Privacy policy

A. Introduction and our role

SVA Products, LLC, 169 Madison Ave, New York ("Spikey AI," "we," "our" or "us") operates the Spikey AI website, business accounts, inbound AI assistant and support. This policy describes the categories of information we collect, use, disclose and retain, and the rights available to you.

Our two roles: we determine the purposes of account administration, billing, website security and our direct relationship with a subscriber. When handling calls made to a business that uses Spikey AI, we act on that business's instructions as its service provider under section J of our Terms of service.

If you called a business: that business controls the record of your call and its own privacy notice also applies. Contact it directly where possible; we will help you identify the right recipient. You may also contact us using the privacy request contact details below. No account is required.

B. Information we collect

This section is also our notice at collection. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising.

• Account, contact and business information: names, email addresses, telephone numbers, business name and service area, role, account identifiers, authorised users, the instructions and business facts you approve, and approval and consent records. Sources: you, your administrator, public websites used for business research, and any identity provider you select.
• Calls and messages: caller identification and callback number, any name or request details the caller provides, real-time voice audio, conversation text, summaries, suggested actions, consent responses, call identifiers, timestamps, duration and status, and the follow-up status your team records. Sources: callers, the business, and our communications and AI providers.
• Billing and delivery: plan, invoice and transaction references, subscription and payment status, call usage, optional spending limits, notification recipients, consent and opt-out records, and delivery timestamps and errors. Stripe receives payment details through its own checkout; we do not store full card numbers or security codes.
• Calendar connections: encrypted authorisation tokens, selected calendar identifiers and names, timezone settings and busy or free times, where you choose to connect a calendar.
• Site, device, security and support: IP address, browser and device details, request timestamps, session identifiers, logs and errors, support messages, and privacy correspondence and status records. These include internet activity and the approximate location that may be inferred from an IP address. We do not request device GPS location.

Sensitive information: credentials and connected-account tokens are sensitive. Callers may volunteer sensitive information although we do not request it. We use sensitive information only to deliver the requested service, protect the account and meet legal obligations, never to infer sensitive traits or target advertising. The Services do not create voiceprints, authenticate speakers by voice, or offer voice cloning.

C. How we use information

We use the information above to:

• authenticate users, establish and administer accounts and manage access;
• configure the assistant and document the approvals and permissions you give;
• answer and transcribe inbound calls, convey requests to the business, suggest follow-ups and display call history;
• measure usage, calculate charges, process subscriptions and send service notices;
• operate and secure the website, prevent abuse and troubleshoot problems; and
• respond to support enquiries, privacy requests and legal obligations.

The assistant may infer a request category or urgency for a person to review. It does not make automated decisions producing legal or similarly significant effects for any individual.

D. Email, Google and Microsoft sign-in

Supabase manages sign-in. With Google or Microsoft sign-in, the provider shares your account identifiers, email address and basic profile; your provider password is never shared with Spikey AI. Sign-in does not grant calendar, inbox or contact access.

E. AI calls, transcription and caller choices

How calls connect: the assistant is artificial intelligence, not a human receptionist. Calls forwarded to a business's Spikey AI number connect directly to the assistant, without a separate keypad step, and speech is transcribed as the call happens. A caller who prefers not to speak with AI can hang up and use the business's other contact channels. Ending a call does not itself delete information already received.

AI providers: ElevenLabs and its configured AI services, including Google Gemini, process voice, transcription and responses. OpenAI researches public business information and identifies possible follow-ups from transcripts. Spikey AI does not use customer calls or connected calendar data to train its own general-purpose AI models.

Audio retention: audio is processed in real time. Our required US voice configuration disables retained audio recordings and sets provider conversation retention to 30 days. Transcripts, messages and metadata saved in Spikey AI are separate records subject to section H. Provider records from calls under earlier settings may remain until deleted separately.

Accuracy: AI text and suggestions can contain errors. Ask the business to verify important details, and request correction of a record about you under section I.

F. Calendar connections and Google Limited Use

Connecting a calendar is optional and read-only. Google permissions allow us to list calendars and retrieve free and busy times, without requesting event titles, descriptions, attendees or write access. Microsoft grants delegated read access to calendars you can access; our requests cover calendar names and identifiers and event timing and availability, without subjects, bodies or attendees. Neither connection books, edits or deletes events. Do not select a calendar whose availability should not be disclosed to callers.

We store encrypted tokens and selected calendar details. Disconnect in Setup or revoke access in your Google account, your Microsoft account consent settings or your organisation's My Apps portal. This stops new access; request deletion of information already received under section I.

Spikey AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Connected-calendar information is not used for advertising, sold, used for credit decisions, or used to train general-purpose AI models. Human access is restricted to support you specifically request, security, legal purposes, or lawful aggregated and anonymised internal operations.

