Privacy Policy

2.Our two roles

When we decide how information is used

We are responsible for the personal information of the owners and staff of the businesses that use JULY Call, people who contact us (including on our own sales, support and concierge lines), visitors to our website and live demos, and people who receive marketing from us.

When we act for a business

JULY Call’s customers are businesses. When you call, text, email or chat with a business that uses JULY Call, or that business contacts you through JULY Call, the business controls your information and decides how it is used. We process it on the business’s behalf, as its service provider, under our Terms of Service and Data Processing Addendum. The business’s own privacy policy applies to you, and questions about it are best sent to the business first (see If you dealt with a business that uses JULY Call).

3.What we collect

Account owners and staff

Your name, business name and industry, email address, phone number and role; your sign-in details (a password handled by our authentication provider, Supabase Auth, or your Google sign-in); the receptionist settings and requests you send us, including the words you use to describe your business and your voice and language choices; your phone numbers and forwarding settings; your calendar connection if you connect Google Calendar (your availability and the appointments the Service creates); billing details (your plan, invoices, payment status and a payment token from Helcim, never your card number); the version of our Terms you accepted for your business, and when; your support messages; and your calls and texts with our concierge line.

Callers and contacts of a business (processed for the business)

Your phone number, and the number a call was forwarded from; the name and details you give; what you say on calls (the audio recording, a transcript and an AI summary, and the language you speak); the texts, WhatsApp messages, chat messages and emails you exchange with the business; appointment details; the reason for your call and notes; consent and opt-out records; and call times, durations and costs. If the business connects Facebook or Instagram lead forms, a website chat, an inbound email address or a contact list, we receive the information it sends from those sources.

People a business contacts through AI outreach (processed for the business)

The contact details the business enrols and the consent basis it records; the messages the AI sends and your replies; call results and any answer you give; any appointment booked; and whether you asked to stop.

Website visitors

We do not use analytics, advertising or tracking cookies or scripts (see Cookies and similar technologies). Our hosting provider processes technical information, such as your IP address and browser type, to deliver and protect the site. If you write to us, use our contact form or ask for a demo, we keep what you send (your name, business, email address, phone number if you give it, and your message) as a sales or support lead, and we email it to our team so a person can reply.

Live-demo visitors

• Receptionist demo (a call from your browser to a fictional business): before the first call you give your first name and mobile number, and we text that number a 6-digit code to confirm it is yours. We keep, as a sales lead, your first name, your number, when you confirmed it, the industry and language you tried, the first name the receptionist heard on the call, the questions you asked (with any phone number or email address you said masked), any time you booked with the fictional business, and whether you ticked the box to let JULY Call call or text you about the service. A time you book during the demo is a real follow-up: it is kept as a consultation with the JULY Call team, we text you a confirmation that says it was a JULY Call demo and that JULY Call will call you then, and our team is told. For the demo’s limits we keep a salted hash of your IP address (never the address itself), the call’s ID at Twilio, how many questions you asked, how long the call lasted, why it ended and whether you booked a time. The code itself is kept only as a one-way code (a hash) and deleted after 30 days. The call is processed live by Twilio and our AI provider so that the demo works, and it is recorded and transcribed like a call to a business’s line: you hear the recording notice right after the greeting, and the recording is stored in Canada after the call. Our team plays back the recordings and reads the transcripts to check the demo’s quality; both are deleted 30 days after the call.
• Outreach demo (the AI calls or texts your own phone): it starts only after you agree, by pressing 1 on the call or replying YES to the text. We keep, as a sales lead, your first name, your number, the scenario you tried, how the demo ended (for example that you picked a time, said no or did not answer) in one line, and whether you ticked the box to let JULY Call call or text you about the service. The demo’s own record keeps your number only while the demo is open; it keeps salted hashes of your phone number and IP address to enforce the demo’s daily limits, and the scenario, channel, status, outcome, number of turns and, for calls, the call’s ID at Twilio. The call is not recorded; the text conversation is kept only while the demo is open and is then erased.
• Why, and your choice: a person at JULY Call may call, text or email you about the demo you asked for. The box is never ticked for you. If you leave it unticked, we follow up only about your demo, within six months of it, as Canada’s anti-spam law allows after an inquiry. You can tell us to stop at any time (reply STOP to a text, or write to us), and we will not contact you again about it.

People who call or text JULY Call

When you call or text our own lines, such as our sales and support line (the JULY Call line) or the concierge line, our AI assistant answers. We decide how that information is used.

