Last updated: September 23, 2026
CallZi AI ("CallZi", "we", "us") provides AI phone-receptionist software for businesses. This policy explains what we collect, how we use it, and the choices you have.
gmail.send (send-only; we cannot read, search, or delete your inbox) and calendar.events (create appointment events and query free/busy availability). We use these solely to send booking confirmations and place appointments for your business. When checking availability we query only the Google Calendar free/busy endpoint, which returns booked time ranges only — never event titles, descriptions, or attendee details.We use your information to operate the service: run your AI receptionist, book appointments on your calendar, send confirmation and summary emails from your connected account, remember returning callers, and provide call logs and analytics to you.
CallZi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide user-facing features of CallZi (sending your booking/summary emails and managing your calendar). We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as needed to provide the service, comply with law, or with your consent. We do not allow humans to read your Google data except with your consent, for security/debugging, or as required by law.
CallZi is an integration platform that routes voice interactions through third-party AI providers via the Vapi orchestration gateway. Google user data — raw, aggregated, anonymized, or derived — is never used to train, fine-tune, or improve any foundational or generalized AI/ML model, whether ours or a provider's.
Our AI subprocessors are used only on their standard API tiers, which by contract do not train on API data: OpenAI (language model, gpt-4o-mini), Deepgram (speech-to-text), Cartesia (text-to-speech), and Google Gemini (post-call transcript summarization only). The AI models never receive your Gmail contents (the scope is send-only) and never receive calendar event details — availability is derived from free/busy time ranges only. Post-call summarization operates on the call transcript, not on Google Workspace data.
We protect your data with encryption in transit (TLS 1.2+ / HTTPS on all endpoints) and encryption at rest on our servers. Google OAuth refresh tokens are stored server-side with restricted filesystem permissions, are never exposed to the browser or any client, and are used only to mint short-lived access tokens for the actions above. Access to production systems is limited to authorized personnel. We apply the principle of least privilege throughout.
We use trusted subprocessors to deliver the service: voice/telephony (Vapi, Twilio), AI providers (OpenAI, Deepgram, Cartesia, Google Gemini), and email/hosting infrastructure. We do not sell your personal information.
You can disconnect your Google account at any time in the console, which immediately revokes and deletes our stored access tokens. You can request deletion of your account and all associated data by contacting us; call recordings and transcripts are retained only as long as needed to provide the service and are deleted on request.
Questions? Email elias.elghaldy@gmail.com.