G. Disclosures and service providers

Within the business you called: its authorised users receive caller information, transcripts and follow-up suggestions in the authenticated workspace. Where an owner enables post-call text messages, Bird and mobile carriers deliver the caller's callback number, a short summary and the next action to the owner's verified mobile number, which may appear on a lock screen. Where callback emails are enabled, Resend delivers the caller's name, callback number and request to the owner's verified sign-in email address; subject lines and previews stay generic, and emails to any other address contain only a dashboard link. Do not use a business account for information you wish to keep from that business.

Our service providers: the following providers receive information for the purposes stated. A provider may act as our service provider for one function and as an independent controller for another, such as operating its network, preventing fraud or meeting its own regulatory duties.

Locations: providers use infrastructure, personnel and downstream providers in several countries, so we do not promise that all processing remains in one state or country. Contact us before providing data subject to a residency restriction. We give affected business customers notice before adding or replacing a provider.

Other disclosures: we may disclose information to professional advisers or competent authorities where reasonably needed to meet legal obligations, protect rights and safety, or respond to lawful process, and to a counterparty in a business transaction subject to equivalent confidentiality and privacy protections. Google calendar information remains subject to the Limited Use restrictions in section F. Mobile numbers, opt-in information and consent records are not sold or shared with any third party or affiliate for marketing or promotional purposes.

H. How long we keep information

We retain information only for as long as there is a purpose for it, applying the following criteria:

• Account and configuration records: while needed to provide the Services, then as needed to close accounts, resolve disputes and evidence approvals.
• Calls, summaries and follow-ups: the business's documented need for call review and outstanding work, its retention instructions, and deletion requests. Provider audio and diagnostics are governed separately as described in section E.
• Billing and usage: charge calculation, reconciliation, refunds, disputes, and applicable tax and accounting requirements. A need for billing totals does not justify retaining a full transcript.
• Calendar tokens and selections: while the connection is enabled.
• Security, support and privacy records: investigation, account protection, evidencing requests and consent, and required recordkeeping. Minimal suppression records may remain so that opt-outs stay effective.

Call content has no automatic expiry yet; we will tell business customers before one takes effect. Cancellation does not immediately erase every record; request deletion under section I. Residual backups may persist until the relevant backup cycle expires, with access restricted and deletion reapplied if restored, and a legal hold may require limited retention. Copies already received by a business or its team, such as callback emails and text messages, must be addressed with those recipients.

I. Privacy requests and your rights

Ask about information held by Spikey AI, request access, correction or deletion, withdraw consent, or appeal a decision. Email hello@spikeyai.com or write to SVA Products, LLC, 169 Madison Ave, New York.

We accept privacy requests from residents of every US state. Depending on your state, our role and applicable exceptions, rights may include confirming processing, access to categories or specific information, a portable copy, correction, deletion, information about recipients, withdrawal of consent, limiting certain sensitive-data uses, and opting out of sale, sharing, targeted advertising or profiling with legal or similarly significant effects. We do not engage in the last four in any event.

What to include: identify your request and give enough context to locate the records, such as your account email, or the business called and the approximate date. Do not initially send passwords, full payment details or identification documents. We may request proportionate information to authenticate you or an authorised agent, and use it only for verification. No account is required.

Timing and appeals: we aim to acknowledge within 10 business days and respond within 45 calendar days, or sooner where the law requires, and will explain any lawful extension within the initial period. Requests are ordinarily free, and we do not discriminate or retaliate for exercising rights. If we decline, we explain the reason and the appeal process; appeal through the same channel with your request reference and we aim to decide within 45 calendar days. You may complain to your state attorney general or privacy regulator at any time. Delaware residents may also write to privacy@delaware.gov.

For information controlled by a business customer we assist that business and may refer you to it, explaining our role. This does not prevent requests about information we control directly.

J. Cookies and communications

Cookies and similar browser storage support authentication, session security and preferences. Blocking them can prevent sign-in. We use no advertising cookies, cross-site advertising trackers or targeted advertising, so Global Privacy Control and similar opt-out signals have no such practices to change here.

Text messages are optional; see the text message terms for opting out, help and rates. Essential security, billing and account emails may continue.

K. Security and children

We maintain access controls, encrypted connections, restricted server-side processing and encrypted storage of calendar credentials. No system guarantees absolute security. Report suspected unauthorised access to hello@spikeyai.com; we investigate incidents and provide legally required notices.

Business accounts are for adults aged 18 or over. The Services are not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so that we can investigate and delete it as appropriate. Businesses must not configure child-directed workflows on the standard Services.

L. Changes and contact

We update the date above when this policy changes and give notice of material changes through the website or your account contacts. We obtain any required consent before a new processing purpose, and updates do not retroactively authorise uses inconsistent with the notice or consent given at collection.

For privacy questions or requests, use the contact details in section I.