Privacy Policy

Mobile Information and SMS

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party, except with the subprocessors that deliver the messages on our behalf, and solely for that delivery.

Callbax sends appointment messages on behalf of the businesses that use it. The business obtains the customer’s agreement at the time of booking; Callbax does not collect that agreement directly from the customer. There are two kinds of message and a customer may receive both: an appointment confirmation before the visit, and — where the business uses Callbax Reviews — one message after a completed visit inviting them to leave a review, containing a link to that business’s own review page. Message frequency is at most one confirmation message and one review request per appointment, and the same number is never asked for a review twice within 90 days. Message and data rates may apply. Reply STOP to stop receiving messages and HELP for help. Carriers are not liable for delayed or undelivered messages. Full programme terms are at callbax.ai/messaging.

1. Information We Collect

Account Information: If you create a callbax account, we collect your email address and authentication data via our identity provider (Clerk).

Business Information: Business name, timezone, and confirmation preferences you provide during setup.

Calendar Data:When you connect a calendar, we temporarily access event data (summary, description, location, attendees) solely to extract the details needed to contact your customer. We retain the phone number (encrypted), the appointment time, source identifiers, and — where your calendar or upload supplies one — the customer’s name, also encrypted at rest. We do not store appointment descriptions, notes, medical information, or the reason for the visit.

Phone Numbers: Customer phone numbers are encrypted at rest using AES-256-GCM and hashed (HMAC-SHA256) for deduplication. We store only the minimum data needed to place confirmation calls or send SMS messages.

Call and SMS Data: Confirmation attempt status, DTMF inputs (e.g. “press 1 to confirm”), and SMS reply keywords (YES/NO/STOP). We do not record calls by default.

Usage Data: Anonymous usage statistics to understand how businesses use callbax and improve the service.

2. How We Use Your Information

We use your information to provide automated appointment confirmation services, manage your account, and improve the platform. We do not sell your data. Ever.

Mobile information: SMS consent and phone numbers will never be shared, sold, or rented to third parties or affiliates for marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Privacy by Design: callbax is built around data minimization. We store only what is needed to contact your customer about their appointment: their phone number, the appointment time, and their name where one is supplied. Names and phone numbers are encrypted at rest; phone numbers are additionally hashed for deduplication. We never store appointment descriptions, notes, medical information, or the reason for the visit. Raw calendar data is processed in-memory and discarded after extraction.

3. Data Storage and Security

All data is stored in EU data centers (Frankfurt, Germany) using Supabase with encryption at rest and in transit. Phone numbers are additionally encrypted using AES-256-GCM with a dedicated encryption key. Phone lookups use HMAC-SHA256 hashing, which is not reversible.

4. Data Retention

Appointment data and confirmation outcomes are retained for a configurable period (default: 30 days) and then automatically deleted. Raw calendar event data is never stored permanently and expires within hours if temporarily buffered for debugging.

You can delete your account and all associated data at any time from Settings.

5. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Restrict processing of your data
• Request data portability
• Withdraw consent at any time

To exercise these rights, contact us at privacy@callbax.ai.

6. Opt-Out for Call and SMS Recipients

If you receive a confirmation call or SMS from callbax, you can opt out at any time:

• During a call: Press 9 to indicate wrong number
• Via SMS: Reply STOP to opt out of all future messages

Opt-outs are processed immediately and permanently prevent future contact from the same business.

7. Third-Party Services

We use the following third-party services to operate callbax:

• Supabase— database (EU-hosted, Frankfurt)
• Clerk— authentication
• Twilio / Telnyx— voice calls and SMS delivery
• Google Calendar API — calendar integration (read-only access)
• Vercel— application hosting

Each third-party service processes data under their own privacy policy. We choose services that meet EU data protection standards.

Google user data. When you connect a Google Calendar, callbax requests read-only access to your calendars and their events solely to read upcoming appointment times and the customer phone numbers stored in those events, in order to send the appointment confirmations you configure. callbax never creates, edits, or deletes calendar events, never uses Google user data for advertising, and never sells it or shares it with third parties for unrelated purposes. callbax's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Children's Privacy

callbax is a business-to-business service not intended for individuals under 18 years of age. We do not knowingly collect information from children.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email. The date at the top of this policy indicates when it was last updated.

10. Contact

For privacy-related questions, contact us at privacy@callbax.ai.

Data Controller:Forward Systems GmbH, Auguststraße 47A, 10119 Berlin, Germany.