Privacy Policy

Introduction

SIPSTACK Inc. ("SIPSTACK", "we", "us", or "our") is a telecommunications and AI software company incorporated in Canada with its principal place of business at 575-3093 Bathurst St., Toronto, ON M6A 2A3. This Privacy Policy applies to all SIPSTACK products and services, including Nova PBX, Flare SMS, Aura AI, SARA AI, Pulse, and Switchboard (collectively, the "Services").

This policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and your rights regarding your data. By using our Services, you agree to the collection and use of information in accordance with this policy.

If you have questions, contact our Privacy Officer at [email protected] or our Data Protection Officer (EU/UK matters) at [email protected].

Information We Collect

Information You Provide Directly

When you register for an account, subscribe to our Services, or contact our support team, you may provide:

Identity information: Name, job title, company name
Contact information: Email address, phone number, mailing address
Account credentials: Username, password (stored as a one-way hash — we never store plaintext passwords)
Billing information: Billing address and payment method details. Payment card data is processed directly by our third-party payment processor and is not stored on SIPSTACK servers.
Support communications: Messages, tickets, and attachments you send to our support team

Information Collected Automatically

When you use our Services, we automatically collect:

Technical data: IP address, browser type and version, operating system, device identifiers
Usage data: Pages viewed, features used, time spent, referring URLs, click patterns
Log data: Server access logs, error logs, API request/response metadata
Cookies and tracking technologies: See our Cookie Policy for full details, and Website Analytics and Advertising Partners for who receives website data
Approximate country (website): To show prices in the right currency, our website asks our own CDN (Cloudflare) which country your connection comes from. No third-party geolocation service is used

Information Collected Through Our Products

The specific data we collect depends on which SIPSTACK products you use:

Nova PBX

Nova PBX is our cloud phone system. When you use Nova PBX, we collect:

Call Detail Records (CDRs): Caller/callee phone numbers, call duration, timestamps, call disposition, and routing path
Caller names: The caller-ID name that the calling party's phone carrier sends with an incoming call, and the number it was sent with. We keep each name we receive for a number, with the dates we first and last saw it, so your call history can show who called even when a later call arrives without a name. A name is shown only to the organization that received the call. We do not keep a name from a call that arrives marked as anonymous, private or restricted, or that withholds the caller's name. If your organization saves a name on a text-message contact, we may use it the same way, for your organization only.
Call recordings: Audio files of recorded calls (if recording is enabled). Recordings are stored with our object-storage provider, with regional routing based on your billing currency. See Call Recording Disclosure for consent obligations.
Voicemail: Audio files and, where enabled, transcriptions of voicemail messages
SIP registration data: Device IP addresses, SIP user agents, registration timestamps, device MAC addresses
PBX configuration: Extensions, ring groups, IVR menus, queues, time conditions, call routing rules, device provisioning data
AI-processed data (feature availability varies by tier):
- Transcription: Real-time and post-call transcripts generated from call audio (all tiers)
- Sentiment analysis: AI-generated sentiment scores applied to call transcripts (Nova Ultra; Nova Core and Pro when the account owner turns it on; Enterprise where enabled)
- Call summarization: Automated summaries of call content (Nova Ultra; Nova Core and Pro when the account owner turns it on; Enterprise where enabled)
- Speaker diarization: Speaker identification in multi-party calls (Nova Ultra; Enterprise where enabled)
- AI data retention: kept and deleted together with the call recording or voicemail it was generated from. See Data Retention

Flare SMS

Flare SMS is our business messaging platform. We collect:

Contact data: Phone numbers, names, email addresses, custom fields, tags, and list memberships for contacts you import or create
Message logs: Content, sender/recipient numbers, delivery status, timestamps, and direction (inbound/outbound) for all SMS and MMS messages
Campaign data: Broadcast content, scheduled times, audience lists, A/B test variants, drip campaign steps, and delivery analytics
Opt-out records: STOP/UNSUBSCRIBE responses and suppression list memberships to enforce messaging compliance
Template library: Message templates you create
Webhook delivery logs: Outbound webhook payloads, delivery attempts, and response codes (HMAC-signed)

Aura AI

Aura AI is our voice agent platform (Enterprise tier). We collect:

Voice call audio: Real-time audio input processed by our self-hosted Automatic Speech Recognition (ASR) engine to generate transcripts during active calls
Transcripts: Text transcriptions of interactions with AI voice agents
LLM-generated responses: Outputs from our large language model inference pipeline
TTS audio: Text-to-speech audio generated to respond to callers

Voice call audio is processed in real time and is not retained beyond the call session unless call recording is separately enabled on the associated Nova PBX extension.