• The JULY Call line (our sales and support line): calls are recorded, with a notice at the start of the call, then transcribed and summarized. We keep what you tell us as a sales lead: your name, your business, your phone number and email address, what you need and the summary of the call, and we email the summary to our team so a person can follow up. The recording is kept 90 days; the transcript and the summary stay with the lead. If you text the line, we keep both sides of the conversation (its last 40 messages) so the assistant can carry it on, and we summarize it for our team. Reply STOP to stop texts from that line; we keep a record that you did, so that we honour it.
• The concierge line (for our customers’ setup): these calls are not recorded. The AI keeps a summary with the request the call created, along with your number and the details you give.

Abuse prevention

We keep short-lived counters that limit abuse, for example how many messages one number can send in a few minutes. They can include a phone number or an IP address and are deleted after about a day.

4.How we use it

For our own purposes

• to create and run accounts, set up and operate each business’s receptionist, and carry out the requests owners send us;
• to bill and collect payment;
• to provide support and send service messages, such as setup, billing and security notices;
• to send marketing about our products to business contacts who have agreed to receive it;
• to run our live demos, enforce their limits, check the quality of the receptionist demo’s recorded calls and follow up with the people who tried them;
• to keep the Service secure and prevent fraud, abuse and misuse;
• to comply with the law and enforce our agreements; and
• to create aggregated or de-identified statistics (such as call latency and demo minutes) that we use to run and improve the Service.

For the businesses we serve

On each business’s instructions: to answer calls and messages, take messages, book appointments, send confirmations and follow-ups, run outreach campaigns, and show the business its own records.

We do not sell personal information, and we do not use it for third-party advertising.

5.Consent

We collect, use and disclose personal information with consent, express or implied as the law allows, or where the law otherwise permits it, for example to meet a legal obligation or to prevent fraud.

For callers and contacts of a business, the business is responsible for having the consent it needs. JULY Call helps: every call answered by the AI starts with a recording notice, in the language of the greeting, automated and marketing texts tell you to reply STOP to opt out, and emails carry an unsubscribe link.

You may withdraw your consent at any time, subject to legal or contractual limits. Withdrawing it may limit what we can do for you; for example, we cannot run an account without the account owner’s contact details. You can stop marketing from us at any time with the unsubscribe link or by writing to us.

6.How the AI processes information

JULY Call uses Anthropic’s Claude models, in the United States, to understand and respond to the words of calls, texts, chats and emails, and to draft setup changes and outreach messages. On calls, speech-to-text (Deepgram) and text-to-speech (ElevenLabs) run inside Twilio, also in the United States. Under Anthropic’s commercial terms, customer content is not used to train its models.

Decisions the AI makes

For the businesses it serves, the AI makes some decisions on its own: which appointment times to offer and book, whether a message looks like spam (in which case it does not reply), and whether a reply to outreach means yes, no, later or stop. If a decision about you was made this way, you may ask the business, or us, to tell you what information was used and the main reasons, to correct that information, and to have a person review the decision.

7.Call recording and transcripts

Every call the AI receptionist answers on a business’s line, and every outreach call it places for a business, starts with this notice: “Just so you know, this call may be recorded for quality and to make sure we get your details right.” A line that greets callers in another language gives the notice in that language too.

Recording starts when the call connects, so the greeting and the notice are part of the recording. Calls are transcribed and summarized. The business can play back its recordings in its dashboard; our staff access them only to provide support, to keep the Service secure or when the law requires it, and every such access is recorded, with the reason for it, in an audit log that cannot be edited. Recordings are stored in Canada after the call and kept as described in How long we keep it. Calls to the receptionist demo on our website are recorded and transcribed the same way, with the same notice; our team plays them back to check the demo’s quality, and they are deleted 30 days after the call. Calls to our own sales and support line (the JULY Call line) are recorded too, with a notice at the start of the call, and kept 90 days. Calls on our concierge line and the outreach demo’s calls are not recorded.

If you do not want to be recorded, you can hang up and reach the business another way, and you can ask the business to delete a recording. Our AI and Call Recording Disclosure explains what callers hear and their choices.

8.Where information is stored and processed

In short: our records are stored in Canada. Calls, texts and email are processed in the United States (email in the European Union only when our fallback provider sends it), and some providers keep their own copies there for a limited time, as listed next. Your information does not stay only in Canada.

Copies our providers keep

Information processed or stored outside Canada is subject to the laws of the country where it is, and may be accessed by the courts, law-enforcement and national-security authorities of that country under those laws. We use contracts with our providers to protect it. Our Subprocessors list names each provider and its role.

9.Who we share it with

• our service providers (listed on our Subprocessors page), under contracts that limit their use of it;
• the business you dealt with, for information we process on its behalf;
• Google or Meta, when a business or user connects them (for example Google Calendar or WhatsApp);
• our professional advisers, under a duty of confidentiality;
• courts, regulators and law enforcement, when the law requires or permits it;
• a buyer or successor in a merger, financing or sale of all or part of our business, under confidentiality and only for that purpose; and
• anyone else, with your consent.

