Privacy Policy
Effective and last updated: September 14, 2026
Who this policy covers
SVA Products, LLC, 169 Madison Ave, New York, operates Spikey AI. This policy covers our website, business accounts, inbound AI assistant and support. It describes the categories of information the service collects and discloses, including through use in the 12 months before this policy's date. Contact hello@spikeyai.com or use our privacy request form without an account.
Spikey AI determines the purposes of account administration, billing, website security and our direct relationship with you (as a controller or business). When handling a customer business's calls and caller information, we act on its instructions as a processor or service provider under our Data Processing Addendum. That business controls its use of messages and copies it receives; its privacy notice also applies. Contact the business about its records. We can help route requests if you do not know whom to contact.
Information, sources and purposes
This section is also our notice at collection. Account information is needed to establish and administer service. Callers choose whether to leave a message. Integrations and SMS are enabled separately. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.
- Account, contact and business information: names, emails, phone numbers, business name, address or service area, role, account identifiers, authorized users, preferences, instructions, public website information, and approval and consent records. Sources are you, your business administrator and public websites used for business research. Purposes are authentication, configuring and supporting the assistant, managing access and documenting permissions. These include identifiers, professional information and customer records.
- Calls and messages: caller ID and callback number, name and voluntarily provided request or contact details, real-time voice audio, conversation text, summaries, suggested actions, consent responses, call identifiers, timestamps, duration and status. Sources are callers, the business and communications/AI providers. Purposes are answering and transcribing inbound calls, conveying requests, suggesting follow-ups, showing call history and measuring usage. AI may infer a request category or urgency for human review; it does not decide a person's eligibility or rights.
- Billing and delivery: plan, transaction/invoice references, subscription and payment status, call usage, notification recipients, consent/opt-out records, delivery timestamps and errors. Sources are you, our system and billing/delivery providers. Purposes are subscriptions, charges, service notices, disputes and messaging preferences. Stripe receives payment details through its checkout. Spikey AI does not store full card numbers or card security codes.
- Optional calendars: authorization tokens, selected calendar IDs/names, timezone settings and busy/free times from your connected Google or Microsoft account and your selections. These support the availability feature you enable, described below.
- Site, device, security and support: IP address, browser/device details, request timestamps, session identifiers, logs/errors, support messages and privacy correspondence. Sources are your browser, infrastructure providers and communications with us. Purposes are website operation, security, abuse prevention, troubleshooting, support and legal/privacy requests. These include internet activity and approximate location that may be inferred from IP addresses. We do not request device GPS location.
Credentials and connected-account tokens are sensitive information. Callers may volunteer sensitive information although we do not request it. Use the assistant for ordinary business inquiries: do not provide passwords, payment credentials, government ID numbers, medical details or unnecessary sensitive information. We use sensitive information for requested services, account protection and legal obligations, not to infer sensitive traits or target advertisements. The service does not create voiceprints, authenticate speakers by voice or offer voice cloning.
AI calls, transcription and caller choices
The assistant is AI, not a human receptionist. Before an inbound call connects to the AI, a notice explains AI processing and transcription and asks you to press 1 to agree. If you decline or do not agree, the call ends without connecting to the AI. Use the business's other contact channels if you prefer. Browser voice tests require agreement before microphone access. You can end the conversation or tell the assistant you withdraw agreement at any time.
ElevenLabs and its configured AI services, including Google Gemini, process voice, transcription and responses. Google Gemini processing through ElevenLabs is separate from the optional Google Calendar connection described below. OpenAI helps research public business information and identify possible follow-ups from transcripts. Relevant conversation content and business instructions are disclosed to these services. Spikey AI does not use customer calls or connected calendar data to train its own general-purpose AI models. Provider handling depends on applicable service settings and processing agreements; we do not promise zero retention in every provider system.