SARA AI

SARA AI is our intelligent auto-responder for email support and SMS conversations. We collect:

Customer email content: Inbound emails forwarded to SARA for processing, including full message body and headers
SMS message content: Inbound SMS/MMS messages processed by SARA auto-reply (when enabled on a Flare SMS number), including message body and sender phone number
Conversation history: Full email thread and SMS conversation context tracked per ticket or conversation, stored in our internal database
Vector embeddings: Semantic representations of conversation content used for knowledge base retrieval (stored in our self-hosted vector database — not shared externally)
AI-generated draft responses: Draft replies created by SARA for human review before sending (email) or auto-sent based on confidence thresholds (SMS)

Knowledge base learning: SARA's shared knowledge base is built only from SIPSTACK's own support interactions with our customers. When a ticket in SIPSTACK's support desk is resolved, SARA may draft a generalized question-and-answer entry from the resolution, written to leave out personal information such as names, account numbers, phone numbers, IP addresses and billing amounts. Each draft is automatically checked for personal information, any detected is flagged for the reviewer, and every entry must be approved by a SIPSTACK staff member before it can be used. The shared knowledge base is never built from data we process on our customers' behalf, such as their calls, voicemail and call transcripts, or the SMS, chat and email conversations SARA handles for their own end users. Any knowledge base built from an organization's own data is private to that organization and is used only to provide the Services to it. This is retrieval-augmented generation (RAG) — not model weight training. Enterprise customers may opt out of the use of their support tickets by contacting [email protected].

Important note regarding third-party AI inference: When SARA generates a response to a support email, a portal chat message, or an SMS, the message content and the retrieval context assembled for that reply are sent to a US-based third-party AI inference provider for large language model inference. That provider is currently the primary language model for SARA text responses on all three of those surfaces. Our self-hosted models handle voice-agent language processing and all retrieval embeddings, which are not shared externally. We intend to move SARA text inference onto self-hosted GPU infrastructure and eliminate this transfer; we have not committed to a date. See AI Data Processing and Data Sharing and Sub-Processors for full details.

Pulse (Mobile App)

Pulse is our mobile UCaaS application for iOS and Android. We collect:

Authentication tokens: JWT access tokens (30-day expiry) and refresh tokens (90-day expiry), stored in your device's hardware-backed secure storage (iOS Keychain / Android Keystore)
SIP credentials: Your extension SIP username and password, delivered over HTTPS and stored encrypted
TURN credentials: Ephemeral ICE/TURN credentials with 5-minute TTL for WebRTC connectivity — not persisted
Push notification tokens: Device push tokens (APNs/FCM) for incoming call notifications (when push notifications are enabled)
WebRTC session data: ICE candidates, session description protocol (SDP) used for establishing media sessions that are encrypted between the app and our edge node — not stored after session ends

Switchboard (Customer Portal)

Switchboard is the web portal used by administrators and end users to manage their SIPSTACK account. We collect:

Session data: Authenticated sessions stored in our database with expiry management
User profiles: Name, email address, role, organization membership, and assigned permissions
Audit trails: Administrative actions, login history, account changes, and impersonation events (for support purposes)
Billing interactions: Invoice views, payment method updates, subscription changes
Session recordings: Recordings of how you use the portal, with form inputs masked (see Session Replay in Switchboard)

How We Use Your Information

We use the information we collect to:

Provide and operate the Services: Deliver calls, route messages, process AI tasks, authenticate users, manage subscriptions, and generate invoices
Maintain and improve the Services: Monitor system performance, diagnose issues, prevent abuse, and develop new features
Communicate with you: Send transactional notices (receipts, password resets, security alerts, service status updates), and with your consent, marketing communications about new features or products
Ensure security and prevent fraud: Detect suspicious activity, enforce rate limits, block abusive traffic, and maintain network integrity
Comply with legal obligations: Respond to lawful requests from authorities, fulfill regulatory reporting requirements, and meet telecommunications regulatory obligations
Analytics and support: Generate usage statistics to understand platform adoption and guide product decisions, and record Switchboard sessions to reproduce and fix reported problems (see Session Replay in Switchboard). Our Services do not profile individual users for advertising. On our public website, if you accept the Marketing & Advertising cookie category, we share website-visitor identifiers and browsing events with advertising partners (see Website Analytics and Advertising Partners).
AI knowledge base improvement: We may draft generalized question-and-answer entries from tickets resolved in SIPSTACK's own support desk to add to SARA's shared retrieval knowledge base. Entries are written to leave out personal information, any personal information detected is flagged for the reviewer, and each entry must be approved by a SIPSTACK staff member before it can be used. The shared knowledge base is never built from data we process on our customers' behalf. It is used for retrieval-augmented generation (RAG) only — not for training model weights. Enterprise customers may opt out of the use of their support tickets by contacting [email protected].

