers called or texted, times, durations, call outcomes and delivery status, used to run and bill the Service.
- Security records: sign-in successes and failures, lockouts, password changes and similar events (see Section 9).
- Cookies and local storage: only what's needed to sign you in and protect forms, plus local storage the app uses on your device. See the Cookie Notice.
2.3 Customer Data
Contacts, leads, property details, notes, files, call recordings, message content, skip-trace results and AI requests and answers that our customers and their users put into the Service. We process this on our customers' behalf (Section 1).
2.4 Information from third parties
Payment and verification status from Stripe; account details from providers you connect (for example the email address of a connected calendar); and data our customers request from skip-trace or do-not-call data providers.
3. How we use information
- To provide, operate and support the Service, including calling, texting, recording, AI features and integrations you turn on.
- To create and secure accounts: verifying emails, preventing fraud and abuse, detecting suspicious sign-ins, enforcing our Acceptable Use Policy and responding to carrier and law-enforcement traceback requests.
- To bill and collect Fees, including metered usage.
- To communicate with you about your account, security, changes to our terms, and (where permitted, with an unsubscribe link) product news.
- To improve the Service, including the learning program described in Section 5.
- To comply with law, keep records of legal acceptances, and establish or defend legal claims.
4. Legal bases (where applicable)
The Service is intended for businesses in the United States. If laws such as the EU or UK GDPR apply to our processing of your information, we rely on: performance of our contract with you or your organization; our legitimate interests in operating, securing and improving the Service (balanced against your rights); compliance with legal obligations; and your consent where we ask for it (you can withdraw consent at any time).
5. AI features and the learning program
AI features send the request you make (for example a call transcript to summarize) to the AI provider your Workspace connected, or to a model we provide. That provider processes it under its own terms. Unless the Workspace owner turns it off in Integrations → AI, we capture AI requests and answers (masked for personal details by default), feedback and approved knowledge to evaluate and train AcqoraGX models. Model training and evaluation run on processing nodes operated by AcqoraGX or its service providers, which receive only the training dataset. We don't use contact lists, recordings or messages for training. The full description is in How AcqoraGX uses AI data.
6. How we share information
- Service providers (subprocessors) that host, process payments, verify identity, deliver email and provide data services for us, under contracts that limit their use of the information. The current list is on our Subprocessors page.
- Providers you choose. When you connect a carrier, AI provider, calendar, email, e-signature or storage account, we send it the information needed to do what you ask. Their use is governed by your agreement with them.
- Within your organization. Workspace owners and administrators can see your profile, role, activity and records in their Workspace.
- Legal and safety. When we believe in good faith it's required by law or legal process, or needed to protect the rights, safety or property of anyone, including responding to carrier and Industry Traceback Group requests about unlawful calls.
- Business transfers. In a merger, acquisition, financing or sale of assets, subject to this policy.
- With your consent or at your direction.
We don't sell personal information, and we don't "share" it for cross-context behavioral advertising as those terms are defined in California law. We don't use advertising cookies.
7. Retention
| Information | How long we keep it |
|---|---|
| Account and profile information | While the account exists, then deleted or de-identified within 90 days of deletion (except as below). |
| Customer Data | As the customer decides during the subscription; deleted or de-identified within 90 days after the 30-day export window that follows termination. |
| Call recordings | Per the Workspace's retention setting (730 days by default), unless the customer deletes them sooner. |
| AI learning examples | Up to two years, then deleted. See the AI data notice for datasets and models. |
| Billing, invoices and tax records | As long as required by tax and accounting law (generally up to 7 years). |
| Records of accepting our terms | For the life of the account and the period in which claims can be brought (generally up to 6 years after it ends). |
| Account security records (Section 9) | Kept permanently to preserve integrity, but made unlinkable to you when your account is deleted. |
| Server logs | Typically 30 days, longer when needed to investigate a security incident. |
| Backups | Overwritten on a rolling schedule set by our hosting provider. |
8. Security
We use administrative, technical and physical safeguards appropriate to the information we handle, including TLS in transit, salted Argon2 password hashing, encryption of stored provider credentials, per-session CSRF protection, rate limiting and lockouts, role-based access, signature validation on carrier and payment webhooks, and audit logs of staff actions. No system is perfectly secure. If we learn of a security incident affecting your personal information, we'll notify you as required by law.
9. Account security records and portable account identity
We keep an append-only, tamper-evident record of security-relevant account events, such as account creation, email verification, sign-ins and failed sign-in attempts (summarized, not one entry per attempt), password changes and resets, sign-outs, role and membership changes, API-key and integration changes, identity verification results, acceptances of our terms, and data export or deletion requests. Each record is linked to a random identifier rather than your name or email, contains no passwords, keys or message content, and refers to things like your email address only through a salted hash. Each record is signed by us so that later changes can be detected.
Each account also has a cryptographic account identity (a public key and an identifier in the "did:key" format) that we generate and hold for you in encrypted form today. You can see your record and identity in the app or through our API. When your account is deleted, we delete the secret value used to create those salted hashes and the private key, and we remove the link between the identifier and your account. The records remain only as unlinkable integrity data.
10. Your rights and choices
- Access, correction, deletion and export. You can update your profile and email in your account settings. You can ask us for a copy of your personal information, to correct it, or to delete it, by using the data-request option in the app or by emailing [LEGAL_CONTACT_EMAIL not set].
- Marketing. Every marketing email has an unsubscribe link. Account and security emails can't be turned off while you have an account.
- Learning program. Workspace owners can turn it off in Integrations → AI.
- Customer Data. Requests about information a customer stores in the Service should go to that customer. We'll help them respond.
10.1 U.S. state privacy rights
Depending on where you live (for example California, under the CCPA as amended by the CPRA, and other states with comprehensive privacy laws), you may have the right to: know what personal information we collect, use and disclose and to receive a copy; correct inaccurate information; delete information; opt out of the sale or sharing of personal information and of targeted advertising (we don't do either); limit the use of sensitive personal information (we use account login credentials only to provide and secure the Service); and not be discriminated against for exercising your rights.
In the past 12 months we collected these categories of personal information for the purposes in Section 3 and disclosed them to the recipients in Section 6: identifiers (name, email, IP address, account identifiers); commercial information (plan, purchases, invoices); internet or network activity (usage and log data); professional information (company and role); sensitive personal information limited to account login credentials and, for owners who verify identity, a verification result from Stripe; and audio and electronic information in call recordings and messages processed on our customers' behalf.
To make a request, email [LEGAL_CONTACT_EMAIL not set] or use the data-request option in the app. We'll verify your request by confirming control of the account email. You may use an authorized agent; we may ask for proof of the agent's authority. If we deny your request you may appeal by replying to our decision, and we'll respond within the time the law requires.
11. Children
The Service is for businesses and users aged 18 or older. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we'll delete it.
12. International transfers
We and our service providers store and process information in the United States. If you use the Service from outside the United States, your information will be transferred to the United States, where privacy laws may differ from those in your country. Where required, we use appropriate safeguards for such transfers.
13. Changes to this policy
We'll post updates here with a new version number and date. For material changes we'll notify Workspace owners by email or in the Service before they take effect.
14. Contact
the company operating AcqoraGX
30 N Gould St, Suite 635, Sheridan, WY 82801
Email: [LEGAL_CONTACT_EMAIL not set]