10.Google user data (Google Calendar and Google Meet)

This section covers the information JULY receives from Google when a staff member of a business connects their own Google Calendar (the Google Calendar and Google Meet add-on), and when someone signs in with Google. Connecting a calendar is optional, each person does it for themselves, and it can be undone at any time.

What we access

• your Google account’s email address, to show which account is connected (signing in with Google gives us your name and email address, which become your login);
• the list of your calendars (their names and IDs), only so you can choose which calendars count as busy; we keep the IDs you choose, not the names;
• free/busy information for the calendars you choose: the start and end times of busy periods only, never the titles, descriptions, attendees or locations of your events; and
• the events JULY itself creates for your bookings, which it adds to your main calendar (with a Google Meet link for a video appointment), moves and deletes. We never read, change or delete any other event in your calendar.

How we use it

Only to provide the booking features you turned on: the receptionist does not offer or book a time when you are busy, each booking appears in your calendar and stays in step with it, a video appointment gets a Meet link that goes into its confirmation and reminder, and the dashboard shows which account is connected. We do not use Google user data for advertising, we do not sell it, and we do not use it, or anything derived from it, to develop, improve or train any artificial intelligence or machine-learning model, ours or anyone else’s.

Who it is shared with

Your busy periods are turned into the open times the AI receptionist may offer: it receives those open times, never your calendar itself. The receptionist runs on Anthropic’s Claude models, and under Anthropic’s commercial terms customer content is not used to train its models. Google user data is stored with Supabase (in Canada) and processed by Vercel (in Canada, with logs in the United States), our service providers, only to run the Service. We do not transfer it to anyone else, except as this policy describes, when the law requires it, or with your consent. People at JULY do not read it, except with your permission (for example to help with a support request you made), when needed for security, or to comply with the law.

How we protect it

The connection uses Google’s OAuth 2.0. Your Google refresh token is stored encrypted at rest (AES-256) in our database in Canada, in a field that no user of the app can read, only our servers; it travels only over TLS 1.2 or higher, and short-lived access tokens are kept in server memory only. Each business’s workspace is separated from the others by row-level security.

How long we keep it, and how to delete it

Busy times are read when a time is offered or booked, and are not stored. Your account email, the calendar IDs you chose and the Google tokens are kept while you stay connected. When you disconnect (Dashboard, Connect, Disconnect), we revoke the access at Google and delete the tokens and settings; they are also deleted at once if Google stops accepting the connection, and when the business closes its workspace. The events JULY created stay in your calendar as your own entries, and you can delete them in Google Calendar at any time. You can also remove JULY’s access from your Google account at any time at myaccount.google.com/permissions, or ask us to delete this information (see “Contact” below).

Limited Use

JULY’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, including the Google Calendar API, adheres to the Google User Data Policy, including the Limited Use requirements.

11.How long we keep it

• Call recordings: 90 days by default. A business may ask us for a different period, between 7 days and 2 years. Then they are deleted. Political and campaign offices keep theirs 400 days by default, because the Canada Elections Act requires the recordings and scripts of election calls to be kept for one year after the election period. One exception, as proof under Canada’s Anti-Spam Legislation: a recording that captures a person’s spoken consent is kept for as long as that consent stands, and until 3 years after it is withdrawn, while the business’s account is open; then it is deleted.
• Calls to our sales and support line (the JULY Call line): the recording, 90 days after the call, then deleted; the transcript and the summary, with the lead the call created, 2 years after our last contact with you.
• Calls on our concierge line: not recorded. Their summaries are kept with the request they created.
• Receptionist demo recordings and transcripts: 30 days after the call, then deleted.
• Leads from the JULY Call line, our contact form and our live demos: kept 2 years after our last contact with you (a later demo counts as one, and any follow-up time you booked during a demo is kept with the lead), then deleted. Text conversations on the JULY Call line (both sides, and their summary): 90 days after the last message, then deleted, except the record that you replied STOP, which we keep for as long as we need it to honour your request. The live demo’s texted codes (kept only as one-way codes, with the number they went to): 30 days.
• Records of who accepted our Terms for a business, which version and when: kept with the business’s billing records.
• Transcripts, summaries, call logs, messages, contacts, appointments and outreach events: kept while the account is active, and deleted within 60 days after the account closes. A business may export them first.
• When a business’s account closes: we email the account owner the date its data will be deleted and how to export it first; until that date the account can be reopened. Within 60 days after closing (for a political or campaign office, once its 400-day recording period has passed), everything we hold for the business is deleted: recordings, transcripts, messages, contacts, appointments, outreach, consent and opt-out records, settings and its users’ logins. Only billing records are kept, as described next.
• Billing records: kept 7 years, as Canadian tax law requires.
• Website demo ledgers (salted IP hashes, salted phone hashes, durations, outcomes): 90 days (a receptionist demo call’s recording and transcript go after 30 days, as above). The outreach demo’s calls are not recorded, and its ledger erases the phone number when the demo ends (your demo lead keeps it, as above).
• Opt-out and consent records: kept as long as needed to honour them while the business’s account is open, because they protect the person who opted out; deleted with the rest of its data when the account closes.
• Backups: Our database provider keeps daily backups for 7 days; then they are deleted.