Customer Testimonials

If you choose to submit a customer testimonial through your account, we collect the content you provide (your star rating, written testimonial, name, job title, company name, and any logo you upload) along with consent evidence — your identity and the IP address, user-agent, and timestamp of your acceptance. We use this information to publish and promote your testimonial across our marketing surfaces in accordance with the Customer Testimonial & Logo Release you accept at submission. This data may be processed and stored in the United States. If you are a Canadian customer, you may withdraw your consent and request removal of your testimonial from SIPSTACK-controlled marketing surfaces at any time, and we will honor such requests on a forward-looking basis as described in the Release.

Call Recording Disclosure

Nova PBX allows you to enable call recording on your extensions, queues, and inbound routes. Call recording laws vary by jurisdiction. In some jurisdictions (including Canada, and US states such as California, Florida, Illinois, and Pennsylvania), recording a call requires the consent of all parties. You — not SIPSTACK — are responsible for:

Determining the consent requirements that apply to your calls based on your location and the location of the called party
Configuring and playing recording announcements to all parties before recording begins
Obtaining any required consent

SIPSTACK provides configurable recording disclosure announcements through Nova PBX to help you meet these obligations, but the legal responsibility remains with you as the subscriber.

How long call recordings are kept is set by your account owner in Switchboard under Account Settings → Security → Call Recording Retention: 7, 14, 30 or 90 days, 1 year, or Keep forever. Recordings older than the period you choose are deleted automatically by a daily process. The default is Keep forever: if no retention period has been set, call recordings are not deleted automatically. Recordings placed under legal hold are never deleted automatically.

Recordings of calls handled by the Aura AI voice agent are also deleted automatically once they are older than your Nova plan's retention limit (Nova Core: 30 days · Nova Pro: 180 days · Nova Ultra: 365 days), whether or not you have set a retention period. This plan-based deletion applies while your account has an active Nova subscription.

AI Data Processing

SIPSTACK operates both self-hosted AI infrastructure and, for specific features, third-party AI services.

Self-Hosted AI (No External Data Transfer)

The following AI services run exclusively on SIPSTACK-owned infrastructure in Canada. No data is transferred to external parties for these functions:

| Service | Model | Function | |---------|-------|----------| | ASR (real-time) | Self-hosted open-source speech-recognition model | Real-time call transcription for Nova PBX and Aura AI | | ASR (post-call) | Self-hosted open-source speech-recognition model | Post-call transcription and speaker diarization | | LLM (voice) | Self-hosted open-source LLM | Language model for the Aura AI voice agent | | Text-to-Speech | Self-hosted open-source speech-synthesis models | Voice synthesis for IVR prompts and AI agents | | NLP | Self-hosted open-source language-processing models | Entity extraction, text classification, topic modeling | | Embeddings (RAG) | Self-hosted embedding model and vector database | Semantic search and knowledge base retrieval for SARA |

Third-Party AI Processing

| Provider | Location | Function | Data Sent | Duration | |----------|----------|----------|-----------|----------| | AI inference provider | United States | Primary LLM inference for SARA AI text responses (support email, portal chat, SMS) | Customer message content + RAG retrieval context | Ongoing; we intend to migrate this to self-hosted infrastructure and have not committed to a date | | Text-to-speech providers (two) | United States | Text-to-Speech (optional feature) | Text strings for synthesis | Only if enabled |

Our AI inference provider processes data under a data processing agreement with SIPSTACK and does not use data submitted via API for training its models. We are actively working to eliminate this third-party dependency by deploying dedicated self-hosted GPU infrastructure.

We do not sell your personal information for money. On our public website only, and only if you accept the Marketing & Advertising cookie category, we share website-visitor identifiers and browsing events with Meta, LinkedIn and Microsoft (Bing) for advertising and retargeting. Under the CCPA/CPRA this may be "sharing" of personal information for cross-context behavioral advertising; you can opt out at any time (see California — CCPA/CPRA). We share your information only with the following categories of parties. The named sub-processors are listed in our Data Processing Addendum (Canada) and on our GDPR Compliance page.

Sub-Processor List

| Sub-Processor Category | Location | Purpose | Data Categories Shared | |---|---|---|---| | AI inference provider | United States | Primary LLM inference for SARA AI text responses (support email, portal chat, SMS) | Customer message content, RAG retrieval context | | Payment processor | United States | Payment processing and billing | Billing address, payment method details | | Telecommunications carrier | United States | Voice carrier, SMS carrier, DID provisioning, E911 | Phone numbers, message content (for delivery), voice routing metadata | | Object-storage provider (PBX media) | Canada and United States | Object storage for PBX media, regionally segregated by billing entity | Call recordings, voicemail audio, MOH, TTS, media files | | Object-storage provider (system backups) | United States | Database backup archive and internal operations logs (system data — not user-generated content) | Database write-ahead log segments, internal job output | | CDN and network-security provider | Global | CDN, DDoS protection, DNS, bot protection | Web traffic, IP addresses | | Error-monitoring provider | United States | Application error monitoring | Error messages, stack traces, device metadata, client IP address, and — for errors raised while handling an API request — the request method and path. Cookies, credential and authorization headers, request bodies and query strings are removed before data leaves our systems | | Log-management provider | United States | Application logging and observability | Application and server access logs, error diagnostics, API request/response metadata, IP addresses | | Text-to-speech providers (two) | United States | Text-to-Speech synthesis (optional) | Text content | | Hosting provider (primary infrastructure) | Canada | Dedicated data-centre hosting of our primary database, application servers, self-hosted AI speech and language models, and transactional email | Essentially all customer data held in our primary database and services | | Virtual-server provider (SIP nodes, Canada) | Canada | SIP registration proxy, session border controller and media-relay nodes for Canadian-region tenants | SIP registration and signalling data (phone numbers, extension identifiers, device IP addresses, call-routing metadata); call media in transit | | Mobile push-notification services (two) | United States | Delivering call, message and voicemail notifications to iOS and Android devices running our mobile app | Device push tokens, caller or sender name and number, notification title, and for inbound text messages a preview of up to the first 140 characters | | Hosting provider (SIP nodes, United States) | United States | SIP registration proxy and media relay for U.S.-region tenants, and our carrier-facing session border controller. Canadian-region tenants' call signalling may transit these nodes where a phone number is homed with the carrier on that session border controller or on failover, and their call media may be relayed through them on failover | SIP registration and signalling data (phone numbers, extension identifiers, device IP addresses, call-routing metadata); call media in transit | | International carrier | United States | International outbound call termination | Calling and called numbers, caller ID; call audio in transit | | Backup carrier and number supplier | Canada | Backup and international-failover outbound calling; supply of phone numbers | Calling and called numbers, caller ID; call audio in transit for the calls it carries; the phone numbers it supplies | | Mail server provider | Canada | Secondary inbound mail server for sipstack.com email addresses | Email sent to SIPSTACK addresses (such as support and privacy), including the sender's address and the message content | | Product-analytics and session-replay provider | United States | Product analytics and support session replay for the Switchboard portal and our website | Portal user identity (name, email, role, organization), usage events, page addresses (access tokens removed), and session recordings that may include on-screen portal content (form inputs masked) |

Website Analytics and Advertising Partners

These services run on our public website (sipstack.com). Analytics and advertising services load only after you accept the matching cookie category, and stop when you withdraw it. Advertising services stay off when your browser sends a Global Privacy Control signal. Manage your choices with Your Privacy Choices in the footer of every page. See our Cookie Policy for the cookies each service sets.

| Vendor | Purpose | Data | Country | Basis | |---|---|---|---|---| | Google Analytics 4 (Google LLC) | Website traffic analytics | Pseudonymous browser ID, pages viewed, referrer, device and browser type, approximate location (IP address truncated) | United States | Consent (Analytics & Performance) | | Our product-analytics provider (US region; named in our Sub-Processor List) | Website product analytics, session replay and error capture | Pseudonymous browser ID, usage events, page addresses, session recordings (form inputs masked); if you submit a form while analytics is on, the name, email and company you entered | United States | Consent (Analytics & Performance) | | Meta Platforms (Meta Pixel) | Advertising measurement and retargeting | Browser identifier (_fbp), pages viewed, website events such as form submissions, IP address, browser details | United States | Consent (Marketing & Advertising) | | LinkedIn (Insight Tag) | Advertising measurement and retargeting | LinkedIn browser identifiers, pages viewed, conversion events, IP address, browser details | United States | Consent (Marketing & Advertising) | | Microsoft (Bing Ads UET) | Advertising measurement and retargeting | Microsoft browser identifiers (MUID, _uetvid), pages viewed, conversion events, IP address, browser details | United States | Consent (Marketing & Advertising) | | Cloudflare Web Analytics | Cookieless page-load and performance measurement added by our CDN | Page address, referrer, page-load timings, browser type, country. No cookies and no cross-site identifier | Global (Cloudflare edge network; Cloudflare, Inc. is in the United States) | Strictly necessary / legitimate interests (site operation) | | Cloudflare Turnstile | Bot protection on our website forms | Browser and device signals, IP address, challenge result | Global (Cloudflare edge network; Cloudflare, Inc. is in the United States) | Strictly necessary / legitimate interests (preventing abuse) | | ipinfo.io | Looks up your ISP and approximate location for the network test tool, only when you click to start the test | IP address | United States | Your request (you run the test) |

Telecommunications Carriers

We share data with our telecommunications carrier partners as technically necessary to complete calls, route messages, and provide interconnection services. This includes caller and callee phone numbers, call routing data, and message content. These transfers are governed by industry regulations and standards.

Legal Requirements

We may disclose your information when required by law, court order, or lawful process from a governmental or regulatory authority. Where legally permitted, we will notify you before complying with such a request.

Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity. We will provide notice before your information becomes subject to a different privacy policy.

Data Retention

| Data Type | Retention Period | Notes | |---|---|---| | Call recordings | Set by your account owner: 7 days to 1 year, or Keep forever. Default: Keep forever | Deleted automatically once older than the period you set; not deleted automatically if no period is set. Aura AI voice-agent recordings are also deleted at your Nova plan limit (Nova Core: 30 days · Nova Pro: 180 days · Nova Ultra: 365 days), except where the law requires us to keep a recording | | Voicemail | Nova Core: 30 days · Nova Pro: 180 days · Nova Ultra: 365 days | Deleted automatically once older than your plan's limit, while your account has an active Nova subscription | | AI data (transcripts, call summaries, sentiment scores) | Same as the call recording or voicemail it was generated from | Stored with that call recording or voicemail and deleted when it is deleted (see the two rows above). For Aura AI voice-agent calls, the transcript, summary and details captured during the call are removed at your Nova plan's retention limit (see Nova plan details), only while your account has an active Nova subscription; the basic call record remains. Without an active Nova subscription they are not removed automatically | | SARA conversation history | Duration of subscription + 30-day cooling-off | Email threads, SMS auto-reply conversations, draft responses | | SARA knowledge base | Indefinite (while platform is active) | Generalized Q&A entries drawn only from SIPSTACK's own resolved support tickets; each entry approved by staff before use | | Call Detail Records (CDRs) | 7 years after the end of the fiscal year in which the record was created, then destroyed | The metadata log of each call and message (calling and called numbers, date and time, duration, cost). Kept in full (not masked or pseudonymized). Not deleted on cancellation or on request: we keep CDRs for legal, tax, fraud-prevention and billing purposes. Self-serve data export includes the last 12 months | | SMS / MMS message logs | Duration of subscription | Available in self-serve data export (last 12 months) | | Application audit logs | 2 years from the event recorded, on every plan, then destroyed | Records of sign-ins, administrative actions, account changes and support access (impersonation), kept for security, fraud prevention, accountability and legal claims. Not deleted when an account is cancelled or ends: each record is kept until it is 2 years old. Audit records of billing, payment and invoice activity are billing records: kept 7 years after the end of the fiscal year in which they were created, then destroyed | | Billing and payment records | 7 years after the end of the fiscal year in which the record was created, then destroyed | Kept in full; required for tax and accounting compliance | | Account data after cancellation or trial expiry | Restorable for 90 days after your last subscription ends, then deleted or anonymized. On cancellation of your entire account: 30-day cooling-off period, then deleted or anonymized | Services suspended when the subscription ends; reactivate or export anytime before deletion; deletion honored on request. Billing and payment records, CDRs and application audit logs follow their own rows above. For-cause / AUP terminations: 30-day retrieval period, then deletion. | | Push notification tokens | Duration of active device registration | Deleted on logout or token refresh | | Backups | Purged on rotation, within 90 days | Data deleted from our live systems is purged from backup and disaster-recovery archives as they rotate, within 90 days | | Caller names (caller ID received on incoming calls) | 7 years after the last call on which we received that name, then deleted | Shown only to the organization that received the call. Names your users save on text-message contacts are deleted when the contact is deleted |

Individual user login profiles are not deleted when an organization's account ends: a user may belong to other organizations or hold their own account, so we keep the profile, with its history, in our own right. This does not give the user continued access to the former organization's data.

You may request deletion of your data at any time. See Your Rights and Choices for self-serve options.

Where Your Data Is Stored

SIPSTACK operates a regional data model for user-generated content. The region that processes your calls, messages, voicemail, and recordings is determined by your billing entity (Canadian or U.S.). PBX, SIP routing (Nexus), and media processing are regionally separated, with the exceptions for carrier routing and failover described below; session border controllers (SBCs) carry SIP signaling only — no media (voice/MMS) transits an SBC.

