How we handle your data.

1. What we collect

We collect the minimum information required to create and operate your YallDesk account and AI receptionist:

• Organization name — used to identify your account and configure your assistant
• Admin email address — used for magic-link login and transactional notifications
• Uploaded documents — menus, policies, FAQs, and other content you provide to train your assistant
• Call transcripts — text records of conversations your AI receptionist has with callers
• Chat messages — text records of web chat conversations handled by your assistant
• Billing information — processed by our payment provider; we do not store raw card numbers

We do not collect personal information from your callers or chat visitors beyond what appears in the conversation transcript. We do not run analytics tracking, ad pixels, or behavioral profiling on visitors to your assistant.

2. Third-party services that process your data

Running YallDesk requires several third-party services. Each has access only to the data necessary for its function:

• VAPI — processes all phone calls and chat messages in real time. Call audio is used to generate a response and transcript. VAPI operates under SOC 2 Type II compliance.Privacy policy ↗
• Supabase — stores your organization data, documents, transcripts, and account information in an encrypted PostgreSQL database with row-level security.Privacy policy ↗
• Vercel — hosts the YallDesk web application and API routes. Request logs may be retained for up to 30 days for debugging purposes.Privacy policy ↗
• Resend — delivers transactional email (magic links, notifications). Email addresses are transmitted to Resend solely to send these messages.Privacy policy ↗
• OpenAI— generates vector embeddings from your uploaded documents to power semantic search in your assistant's knowledge base.Privacy policy ↗
• Google Calendar API — when you connect your Google Calendar, YallDesk accesses your calendar solely to check free/busy availability and create appointment events on your behalf during calls. We request only the minimum scopes needed: calendar.readonly (to read availability) and calendar.events (to create booking events). We do not read, store, or share the content of your existing calendar events. Access tokens are encrypted at rest and never exposed in plaintext. You can revoke access at any time from your Integrations settings or directly from your Google Account.Google Privacy Policy ↗

3. How we use your data

• To operate and improve your AI receptionist
• To send transactional email (login links, billing receipts, call summaries)
• To generate usage reports visible in your admin dashboard
• To process billing and manage your subscription

We do not use your data to train AI models for other customers. We do not sell, rent, or share your data with advertisers or data brokers.

4. Data retention

Your organization data, documents, and call transcripts are retained for as long as your account is active. If you close your account, you may request deletion of all associated data by emailing hello@yalldesk.com. We will process deletion requests within 30 days.

Call transcripts are retained indefinitely by default to power your admin reports. You may disable transcript retention in your account settings (this will also disable call summary reports).

5. Cookies

YallDesk uses only session authentication cookies — small tokens stored in your browser to keep you logged into your admin dashboard. We do not use analytics cookies, advertising cookies, or any third-party tracking pixels. If you clear your browser cookies, you will be logged out and need to request a new magic link.

6. Google Calendar integration

YallDesk offers an optional Google Calendar integration that allows your AI receptionist to check your availability and book appointments during phone calls. This section describes how we handle Google user data in accordance with Google's API Services User Data Policy.

• What we access:When you connect your Google Calendar, we request read access to your calendar's free/busy information and write access to create new calendar events. We access only the calendars you explicitly select during setup.
• What we do not access: We do not read, index, store, or share the titles, descriptions, attendees, or any other details of your existing calendar events. We access only free/busy availability data to find open slots.
• What we store: We store OAuth access and refresh tokens, encrypted with AES-256-GCM, to maintain your calendar connection between calls. We store basic metadata about appointments we create (date, time, caller name, caller phone) in your YallDesk account for your admin records.
• How we use it: Google Calendar data is used solely to power the appointment booking feature for your organization. It is never used to train AI models, shared with third parties, or used for any purpose beyond operating your AI receptionist.
• Revoking access: You can disconnect your Google Calendar at any time from your YallDesk admin panel under Integrations, or by visiting your Google Account permissions ↗. Disconnecting immediately stops all calendar access and removes your tokens from our system.

YallDesk's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

7. Your rights

You have the right to access, correct, or delete the personal data we hold about your organization. To exercise any of these rights, email us at hello@yalldesk.com. We will respond within 10 business days.

Note: deleting your admin email from our records will permanently disable access to your account, as it is required for magic-link authentication.

8. Contact

Questions about this privacy policy or how we handle your data? Contact us at hello@yalldesk.com. We'll respond within one business day.