Other personal information is kept only as long as needed for the purposes in this policy or as the law requires, then deleted or anonymized.

12.How we protect it

Information is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256, Supabase). Each business’s workspace is separated by row-level security, and access inside a workspace depends on the user’s role. Sign-in is through Supabase Auth (email, or Google with OAuth 2.0). Webhooks from Twilio are verified by their signatures, and our voice relay is authenticated with a secret. Card details stay with Helcim. No system is perfectly secure, but we work to protect information appropriately for its sensitivity. See our Security page.

13.Your rights

Subject to the law and its exceptions, you may:

• ask whether we hold personal information about you, see it, and learn how it has been used and to whom it has been disclosed;
• ask us to correct information that is inaccurate or incomplete;
• withdraw your consent;
• ask us to delete information, or (in Quebec) to stop disseminating it, where the law gives that right;
• in Quebec, receive computerized information you provided in a structured, commonly used technological format; and
• ask about decisions made by the AI, as described in How the AI processes information.

To make a request, write to our Privacy Officer at support@july.ca. We will confirm your identity before we act, and we will reply within the time the law sets (generally 30 days). If we cannot meet a request, we will explain why, unless the law prevents us.

Complaints

Please contact us first, and we will try to resolve your concern. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or Quebec’s Commission d’accès à l’information (cai.gouv.qc.ca), as applicable.

14.If you dealt with a business that uses JULY Call

The business controls your information, so please send requests about it (access, correction, deletion, recordings) to the business. If you write to us instead, we will pass your request to the business and help it respond; to do that, we may need to tell the business who asked.

To stop messages from a business: reply STOP to its texts, use the unsubscribe link in its emails, or, when the assistant calls you for the business, tell it that you do not want to be contacted. Our Messaging and Outreach Policy explains how opting out works.

15.Cookies and similar technologies

We use only what the Service needs to work:

• sign-in cookies set by our authentication provider, Supabase Auth (named “sb-…-auth-token”), which keep you signed in;
• a short-lived cookie (“jc_signup”) that remembers your industry and business name for up to 30 minutes while you sign up with Google, and is cleared once you are signed in;
• a short-lived cookie (“apc_gstate”) that protects the step where you connect Google Calendar: it lasts up to 10 minutes and is cleared when the connection completes;
• a cookie (“jc_terms”) that remembers, for up to 30 days, that your business has accepted the current Terms, so we do not ask again on every page;
• a setting in your browser’s local storage that remembers you closed the dashboard’s getting-started checklist;
• after you confirm your number for the live demo, a token in the browser tab’s session storage (“jc_demo_lead”) that lets you start more demo calls for up to a day without a new code; it is cleared when the tab closes; and
• on a business’s website, the JULY Call chat widget keeps a chat session ID and the last 40 messages of your conversation in the browser tab’s session storage, which is cleared when the tab closes.

We do not use analytics, advertising or tracking cookies or scripts on our website or in the app. When you pay, Helcim’s payment form opens in a secure frame provided by Helcim; when you sign in with Google, you use Google’s pages; and when you try the live demo, your browser connects to Twilio to carry the call audio. Those providers handle that information under their own terms.

16.Children

JULY Call is a service for businesses and is not directed at children. We do not knowingly collect personal information from children for our own purposes. People who call or message a business may include minors; that information is handled for the business, which is responsible for it.

17.If there is a breach

If a breach of security safeguards involves personal information and creates a real risk of significant harm (or, in Quebec, a risk of serious injury), we notify the affected people and the privacy regulators as the law requires, and we keep a record of breaches. When the information is held for a business, we tell the business without undue delay and help it meet its own obligations.

18.Changes to this policy

We may update this policy. The effective date at the top shows the current version. If we make a material change, we will tell account owners by email or in the Service, and post a notice on our website, before it takes effect.

19.Contact

Privacy Officer, JULY Marketing Inc., 666 Burrard Street, Suite 500, Vancouver, British Columbia, Canada. Email support@july.ca.