Audio is processed in real time. Our required US voice configuration disables retained audio recordings and sets provider conversation retention to 30 days. Transcripts, messages and metadata saved in Spikey AI are separate records and follow the retention criteria below. Calls handled under older configurations may have retained audio and conversation records without automatic expiry. Those older provider records require a separate deletion review; changing a setting does not automatically erase them. Ending a call or withdrawing agreement does not itself delete information already received. Request deletion below. AI text and suggestions can contain errors; ask the business to check important details and request correction when needed.
Google and Microsoft calendars
Connecting a calendar is optional. Google permissions let us list calendars and retrieve free/busy times, without requesting event titles, descriptions, attendees or event-writing access. Microsoft grants delegated read access to calendars you can access, including shared calendars. Our requests select calendar names/IDs and event timing, availability and cancellation fields, without requesting subjects, bodies or attendees. Neither connection books, edits or deletes events.
We store encrypted authorization tokens and selected calendar metadata to maintain the connection. Availability is supplied to the assistant to answer scheduling inquiries and may appear in call transcripts. Do not select a calendar whose availability should not be disclosed to callers. Disconnect in Integrations to remove the saved connection, or revoke access in your provider account. This stops new access; request deletion separately for information already in call records.
Microsoft users can also revoke permission through their Microsoft account consent settings or their organization's My Apps portal. Contact us through the privacy request form to close an account or remove calendar-derived records. Our account-closure and abandonment review includes deleting connected-calendar data, subject to required legal retention; revoking permission alone does not erase previously received copies.
Spikey AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and applicable Google Workspace user data policy, including Limited Use requirements. Connected-calendar information is not used for advertising, sale, credit decisions or general-purpose AI model training. Human access is restricted to support with your specific agreement, security or legal purposes, or lawful aggregated, anonymized internal operations.
Who receives information
Authorized users of the business you call receive its caller information, transcripts and follow-up suggestions, including through its configured notification destinations. Your administrator can manage workspace access and information. Do not use a business account for information you want to keep private from that business.
Providers receiving information for the purposes above include Vercel and Supabase (infrastructure and database); ElevenLabs, its configured Google Gemini service, and OpenAI (voice and AI); Twilio (telephony and SMS); Mailgun (email); Stripe (billing); and Google or Microsoft for enabled calendars. Our service provider directory describes their functions and data. Providers may use downstream providers. Their handling of your separate accounts with them is governed by their notices.
Some providers also have independent responsibilities. Twilio and Sinch (Mailgun) process communications information for network operation, security, fraud and spam prevention, business administration and legal requirements; Twilio's terms also describe service improvement. Stripe independently processes certain payment information for fraud prevention, financial compliance and service improvement. These activities are governed by their applicable terms and privacy notices. Our provider directory does not mean every activity of every provider is performed solely on Spikey AI's instructions. Google calendar information remains subject to the Limited Use restrictions above.
We may disclose information to professional advisers or competent authorities when reasonably needed to meet legal obligations, protect rights and safety or respond to lawful process, and in a business transaction with appropriate confidentiality and privacy protections. Google data remains subject to the more restrictive Limited Use terms above. Other disclosures require your direction or another lawful basis and any required consent.
Mobile numbers, opt-in information and consent records are not sold or shared with third parties or affiliates for marketing or promotional purposes. Services delivering messages and honoring preferences may receive them. We do not offer personal information for sale or share it for cross-context behavioral advertising, including information about people under 16.
How long information is kept
Scheduled expiry of call content in Spikey AI is not currently active. A 90-day default after a call is created is proposed for US release, covering caller details, transcripts, summaries and related callback or follow-up content. The schedule requires approval and activation; it does not mean existing records are already being purged. The approved period will be communicated to business customers. Verified deletion requests and applicable shorter legal requirements can require earlier action. Billing totals, minimal consent evidence and justified suppression records have separate retention needs.
Retention depends on the category and its purpose. We limit it to what is reasonably needed, apply deletion requests subject to law and documented exceptions, and use these criteria:
- Account, business and configuration records: while needed to provide service, then what is needed to close accounts, resolve disputes and document access or approvals.
