Privacy Policy

1.About this policy

DialStack, Inc. ("Provider," "we," "us," "our") provides a business phone service. Most customers reach our service through a "Platform Partner" — a software company that has built our phone service into its product. Even when you sign up through a Platform Partner, Provider is the underlying telecom carrier of record and is responsible for handling the information described in this policy.

This policy applies if you:

• Visit our website
• Use our phone service (whether directly or through a Platform Partner's product)
• Contact us about the service

If you signed up through a Platform Partner, that company also has its own privacy policy that covers what it does with your information. This Privacy Policy does not apply when you use our services and other companies collect your information, including when you visit third-party websites, connect to a third-party application, or provide information directly to another company. This policy only covers what Provider does with information we collect through your use of our services or website. You acknowledge that Provider has no control over or responsibility for Platform Partner's or any third party's collection or use of information. You should review the privacy policies of Platform Partner and other third parties whose products or services you access via our services or website.

We may collect personal information from you and anyone who uses our services under your account. You are responsible for ensuring that all your users agree to this Privacy Policy.

2.What we collect

Information you give us

• Account info (name, business name, email, phone)
• Billing and payment info (typically handled by your Platform Partner)
• Transaction data (e.g., service orders, service modifications, cancellations)
• Account settings and login credentials
• Anything you send when you contact support

Information generated by your use of the service

• Call records (numbers dialed, time, duration — known as "CDRs")
• Voicemails and text messages you send or receive
• Call recordings, if you turn on the recording feature
• Transcripts of voicemails or recordings, if you turn on transcription
• Service location and 911 address information
• Device and network data (IP address, device type, network performance)
• Other data about your use of our website and/or services including, for example, geographical location, browser type and version, operating system, referral source, length of visit, page views, website navigation paths

Information from others

• Information from your Platform Partner
• Information from upstream carriers (e.g., for porting numbers)
• Identity verification, fraud screening, and "Know Your Customer" ("KYC") data from vendors that help us prevent abuse
• Business-visitor information about people who visit our website. We use a third-party service that may match a website visitor to their name, professional profile, business email address, and employer, drawn from third-party data sources. This applies only to our marketing website, not to your use of the phone service. See "Website visitor identification" in Section 4, and the opt-out in Sections 10 and 11.

What's "CPNI"?

Some information we collect is Customer Proprietary Network Information ("CPNI") under federal telecom rules. CPNI includes the type of phone service you have, your call records, and your billing details. It does not include your name, phone number, or address. We follow FCC rules for CPNI. Neither we nor our Platform Partners use or disclose CPNI for marketing. Our agreements with Platform Partners contractually prohibit them from using CPNI for marketing purposes. More information about CPNI is available in your Service Subscription Agreement with us.

Sensitive information

Audio data — call recordings, voicemails, and similar — is treated as "sensitive personal information" under California law. We use it only to deliver the service you asked us to provide (e.g., storing your voicemails, generating transcriptions). We do not use it to profile you or for advertising.

3.How we use your information

We use your information to:

• Provide and operate the phone service (call routing, voicemail, recordings, messaging)
• Bill you correctly (through your Platform Partner) and remit taxes and regulatory fees and record payments or non-payment
• Keep the service secure and detect fraud, robocalls, and abuse
• Respond when you contact support
• Meet our legal and regulatory obligations (FCC, state regulators, taxing authorities, court orders, industry traceback)
• Send service-related messages (outages, security alerts, policy updates)
• Improve our service, including training machine learning models on de-identified, aggregated data. We do not train models on the contents of your calls, voicemails, or messages. We do not try to re-identify aggregated data.

We do not use your service data — calls, voicemails, recordings, transcripts, messages, or CPNI — for marketing or advertising. Our agreements with Platform Partners require them to follow the same rule.

4.Who we share your information with

Your Platform Partner. Your Platform Partner receives the call metadata, usage data, and analytics it needs to provision, support, bill, and maintain its product. We do not share raw CPNI with Platform Partners for their marketing.

Service providers. We use vendors for cloud hosting, payment processing, telecom infrastructure, analytics, fraud screening, and identity verification. They receive only what they need to do their job for us. We can provide a list of our key service providers on request — email legal@dialstack.ai.

Other carriers and telecom infrastructure. When you make calls, port numbers, or rely on 911 service, we exchange information with upstream carriers, number providers, 911 service providers, and the public telephone network — as needed to make the service work.

Industry traceback and law enforcement. As a carrier of record, we cooperate with industry efforts to combat illegal robocalls (such as the USTelecom Industry Traceback Group) and respond to lawful requests from regulators and law enforcement.

Legal and safety. We disclose information when legally required (subpoenas, court orders, regulatory requests) or when needed to protect Provider, our customers, or others from fraud or harm.

Business transfers. If Provider is acquired, merged, or restructured, your information may transfer to the successor.

Professional Advisers. We may disclose your information to our insurers and/or professional advisers (including attorneys and accountants) insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or establishing, exercising, or defending legal claims.

Advertising and marketing analytics. Our website uses analytics and advertising tools (for example, Google Analytics, LinkedIn, and Meta) to measure and improve our marketing. Under California and other U.S. state privacy laws, this can be considered "sharing" of personal information for cross-context behavioral advertising. You can opt out, see Sections 10 and 11.

