Privacy Policy

This Privacy Policy explains how AVEGANDO AI LABS LLC, a Wyoming limited liability company, USA ("we", "us"), collects, uses, stores and shares personal data when you use RingDeck at ringdeck.io and app.ringdeck.io (the "Service"), including AI phone and chat agents that our business customers configure. It applies worldwide and contains additional information for residents of the United States (including California), the United Arab Emirates and the Sultanate of Oman.

Contact for privacy requests and our data protection contact: support@ringdeck.io

1. Our role

• Controller: we decide how personal data of our business customers and their users (account holders, team members, website visitors) is processed.
• Processor / service provider: when a business uses RingDeck to answer calls or chats, we process the callers' data only on that business's behalf and instructions. That business is responsible for informing its callers, for any required consent and for lawful use. Please contact the business you called for requests about those conversations; we will support them.

2. Personal data we process

• Identifiers and account data: name, email address, password (stored only as a secure hash), workspace and team membership.
• Agent configuration: prompts, greetings, voice and model settings, knowledge base texts and files you upload.
• Conversation data: voice audio processed in real time to understand and answer, transcripts, call and chat metadata such as time, duration and phone numbers.
• Customer profiles: for returning callers and website visitors who share their phone number or email, the business's agents keep one profile per business – name, phone number or email, preferred language, interests, open requests and short summaries of earlier conversations – so that they can continue where the last conversation ended.
• Integration data: data from services you connect, for example Google (see section 6).
• Internet and device data: IP address, browser type and log data needed to run and secure the Service.
• Commercial and billing data: plan, usage and invoices; card details are handled by our payment provider.

We do not intentionally collect sensitive personal data. Business customers must not upload health, biometric or financial data into agents unless they have a legal basis and all required approvals.

3. Why we use it and on what basis

• To provide the Service and the agents you configure (contract; where local law requires, your consent).
• To secure the Service, prevent abuse, fix errors and keep backups (legitimate interests / legal obligations).
• To send transactional emails about your account, usage and security.
• To comply with legal obligations such as tax and accounting records.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use conversation or integration data to train AI models.

4. Service providers and international transfers

These are the providers we use, what each one does, and where it sits. Providers marked "only when connected" receive data solely after a workspace connects that service.

• Hetzner Online (Germany) – the servers this service runs on, and the database.
• Cloudflare (USA, EU) – network and security in front of our servers, and outgoing e-mail.
• Google (USA, EU) – Gemini language models, which write the agent's answers.
• OpenAI (USA) – language model and speech output, used as a fallback when Gemini is unavailable.
• Anthropic (USA) – language model, used as a second fallback.
• ElevenLabs (USA) – speech recognition and the agent's voice.
• LiveKit (USA, EU) – the real-time audio connection during a call.
• Twilio and Telnyx (USA) – telephone numbers and the phone network.
• Stripe (USA, Ireland) – subscription payments. Card data goes to Stripe directly, never through us.
• Mercury (USA) – our business banking, for invoices.
• Meta / WhatsApp Cloud API (USA, Ireland) – only when connected: WhatsApp conversations.
• Telegram – only when connected: Telegram conversations.
• Tavus (USA) – only when switched on: the video avatar for calls where the caller sees a picture.
• Google Workspace APIs – only when connected: calendar, spreadsheets and Gmail of that workspace.

All of them are bound by contracts that limit their use of the data. Your data may therefore be processed outside your country, including outside the UAE and Oman. Where the law of your country requires it, such transfers are based on appropriate safeguards (for example standard contractual clauses) or on your consent, which you give when you create an account and agree to this policy. We update this list when a provider changes.

5. Retention and deletion

These are the periods the service actually enforces, not intentions:

• Calls, transcripts and summaries: 24 months after the call, then deleted automatically.
• Website and WhatsApp conversations: 24 months after the last message, then deleted automatically.
• Customer profiles your agents build: 24 months after the last contact, or earlier when the business deletes them.
• Backups: 14 days, then overwritten.
• Knowledge files and agents: deleted from our servers as soon as you delete them.
• Invoices and accounting records: kept as long as tax law requires.

You can download everything your workspace holds at any time under Settings, and you can delete your account there as well. Deleting the account removes the workspace with its agents, calls, conversations, contacts and widgets. What we must keep by law stays, and nothing else.

6. Google user data

RingDeck offers an optional integration with Google. It is only active if a workspace owner or member clicks "Connect Google" in the app and grants access on Google's consent screen. This section describes exactly how RingDeck accesses, uses, stores, shares, protects and deletes Google user data.

6.1 Data accessed

• Basic profile (openid, userinfo.email, userinfo.profile): your Google account email address and name.
• Google Calendar events (calendar.events): start and end times, status and titles of events in your primary calendar within the time window being checked, and the details of appointments the app creates (title, time, description, invited guest email).
• Files you choose (drive.file): only the Google Sheets or Google Docs files you explicitly select in the Google file picker or that the app creates for you. The app has no access to any other file in your Google Drive.
• Sending email (gmail.send): the ability to send an email from your Gmail address. The app cannot read, search, list or delete messages in your mailbox.

6.2 How the data is used

• Email address and name are shown in the app so you can see which Google account is connected.
• Calendar data is used only to find free time slots and to create appointments when your AI agent books them for a caller or when you test this function.
• Selected spreadsheets are used only to add a row with the details your agent collected (for example name, phone number and request). Selected documents are used only as a source of information for your agent.
• Gmail is used only to send an email that your agent or you trigger, for example a booking confirmation.
• Google user data is used solely to provide these user-facing features in your workspace. It is not used for advertising, profiling, market research, or to develop, improve or train AI or machine learning models.

6.3 Sharing and transfer

• We do not sell Google user data and do not transfer it to data brokers, advertising platforms or information resellers.
• Google user data is not shared with other customers or other workspaces.
• When your agent answers a conversation, the minimum needed to formulate the answer (for example a list of free time slots) is processed by our AI language model provider as a sub-processor, only to generate that answer and not for training.
• We disclose data only if required by law or to protect the security of the Service.
• RingDeck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.4 Storage and protection

• We store only the OAuth tokens needed to act on your behalf, your Google email address and name, and the IDs of files you selected. Calendar events, spreadsheet contents, documents and emails are not copied into our database.
• OAuth tokens are encrypted with AES-256-GCM before they are stored on our servers in Germany. All connections to Google and to our app use TLS encryption.
• Access is limited to the workspace that connected Google; other customers cannot use or see the connection.

6.5 Retention and deletion

• Tokens and connection details are kept only while Google is connected.
• When you click "Disconnect" under Integrations, we revoke our access at Google and delete the stored tokens and connection details immediately. Actions using Google stop at once.
• You can also remove access at any time at myaccount.google.com/permissions; the app then stops working with your Google account.
• Appointments, rows or emails created in your Google account remain there under your control. When your RingDeck account is deleted, the Google connection is deleted as well. Encrypted backups containing tokens are overwritten within 14 days.
• To request deletion or ask questions about Google user data, contact support@ringdeck.io.

7. Security and incidents

Data is encrypted in transit (HTTPS/TLS), access is limited to the respective workspace, credentials for connected services are encrypted, and systems are protected by access controls and daily backups. If a personal data breach affects your rights, we notify you and the competent authorities within the deadlines required by applicable law.

8. European Union, EEA and United Kingdom (GDPR)

This section applies to persons in the European Union, the European Economic Area and the United Kingdom under the General Data Protection Regulation (GDPR) and the UK GDPR. The controller is AVEGANDO AI LABS LLC as named in the imprint.

Legal bases (Art. 6 GDPR)

• Contract (Art. 6(1)(b)): your account, workspace, agents, calls, conversations, billing and support.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, answering lawful requests.
• Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse, fixing errors, backups, and knowing how our website is used. For the last point our website keeps aggregated counters of page views and button clicks together with the page path, the country and the referring site, without cookies and without storing IP addresses. You can object at any time (see below).
• Consent (Art. 6(1)(a)): only where we ask for it, for example when you connect Google or another service to your workspace. You can withdraw consent at any time (Art. 7(3)); withdrawal does not affect earlier processing.

Callers and website visitors of our business customers

When a business uses RingDeck to answer its calls or chats, that business is the controller for its callers' data and we are its processor under Art. 28 GDPR. We process that data only on the business's instructions. Business customers conclude our data processing agreement with us: Data Processing Agreement (PDF). If you called or chatted with such a business, please send requests about that conversation to the business; we support them in answering.

Where data is stored, and transfers outside the EU (Art. 44 ff.)

The Service and its database run on servers in the European Union (Germany). Some of the providers listed in section 4 process data outside the EU, mainly in the United States, for example the language models, speech recognition, the voice, the phone network and payments. Those transfers rest on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, with the UK Addendum where applicable) together with additional safeguards such as encryption in transit. We do not rely on the EU-US Data Privacy Framework for these transfers. You can request a copy of the safeguards we use at support@ringdeck.io.

Your rights (Art. 15 to 22)

• Access to your personal data and a copy of it (Art. 15).
• Rectification of inaccurate data (Art. 16) and erasure (Art. 17), subject to what we must keep by law.
• Restriction of processing (Art. 18) and data portability in a machine-readable format (Art. 20).
• Objection to processing based on legitimate interests, for reasons arising from your particular situation (Art. 21); we then stop unless we have compelling legitimate grounds.
• We make no decisions about you that are based solely on automated processing and produce legal or similarly significant effects (Art. 22).
• You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77).

Send requests to support@ringdeck.io. We answer within one month; for complex requests we may extend this by two further months and tell you why. Retention periods are in section 5.

9. Your rights

Send requests to support@ringdeck.io. We verify your identity before acting and do not discriminate against you for exercising your rights. Depending on where you live, you have the rights below.

United States – California and other states with privacy laws

• Right to know and access the categories and specific pieces of personal information we collected, the sources, purposes and categories of recipients (categories and sources are listed in sections 2 and 4).
• Right to delete and to correct personal information.
• Right to opt out of sale or sharing – we do not sell or share personal information, including of consumers under 16.
• Right to limit the use of sensitive personal information – we do not use it to infer characteristics.
• You may use an authorized agent. We respond within the time limits of the applicable law (in California generally 45 days).

United Arab Emirates – Federal Decree-Law No. 45 of 2021 (PDPL)

• Right to information and access about the processing, recipients inside and outside the UAE and the safeguards for transfers.
• Right to data portability, to correction and erasure, to restrict processing and to stop processing (for example for marketing).
• Right to object to decisions based solely on automated processing that have legal or similarly significant effects.
• Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect earlier processing.
• Entities in the DIFC or ADGM free zones are subject to their own data protection laws.

Sultanate of Oman – Royal Decree No. 6/2022 (PDPL) and its Executive Regulations

• Where required, we process your personal data only with your explicit consent, which you can withdraw at any time.
• Right to request correction, deletion, a copy of your data and data portability; we respond to written requests within 45 days.
• Transfers of your data outside Oman (see section 4) take place only on the basis of your explicit consent or as otherwise permitted by law.
• Data protection officer for Oman: Mahmoud Hammoud, h@ringdeck.io. You may also contact the Ministry of Transport, Communications and Information Technology.

10. Children

The Service is for businesses and is not directed at children. We do not knowingly collect data of children.

11. Changes and language

We may update this policy; the current version is always published on this page. If we change how RingDeck accesses, uses, stores or shares Google user data, we notify affected users by email or in the app before the change takes effect and, where required, ask for new consent. An Arabic version is available; if the versions differ, the English version applies unless local law requires otherwise.