Privacy notice

Who this notice covers

“We” means Auto Attendant, the provider of autoattendant.io, the customer app and the phone service. This notice applies to people who browse the site, request an article PDF or write to us; to business customers who sign up and use the app; to team members whose phone numbers or email addresses a customer sets as destinations; and to people who call a business number that uses the service. A business customer may also have its own obligations to its callers and staff; this notice does not replace them.

Effective date: 26 October 2026. This notice is also available in French.

Person in charge of the protection of personal information: Privacy Officer, [email protected]. Questions, requests and complaints about personal information go to this address.

The website

The pages of autoattendant.io outside /articles/ are static and set no cookies of their own. Each page records a page view (its address and title, the referring address, campaign parameters, browser language and time zone) with a random visitor identifier kept in your browser’s local storage, so we can see which pages lead to requests; the same identifier connects these views with the /articles/ section. They do not ask you to create an account; accounts are created in the app, described below. A request for a page can still produce ordinary server records such as the requested URL, time, IP address and browser information, used to serve, operate and protect the site.

These pages load a font from Google Fonts. Your browser requests the font stylesheet and font files from Google, so Google receives the IP address used for that request. Google's documentation describes the browser request for its stylesheet and font files.1 If the font cannot load, the page uses a local system font.

The articles section

The /articles/ section is a separate publishing service. Its analytics code is designed to record page views and reading interactions, using a browser visitor identifier to connect visits on that section when the analytics endpoint is available. If you enter an email address to receive an article PDF, that address and the article requested are used to deliver the PDF; the request may be connected with that browser identifier and earlier article views. The article interface may remember the address in browser storage for a later PDF request.

The static pages and article pages have different data behaviour. Article activity may be used to understand which material is useful and to respond to a PDF request; a PDF request is not an anonymous download.

Email enquiries

If you write to [email protected], we receive your email address, message and any details you choose to include. A number transfer is requested in the app (see moving an existing number); if you write to us about one, we use what you send for that transfer. We use the correspondence to answer, make requested changes, help with a transfer and keep an ordinary record of the conversation. We email you only about your enquiry, your account and your line; we do not add you to a newsletter or a marketing list.

Your account in the app

To sign up at app.autoattendant.io you give an email address, your business name and your country; the app also keeps the language you use (English, French or Spanish). To sign in, the app emails you a link that works once and expires after 30 minutes. A signed-in session lasts up to 30 days. We store only a one-way hash of each sign-in link and session, never the link itself.

The app sets two cookies on app.autoattendant.io: a session cookie that keeps you signed in (up to 30 days, removed when you sign out) and a language cookie that remembers English, French or Spanish (one year). Both are needed for the app to work; the app sets no advertising or analytics cookies. To limit abuse, the app counts sign-up and sign-in attempts per IP address over one hour, in memory only.

The app keeps a record of events on your account, such as a number bought, a line going live, a menu published or a payment received, to run and support the account.

Moving an existing number to the service

If you ask in the app to bring (port) a number you already have, the app collects what that transfer needs: the number, the name of the account holder, your name and email address (or those of the person who will sign, if the account is in someone else's name), the account number with your current provider, the billing address on that account, a copy of a recent bill and, for a mobile number, the transfer PIN from the carrier. For toll-free and Canadian numbers it collects only who holds the account; our team may email you for anything else the transfer needs.

These details are passed to our telephony provider and to your current provider (the losing carrier) to process the transfer: the current provider checks them against its own records before it releases the number. The transfer authorization (letter of authorization) is signed online, through an email our telephony provider sends to the person named in the request. The app shows the status of the transfer, and the reason if the current provider rejects it.

We use these details only to carry out and support the transfer, and keep them only as long as that and any record the law requires make necessary.

Your line, calls and voicemail

To run your line we hold its number and the menu configuration: business hours, time zone, holidays, languages, the wording of the prompts, option labels, the phone numbers your options ring and the email addresses that receive voicemail. A text-to-speech service turns the menu wording into the audio callers hear. Earlier versions of the menu are kept so you can restore one.

When someone calls the number, our telephony provider records the call details: the caller's number, the time, the duration and the call status. The dashboard shows recent calls and this month's calls and minutes. A forwarded call shows the business number as caller ID on the team member's phone. A conversation answered on a team member's phone is not recorded.