Website visitor identification. When you visit our website, we use a third-party service to help us identify business visitors and the companies they work for. This may include your name, professional profile, business email address, and employer, matched from third-party data sources. We use this information to understand interest in our products and to follow up with relevant businesses. Under some U.S. state privacy laws, this activity may be considered a "sale" or "sharing" of personal information. This applies only to our marketing website. We do not do this with your phone-service data. You can opt out at any time by selecting "Do Not Sell or Share My Personal Information" in our website footer, or by browsing with a Global Privacy Control (GPC) signal enabled, in which case we will not identify or share your information. An opt-out made through the footer link is saved for the browser and device you used to make it. See Sections 10 and 11.

5.Call recordings

If you record calls using the service, you are responsible for following applicable recording laws, which in some states require notice or consent from all parties on the call. Provider does not determine whether your recordings are lawful — that's your obligation.

6.Cookies

We use cookies and similar technologies on our website for:

• Essential functions (so the site and login work)
• Analytics (e.g., Google Analytics, PostHog)
• Marketing and visitor identification (e.g., LinkedIn, Meta, and the business-visitor-identification service described in Section 4)

You can control cookies through your browser settings or through any cookie banner we present. We honor Global Privacy Control ("GPC") signals where required, including by not loading our marketing and visitor-identification tools for visitors whose browser sends a GPC signal.

7.How long we keep your information

We keep your information as long as we need it to provide the service, meet legal and regulatory obligations, resolve disputes, and enforce our agreements. We don't keep information longer than necessary, and we securely delete or de-identify it when it's no longer needed. Some information — like CDRs and CPNI — is kept for the periods required by FCC and state rules.

8.How we protect your information

We use reasonable administrative, technical, and physical safeguards, including:

• Encryption of data in transit
• Role-based access and need-to-know controls
• Access logging and monitoring on sensitive systems
• Security review of vendors that process your information

Provider is in the process of obtaining SOC 2 Type II certification, which we expect to complete in the first quarter of 2027.

No system is perfectly secure, and we can't guarantee information will never be lost or accessed without authorization.

9.Where we store your information

We primarily store and process your information in the United States. We may use other regions for redundancy, business continuity, or specific service features. We do not currently offer the service to customers outside the United States.

10.Your privacy rights

Depending on where you live, you may have rights to:

• Know what information we have about you
• Access a copy of it
• Correct information that's wrong
• Delete your information (with limited exceptions for legal and regulatory needs)
• Opt out of sale or sharing of your information (this applies to data collected through our website, including marketing analytics and business-visitor identification; we do not sell or share your phone-service data). You can opt out using the "Do Not Sell or Share My Personal Information" link in our website footer, by enabling Global Privacy Control ("GPC") in your browser, or by emailing legal@dialstack.ai
• Limit the use of sensitive information (note: we already use it only to deliver the service)
• Object to or restrict certain processing
• Appeal if we deny a request

How to make a request. Email legal@dialstack.ai from the email address on your account and tell us what you want. We may ask for additional information to confirm it's really you (for example, a phone number on the account or a recent invoice number) before we act.

Authorized agents. You can ask someone to make a request for you. We may ask for written proof of authority and verify your identity directly.

Timing. We aim to respond within 45 days. If we deny your request, we'll explain why and tell you how to appeal.

11.Notice for California residents

This section provides the additional disclosures required by the California Consumer Privacy Act (CCPA/CPRA).

Categories we collect, sources, and purposes

In the past 12 months, we have collected the following categories of personal information:

Sensitive personal information

We collect audio data (call recordings, voicemails). We use it only to deliver the service you asked us to provide — not to infer characteristics or for advertising. The CCPA "Limit Use" right does not change anything for us, since we already use audio data only for service delivery.

Sale and sharing

We never sell, share, or use your phone-service data (calls, voicemails, recordings, transcripts, messages, or CPNI) for advertising, and we do not sell it at all. That commitment does not change.

Separately, our marketing website uses analytics and advertising tools and a business-visitor-identification service. Under California and other U.S. state privacy laws, the personal information these website tools collect may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising. This applies only to information collected through our website, not to your phone-service data. You can opt out by:

• Selecting "Do Not Sell or Share My Personal Information" in our website footer (saved for the browser and device you use)
• Enabling Global Privacy Control ("GPC") in your browser. We honor GPC signals and will not load these website tools for a browser that sends one
• Emailing legal@dialstack.ai

Minors

We don't knowingly collect personal information from anyone under 13. We don't sell or share personal information of minors.

"Shine the Light"

We don't disclose your personal information to third parties for their own direct marketing.

How to exercise your rights

Email legal@dialstack.ai. We'll verify your identity, respond within 45 days, and explain any denials. You can appeal by replying to our response email.

12.Other US states with privacy laws

If you live in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Florida, Montana, Delaware, Iowa, New Hampshire, New Jersey, Minnesota, Maryland, Nebraska, Kentucky, Indiana, Rhode Island, or Tennessee, you have similar rights to access, correct, delete, and opt out under your state's privacy law. Email legal@dialstack.ai to make a request, and see Section 10 for the process.

Some of these state laws give you the right to opt out of profiling with significant effects. We do not currently use your information for that kind of profiling.

If we deny a request, your state's law and our response will explain how to appeal.

13.EU and UK visitors

We provide the service in the United States only. We don't market to or knowingly serve customers in the EU or UK. If you visit our website from the EU or UK, you can email legal@dialstack.ai with questions about the information we may have collected through your visit.

14.Children

The service is not directed to anyone under 13, and we don't knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us at legal@dialstack.ai and we'll delete it.

15.Changes to this policy

We may update this policy. When we do, we'll update the "Last Updated" date above. For material changes that adversely affect customers, we'll make reasonable efforts to provide advance notice — typically by email to the account administrator. You should check this page periodically for changes to this policy.

16.Contact us

For privacy questions, requests, or complaints: