Privacy Policy

This Privacy Policy explains how SmartSMB (“SmartSMB”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal information. SmartSMB operates the website at smartsmb.ai and provides an AI receptionist and missed-call recovery service that answers calls, sends and receives text messages, qualifies leads, and books and rebooks appointments for small businesses.

SmartSMB is operated by SmartSMB Inc., based in Alberta, Canada. We are committed to handling personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), Canada’s Anti-Spam Legislation (“CASL”), and applicable provincial privacy laws.

1. The two ways we handle information

We handle personal information in two distinct capacities, and your rights differ depending on which applies:

• As the organization (controller). When you visit our website, request a demo, or sign up as a business customer, we collect and control your information for our own purposes (operating, billing, and supporting your account).
• On behalf of our business customers (processor).When our AI receptionist answers calls and messages on behalf of a SmartSMB business customer, we process the personal information of that business’s callers and customers (“end users”) under that business’s instructions. The business is responsible for that information and for obtaining the consents described below. If you are an end user and want your information accessed, corrected, or deleted, contact the business you called, or contact us and we will route your request.

2. Information we collect

From business customers: name, business name, email address, phone number, billing and payment details, account credentials, the configuration of your AI agent, and the integrations you connect (such as your calendar).

From callers and end users (on behalf of our customers): phone number, name, the reason for the call, appointment and scheduling details, address or service location, and any other information a caller provides during a call or text conversation.

Call and message content: audio recordings of phone calls, automated transcriptions of those calls, and the content of SMS/text conversations handled by the service.

Automatically: call metadata (time, duration, caller ID, outcome), usage and performance metrics, log data, device and browser information, IP address, and cookies/similar technologies used to operate the site.

3. Call and message recording — consent

The service records and transcribes phone calls so the AI can understand and respond, so calls can be reviewed for quality and accuracy, and so we can confirm the system worked. Recording begins at the start of a call.

• We require our business customers to notify callers that calls may be recorded and to obtain any consent required by law for their jurisdiction and call type.
• Where SmartSMB controls the greeting, the AI provides an audible notice that the call is handled by an automated assistant and may be recorded.
• A live voice or browser demo on our website records audio so the AI can respond and so we can confirm the demo worked. Demo recordings are used only to operate and improve the demo and are deleted on request.

4. How we use information

• To provide, operate, and maintain the AI receptionist and related features.
• To answer calls and messages, qualify leads, and book and rebook appointments.
• To send appointment confirmations, reminders, and follow-ups on behalf of our customers.
• To process payments, manage subscriptions, and provide support.
• To monitor, secure, troubleshoot, and improve the service and its accuracy.
• To report performance and return-on-investment metrics to the relevant business.
• To comply with legal obligations and enforce our agreements.

We use de-identified and aggregated data (which does not identify any individual) to measure and improve the service. We do not sell personal information, and we do not use the content of customer calls, messages, or transcripts to train third-party foundation models.

5. Consent

We rely on consent to collect, use, and disclose personal information, except where collection, use, or disclosure without consent is permitted or required by law. By using the service, business customers consent to this Policy. Business customers are responsible for obtaining the consent of their callers and end users for the recording, messaging, and processing performed through the service. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by contacting us — though doing so may prevent us from providing the service.

6. Automated messages (CASL)

The service sends commercial and transactional electronic messages (such as missed-call text-backs, confirmations, reminders, and follow-ups) on behalf of our business customers. Our customers are responsible for ensuring they have the consent required under CASL to message their recipients. Every recipient can opt out by replying STOP (or as otherwise indicated in the message), and opt-out requests are honoured promptly.

7. Disclosure and service providers

We do not sell or rent personal information. We disclose it only as follows:

• Service providers (subprocessors) who process information on our behalf under contractual confidentiality and data-protection obligations, including: Retell (voice AI), Twilio (telephony and SMS), Supabase (managed database and storage), Stripe (payment processing), Resend (transactional email), Cal.com (scheduling), Vercel and Netlify (hosting), and our AI model providers (for inference). Some of these providers process or store data outside Canada (see below).
• Our business customers receive the information collected on their behalf by the AI receptionist.
• Legal and safety— where required to comply with law, respond to lawful requests, enforce our terms, or protect rights, safety, and property.
• Business transfers— in connection with a merger, acquisition, or sale of assets, subject to this Policy.

8. Where information is stored and cross-border transfers

Some of our service providers store and process data in the United States and other countries. As a result, personal information may be transferred to, stored in, and processed outside Canada, where it may be accessible to courts, law enforcement, and regulatory authorities under the laws of those jurisdictions. We use providers that offer contractual and technical safeguards comparable to those required under Canadian law.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and row-level security on stored data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Retention

We retain personal information only as long as needed for the purposes described in this Policy, to provide the service, and to meet legal, accounting, and reporting requirements, after which it is deleted or de-identified. Business customers may request deletion of data processed on their behalf, subject to legal retention obligations. Demo recordings are deleted on request.

11. Your rights

Subject to legal limits, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion; withdraw consent; and ask questions about how your information is handled. To exercise these rights, email support@smartsmb.ai. We will respond within the time required by applicable law. End users should generally direct requests to the business they contacted; we will assist in routing such requests.

12. Cookies and analytics

Our website uses cookies and similar technologies to operate the site, remember preferences, and measure usage. You can control cookies through your browser settings; disabling them may affect site functionality.

13. Children

The service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice. Continued use of the service after changes take effect constitutes acceptance.

15. Contact us

For privacy questions, requests, or complaints, contact our Privacy Officer at support@smartsmb.ai. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.