Canada

Object storage, Canadian region (Toronto): Call recordings, voicemail audio, music-on-hold, TTS audio, and other PBX media for organizations billed under the SIPSTACK Canadian entity (CAD).
Nexus CA SIP cluster (nexus-ca.sipstack.com): SIP registrations and call signaling for Canadian-region tenants, on virtual servers operated by our hosting provider in Toronto. Voice media (RTP) for Canadian-region tenants is normally relayed in Canada; the exceptions for carrier routing and failover are described under United States below.
Self-hosted infrastructure (Canadian data centre operated by our hosting provider in Toronto): Our primary database, cache, and self-hosted general object storage (legacy — being migrated); all on-premise AI speech and language models (speech recognition, text-to-speech, language models, embeddings and vector search, NLP); and transactional email delivery. Application logging and observability are currently provided by a third-party service outside this infrastructure — see the Sub-Processor List.
Backup carrier and number supplier (Montréal, Québec): Backup and international-failover outbound calls, and supply of phone numbers. Receives calling and called numbers, caller ID and call audio for the calls it carries.
Mail server provider (Toronto): Secondary inbound mail server for email sent to sipstack.com addresses.

United States

Object storage, U.S. region: Call recordings, voicemail audio, music-on-hold, TTS audio, and other PBX media for organizations billed under the SIPSTACK U.S. entity (USD).
Nexus US SIP cluster (nexus-us.sipstack.com): SIP registrations, call signaling and media relay for U.S.-region tenants, on servers operated by our hosting provider in Tampa, Florida, which also hosts our carrier-facing session border controller. Canadian-region tenants' call signalling may transit these nodes where a phone number is homed with the carrier on that session border controller or on failover, and their call media may be relayed through them on failover.
Backup object storage (U.S. jurisdiction): Database write-ahead log (WAL) backup archive and internal operations logs. These buckets hold system and operational data; they are not used for user-generated voicemail, recordings, SMS/MMS media, or other customer content. WAL segments may contain incidental row-level data from the primary database — see the residency notice below.
Payment processor: Payment processing and billing records.
Telecommunications carrier: Carrier routing metadata; voice traffic and SMS/MMS content in transit (carrier-required).
International carrier: International outbound calls: calling and called numbers, caller ID and call audio in transit.
Product-analytics and session-replay provider: Switchboard and website usage events, page addresses and session recordings (see Session Replay in Switchboard).
AI inference provider: Primary SARA AI LLM inference for text responses on support email, portal chat, and SMS (see AI Data Processing).
Error-monitoring provider: Application error and crash diagnostic data: error messages, stack traces, device metadata, the client IP address and, for errors raised while handling an API request, the request method and path. Cookies, credential and authorization headers, request bodies and query strings are removed before the data leaves our systems.
Mobile push-notification services (two): Call, message and voicemail notifications to iOS and Android devices: device push tokens, caller or sender name and number, notification title, and for inbound text messages a preview of up to the first 140 characters.
Log-management provider: Application logging and observability data — server access logs, error logs, and API request/response metadata emitted by our backend services. This is server-side telemetry only; we do not run that provider's browser SDK or session-replay recorder in any SIPSTACK application.

Global (CDN)

CDN and network-security provider: Web traffic and API requests transit our CDN provider's global edge network for CDN delivery and DDoS protection. The provider does not retain request payloads.

Cross-Border Residency Notice (PIPEDA / Quebec Law 25)

The user-generated content (call recordings, voicemail, music-on-hold, TTS, PBX media) of customers billed under our Canadian entity (CAD) stays in Canada via the regional object storage described above; for customers billed under our U.S. entity (USD), including any Canadian customer billed in U.S. dollars, it is stored in the United States. A defined set of data flows for Canadian customers does cross the Canada–U.S. border: the database write-ahead log backup archive (U.S.), error-monitoring diagnostic data (U.S.), application logging and observability data (U.S.), third-party LLM inference for SARA text replies on support email, portal chat and SMS (U.S.), payment-processor billing data (U.S.), telecommunications carrier metadata (U.S.), mobile push-notification data for call, message and voicemail notifications (U.S.), product-analytics and session-replay data from Switchboard and our website (U.S.), website analytics data sent to Google Analytics with your consent (U.S.), website advertising data shared with Meta, LinkedIn and Microsoft with your consent (U.S.), the IP address sent to ipinfo.io when you run our network test (U.S.), international outbound calls carried by our international carrier (U.S.), and call signalling — and, on failover, call media — that transits our U.S. SIP nodes (U.S.). These transfers are subject to contractual safeguards with each sub-processor and are disclosed here in accordance with PIPEDA Principle 4.8 (Openness). Privacy Impact Assessments for these flows (Quebec Law 25, s. 17) have been drafted and are undergoing legal review. Canadian customers requiring a Data Processing Addendum may review our Data Processing Addendum (Canada) or contact [email protected].

Your Rights and Choices

You can request a copy of all personal data associated with your organization through the Switchboard portal:

Switchboard → Account → Privacy → Request Data Export

Your export includes: organization profile, provisioned phone numbers, PBX configuration, contacts, SMS CDRs (last 12 months), call CDRs (last 12 months), voicemail metadata, media file inventory, and billing invoices. The export is packaged as a ZIP archive and delivered via a secure 7-day download link. One export per organization per 24 hours.

You can request deletion of specific data categories through Switchboard:

Switchboard → Account → Privacy → Request Data Deletion

Available deletion scopes:

PBX configuration: Extensions, ring groups, IVR menus, queues, routing rules, device records
Messages: SMS/MMS logs and contact data
Recordings: Call recordings and voicemail
AI voice data: AI-generated transcripts, sentiment scores, and call summaries
SARA AI data: Conversation history, email threads, SMS auto-reply logs, and AI-generated draft responses

Note: Billing records and CDRs are locked from deletion — these are required by telecommunications regulations and tax law. Deletion requests are reviewed by our compliance team within 30 days. You will receive email notifications when your request is approved, rejected, or completed.

Account Cancellation

You can cancel your subscription at any time through Switchboard. When your organization's last subscription ends, your account remains restorable for 90 days. During that time your data remains accessible for export, and you can reactivate by resubscribing. If you do not reactivate, your data is deleted or anonymized at the end of that period. If you cancel your entire account, your account enters a 30-day cooling-off period during which your data remains accessible for export, after which it is deleted or anonymized. Call recordings, voicemail and other stored media are deleted. Billing and payment records and call detail records are kept in full for 7 years after the end of the fiscal year in which they were created, and are then destroyed (see Data Retention). Application audit logs are not deleted when the account ends: each is kept for 2 years from the event it records and is then destroyed, and audit records of billing, payment and invoice activity are kept as billing records. Individual user login profiles are not deleted when an organization's account ends, because a user may belong to other organizations or hold their own account. Copies in backup and disaster-recovery archives are purged as the archives rotate, within 90 days after deletion from the live system.

Session Replay in Switchboard

When you use Switchboard, our customer portal, we record your session using our product-analytics and session-replay provider, located in the United States (see the Sub-Processor List). We use these recordings to understand how the portal is used and to reproduce and fix problems reported to our support team. A recording captures the pages you visit, your clicks and scrolling, and what is displayed on your screen, which may include portal content such as names, phone numbers and message text. Everything you type into form fields is masked and is not captured. Recordings are linked to your portal user profile (name, email address, role and organization).

Session replay is turned off for organizations that have HIPAA mode enabled. There is currently no setting that lets an individual portal user turn session replay off. If you object to your sessions being recorded, or have questions about session replay, contact [email protected].

Decisions Made by Automated Processing

Some decisions about your account are made exclusively by automated processing:

Card verification: During a free trial, certain billable actions remain blocked until your payment card passes your card issuer's verification check (3-D Secure).
Fraud-risk holds: Rule-based checks can place a hold on an account that blocks the purchase of phone numbers until a member of our staff reviews it.
Suspension for non-payment: If a payment remains outstanding after our payment retries and reminders, the affected Services are suspended automatically, as described in our Terms of Service.

If one of these decisions concerns you, you may ask us to tell you what personal information was used to make it and the reasons and the principal factors and parameters that led to it, and to correct that personal information if it is inaccurate. You may also submit your observations and request that the decision be reviewed by a person with the authority to reverse it. Send your request to [email protected].

You can manage your cookie preferences at any time using the Your Privacy Choices link in the footer of every page on sipstack.com. Our consent banner denies all non-essential cookies by default until you explicitly grant consent. We honour Global Privacy Control (GPC): if your browser sends a GPC signal, advertising cookies stay off. See our Cookie Policy for full details.

SMS Opt-Out

To stop receiving SMS messages from any SIPSTACK customer using Flare SMS, reply STOP to any message. Opt-outs are immediately added to the sender's suppression list and are permanent until you reinstate consent by replying START.

Email Unsubscribe

All marketing emails include a one-click unsubscribe link and a List-Unsubscribe-Post header compliant with RFC 8058 for automated unsubscription. Unsubscribing from marketing emails does not affect transactional or service-related notifications.