When a caller leaves a voicemail, the telephony provider records and transcribes it (a French or Spanish voicemail is transcribed in its own language). The recording is emailed, as an MP3 attachment, to the recipients you set, with the caller's number and the option chosen; the transcript follows in a second email when transcription produces text. The voicemail emails are written in the language the business chose for them (English, French or Spanish). The dashboard lists voicemails, where you can play, read and delete them. Our team is notified of each new voicemail, its transcript and each forwarded call in an internal messaging service, to watch over the service.

Voicemail recordings and transcripts stay in your dashboard for 365 days, and our own stored copy is deleted then. Our call-handling provider also keeps a copy of each recording; write to us to have particular recordings deleted there. Deleting a voicemail in the dashboard removes it from the dashboard sooner. Copies already emailed stay in the recipients' inboxes until they delete them.

We use this information to route calls, deliver voicemail, show the dashboard, maintain the account, answer support requests and operate the service. A customer decides which phones receive calls and which addresses receive voicemail, and should choose them with the sensitivity of their callers' messages in mind. Trust and reliability explains the call path and its fallback.

Payment

Payment is handled by Stripe, a payment processor, on its hosted checkout page and billing portal. You enter your card or other payment details on Stripe's pages: we do not receive or store your full card number or bank details. We keep the references Stripe gives us for your customer record and subscription, and the subscription's status and renewal date. Stripe may ask for a billing address, and lets a business enter a tax registration number, to calculate tax and issue invoices. You pay online at the end of setup, and a new number goes live as soon as payment completes. A number you bring with you is not charged until it has moved.

Where information is processed

The providers that host the site and the app, send email, carry and route calls, process number transfers, transcribe voicemail, turn menu text into speech, store recordings, process payments, deliver our team's notifications and serve the font are located mainly in the United States. Information about visitors, customers and callers in Canada, including Quebec, is therefore processed and stored outside Canada and outside Quebec. While it is there it is subject to the laws of that country, and it may be accessible to its courts, law enforcement and national security authorities.2 We use only providers we need for the purposes in this notice, and we remain responsible for information we pass to them for processing.3

Sharing, retention and sale

We do not sell personal data. Information passes through the providers described above, only as needed for their part of the service; for a number transfer, the details described above also go to your current provider. Information is otherwise disclosed only where law requires it.

Voicemail recordings and transcripts stay in your dashboard for 365 days, and our own stored copy is deleted then. Our call-handling provider also keeps a copy of each recording; write to us to have particular recordings deleted there. Sign-in links expire after 30 minutes and sessions after 30 days. Account information is kept while the account is open, and afterwards only as long as needed for a required business record or to resolve a problem. Other information, such as an email or a call record, is kept for as long as needed for the purpose for which it was collected; we do not publish a fixed period we cannot substantiate. When information is no longer needed for its purpose or a required record, it is deleted.

Within our team, access is limited to the people who answer enquiries and set up and support lines, and only for those tasks.

Your choices and requests

Write to [email protected] to ask what information we hold about you, to request access, correction or deletion, to close your account, to withdraw a consent, or to ask about how a particular record is used. We answer in writing within 30 days. Give enough detail for us to find the record without sending unnecessary sensitive information. We may need to verify that the request is yours and may need to retain information where a legal obligation applies. If you are a caller to a business using the service, identify the business number so we can direct the request appropriately.

Customers can delete voicemails in the dashboard at any time. Browser storage for the articles section can be cleared in your browser, and you can choose not to submit an email address for a PDF. Those choices do not remove copies of messages already sent by email; contact us for a deletion request.

Canadian residents, including Quebec

For people in Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and in Quebec the Act respecting the protection of personal information in the private sector. Under both you can ask what information we hold about you, how it is used and to whom it has been communicated, and have it corrected or deleted where it is inaccurate, incomplete or no longer needed. Make the request in writing to the address above; we answer within 30 days.45

Complaints. Write to the Privacy Officer first, with "Privacy complaint" in the subject: the complaint is reviewed and answered in writing, with the reasons and what we will change, if anything. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada; Quebec residents can also apply to the Commission d'accès à l'information, within 30 days of a refusal or of a request left unanswered.46

Incidents. If a confidentiality incident involving your information creates a real risk of significant harm (in Quebec, a risk of serious injury), we notify you and the regulator concerned, as the law requires.45

Business contact details. Much of what a business customer gives us is business contact information (a name, title, business email or work number used for the business). We handle it with the same care as the rest.7

Children and changes

The website and service are intended for businesses, not children. We do not knowingly ask children to submit personal information. If you believe a child has sent us information, contact [email protected] so we can review it.

We may update this notice when the service or its data handling changes. The effective date on this page identifies the version currently published. Material changes will be made clear here; if a change directly affects customer accounts, we will also notify them by email.