- Calls, summaries, follow-ups and notifications: the business's documented need for call review and outstanding work, its retention instructions and deletion requests. Provider audio and diagnostics are governed separately by settings and provider obligations described above.
- Billing and usage: charge calculation/reconciliation, refunds, disputes and applicable tax, accounting and recordkeeping requirements. A need for billing totals does not by itself justify keeping a full transcript.
- Calendar tokens and selections: while the connection is enabled. Disconnecting removes the active saved connection. Previously returned availability in call history follows call-content retention criteria.
- Security, support and privacy records: investigation, account protection, documenting requests and consent, and legally required recordkeeping. Minimal suppression records may remain to ensure SMS opt-outs stay effective.
Cancellation does not immediately erase every record. Request account or call-data deletion below. Deletion involves our systems, relevant providers and, for business-controlled data, the business's instructions. Residual backups may remain until the relevant backup cycle expires, with access restricted and deletion reapplied if restored. Legal holds or another lawful exception may require limited retention. Copies received by a business or its team must also be addressed with those recipients.
US privacy rights and requests
We accept privacy requests from every US state. Depending on state law, our role, applicability thresholds and legal exceptions, rights may include confirming processing; access to categories or specific information; a portable copy; correction; deletion; information about categories or identities of recipients where required; consent withdrawal; limiting certain sensitive-data uses; and opting out of sale, sharing, targeted advertising or profiling with legal or similarly significant effects. Ordinary follow-up suggestions do not make those consequential decisions.
Use our privacy request form or email hello@spikeyai.com. Identify your request and enough context to find the records, such as account email or the business called and approximate call date. Do not initially send passwords, full payment details or ID documents. We may request proportionate information to authenticate you or an authorized agent and use it for verification. No Spikey AI account is required.
Authorized agents may submit evidence of authority. We may ask you to verify your identity or confirm permission when law permits, and honor valid powers of attorney as required. We do not require opt-out identity verification where prohibited. We do not discriminate or retaliate for exercising rights. Requests are ordinarily free; we will explain any lawful exception or permitted fee before proceeding.
We aim to acknowledge requests within 10 business days and respond within 45 calendar days, or sooner when law requires. We will explain a lawful extension within the initial period. Opt-outs, consent withdrawals and requests with shorter legal deadlines are handled within those deadlines. If we decline a request, we explain the reason and appeal process. Appeal through the same form or email with your request reference. We aim to decide appeals within 45 calendar days, subject to shorter required deadlines, and explain the outcome. You may complain to your state attorney general or privacy regulator, including after an unsuccessful appeal. Delaware residents may send complaints to privacy@delaware.gov.
For business-controlled information we assist the business and may refer you to it; we will explain our role. This does not prevent requests about information we control directly. California residents can also request disclosures for others' direct marketing under Shine the Light; we do not make those disclosures. Nevada residents may use the same channels to opt out of sale, although we do not sell covered information.
Security, locations and children
We use access controls, encrypted connections and restricted server-side processing. Calendar credentials are encrypted in storage. No system guarantees absolute security. Report suspected unauthorized access to hello@spikeyai.com. We respond to incidents and provide legally required notices.
We and providers may process information in the United States and other countries where personnel and infrastructure operate. We do not promise exclusive storage in one state or country. Contact us before providing data with a location restriction. Transfers remain subject to applicable safeguards and processing terms.
Business accounts are for adults 18 or older. The service is not directed to children under 13, and we do not knowingly seek their personal information. If you believe a child provided information, contact us to investigate and delete it as appropriate. Businesses must not configure child-directed or sensitive-data workflows under the standard service.
Changes and contact
We update the date above when this policy changes and provide material-change notice through the website or account contacts. We obtain any required consent before a new processing purpose. Updates do not retroactively authorize uses inconsistent with notice or consent at collection.
Privacy contact: SVA Products, LLC, 169 Madison Ave, New York; hello@spikeyai.com. You may use our privacy request form at any time.