Your Privacy Rights by Jurisdiction

Canada — PIPEDA

As a Canadian corporation, we are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Under PIPEDA, you have the right to:

Access personal information we hold about you
Correct inaccurate or incomplete information
Withdraw consent for non-essential uses (subject to legal or contractual limitations)
Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise these rights, contact [email protected].

California — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights.

Categories of personal information we collect:

| CCPA Category | Examples | |---|---| | Identifiers | Name, email address, phone number, IP address, account ID | | Commercial information | Subscription plan, billing history, invoices | | Internet or electronic network activity | Usage logs, CDRs, message logs, session data | | Audio, electronic, or visual data | Call recordings, voicemail audio | | Professional or employment information | Company name, job title, industry | | Inferences | AI-generated transcripts, sentiment scores, call summaries |

Business and commercial purposes for collection: Service delivery, billing, customer support, security, fraud prevention, aggregated analytics, product analytics and support session replay, improvement of SARA's support knowledge base (generalized content drawn from SIPSTACK's own resolved support tickets), and — on our public website, with your consent — advertising measurement and retargeting.

Do Not Sell or Share My Personal Information: We do not sell personal information for money. If you accept the Marketing & Advertising cookie category on our public website, we share identifiers (browser and advertising identifiers, IP address) and internet or electronic network activity (pages viewed and website events such as form submissions) with Meta, LinkedIn and Microsoft (Bing) for advertising and retargeting. This may be "sharing" for cross-context behavioral advertising, and in some states a "sale", under the CCPA/CPRA and similar US state laws. We do not share information from your use of our Services (calls, messages, recordings, portal activity) for advertising. We do not knowingly sell or share the personal information of consumers under 16.

To opt out, use Your Privacy Choices in the footer of any page on sipstack.com and turn off Marketing & Advertising, or turn on Global Privacy Control in your browser. We treat a GPC signal as a valid opt-out request for that browser.

Your California rights:

Right to Know: Request the categories and specific pieces of personal information we have collected about you
Right to Delete: Request deletion of personal information (subject to legal exceptions)
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing: Opt out of the website advertising sharing described above with Your Privacy Choices or a Global Privacy Control signal
Right to Limit Use of Sensitive Personal Information: Request that we limit use of sensitive PI to purposes necessary for providing the Services
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

How to exercise your rights: Contact [email protected] or use the self-serve tools in Switchboard (see Your Rights and Choices). We will verify your identity via your account credentials. Authorized agents may submit requests with written permission from the account holder. We respond to verified requests within 45 days (extendable by an additional 45 days with notice).

If you are located in the EEA or UK, see our GDPR Compliance page for detailed information on legal bases for processing, your GDPR data subject rights, international transfers, our Data Protection Officer contact, and breach notification procedures.

Children's Privacy

Our Services are not directed at individuals under the age of 13 (or under 16 in jurisdictions where a higher age threshold applies). We do not knowingly collect personal information from children. If we become aware that personal information has been collected from a child without verifiable parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact [email protected].

Security

We implement technical and organizational security measures to protect your personal information against unauthorized access, loss, disclosure, or destruction. These measures include:

Encryption in transit: TLS 1.2 or higher for the API, the Switchboard portal and our website. Our Pulse apps use secure WebSocket (TLS) signalling and DTLS-SRTP encrypted media between the app and our edge node; beyond that node, call media is not encrypted. Desk phones and other provisioned devices, and our connections with telecommunications carriers, use unencrypted SIP signalling and RTP media, as is standard for interconnection with the public telephone network. No calls or messages are end-to-end encrypted
Encryption at rest: Databases, object storage, and backups are encrypted at rest
Access controls: Role-based access control, MFA for administrative accounts, principle of least privilege, and access logging
Security monitoring: Continuous monitoring and alerting, anomaly detection, and security incident response procedures
Breach notification: In the event of a personal data breach, we will notify affected individuals and relevant supervisory authorities as required by applicable law (72 hours for GDPR; promptly for PIPEDA)

No security system is impenetrable. If you discover a security vulnerability, please report it to [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, products, or legal requirements. When we make material changes, we will:

Update the "Last Updated" date at the top of this page
Post the revised policy on this page
Notify you by email to the address associated with your account (for material changes affecting your rights)
Provide at least 30 days' notice before material changes take effect

Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to a material change, you may cancel your account before the effective date.

Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Privacy Officer Email: [email protected] Phone: 1-800-277-7578 Mail: SIPSTACK Inc., Privacy Officer, 575-3093 Bathurst St., Toronto, ON M6A 2A3, Canada

Data Protection Officer (EU/UK) Email: [email protected] Response time: We acknowledge all privacy inquiries within 72 hours and respond fully within 30 days.