Legal
Privacy Policy
Last updated: 7 October 2026
This explains what Toori collects, why we collect it, who else touches it, and how to get it back or get it deleted. It covers toori.ai and any account you create there.
Who we are
Toori, Inc. is a company in San Francisco, California. We build an AI phone answering service for small businesses. For anything in this policy, reach us at [email protected].
What we collect
When you create an account
Your email address and a password. Passwords are stored hashed — we never see or store the password itself. If you sign in with Google instead, we receive your name, email address, and profile picture from Google. We do not receive your Google password and we do not get access to your Gmail, Drive, or anything else in your Google account.
When you fill in the setup form
Information about your business that you choose to give us: business name, location, hours, services, pricing rules, how you want urgent calls handled, and similar. This is what the AI agent needs in order to answer your phone correctly. It saves as you type so you don't lose work, which means partial answers are stored even if you never finish.
When you call or text a business that uses Toori
If you're a customer of one of our clients and you call or text their business number, Toori handles that call or text on the business's behalf. We process your phone number, the recording and transcript of the call (every answered call opens by saying it's an AI and that it's recorded), the content of any text messages, and the details you give the assistant — your name, address, what you need, and an appointment time if you book one. All of it goes to the business you contacted; that's the point. We don't use it for anything else, and we never contact you except in reply to your own call or text.
Automatically, when you visit the site
We use Cloudflare Web Analytics to see roughly how many people visit and which pages they look at. It does not use cookies, does not follow you to other websites, and does not build a profile of you. It is not loaded at all for visitors in the European Union.
Cloudflare also handles our DNS and hosting, and keeps standard server logs (IP address, browser type, time of request) for security and abuse prevention.
Cookies
We use one kind: a token that keeps you signed in after you log in. Without it you would be logged out on every page. We do not use advertising cookies, tracking pixels, or session recording, and we do not run a cookie consent banner because we have nothing to ask consent for.
What we don't collect
- We do not sell your information, and we do not share it for advertising.
- We do not buy information about you from data brokers.
- We do not track you across other websites.
Why we use it
- To create and secure your account, and to sign you in.
- To build and run the AI agent that answers your business phone and replies to texts.
- To show a business the calls and texts handled for it, and to alert the owner when something is urgent, booked, or needs a call back.
- To send you email you'd expect — confirming your address, resetting a password, telling you about your account.
- To understand, in aggregate, whether the website is working.
- To meet legal obligations and to investigate abuse or fraud.
Who else handles it
We keep the list short on purpose. Each of these companies processes data on our instructions, for the job named, and nothing else.
| Company | What it does for us |
|---|---|
| Supabase | Accounts, sign-in, and our database. Hosted in the United States. |
| Cloudflare | DNS, website hosting, and privacy-first analytics. |
| Twilio | Phone numbers, call routing, voicemail recording and text-message delivery. Caller numbers, call metadata, voicemails and message content pass through it. |
| Retell AI | Runs the AI voice agent on calls: recording, transcription and the conversation itself. It uses large-language-model providers (currently Anthropic) to generate what the agent says. |
| Cal.com | Appointment scheduling, when a business connects a calendar. Holds the appointment time and the booking's name and phone number. |
| Stripe | Subscription billing for businesses. Card details go to Stripe directly; we never see or store card numbers. |
| Resend | Sends our account and confirmation emails. |
| Anthropic | Runs the AI model that writes the receptionist's text-message replies. Message content is sent to it to generate each reply; under its commercial terms it is not used to train models. |
| Microsoft | Our own business mailbox, so we can receive your email. |
| Sign in with Google if you choose it, and the fonts this site is set in. |
We may also share information if the law requires it, or to protect our rights, safety, or property. If Toori is ever acquired or merges with another company, account information would transfer as part of that — we'd tell you before it happened.
Recorded calls
Every call the AI answers is recorded and transcribed, and the agent says so in its first sentence, before anything the caller says is captured: it names the business, says it's an AI assistant, and says the call is recorded. A caller who continues after hearing that is treated as having agreed; one who would rather not be recorded can hang up and reach the business another way, and the business is responsible for offering one. Toori is responsible for making sure that disclosure plays on every answered call; each business is responsible for confirming it's sufficient where its callers are, and confirms that during setup. The full arrangement is in Addendum 1 of the Customer Agreement.
Voicemails left when a Standard or Business line isn't picked up are kept the same way: the greeting names the business, says the caller will get a text, and offers to take a message.
Who hears it. The business you called, on its dashboard, and Toori staff when we review calls to fix the agent or when a business asks us to. Owner alert texts carry a link to the recording that stops working after 30 days; the dashboard keeps access for as long as the business's account exists.
How long we keep it. Recordings and transcripts are kept while the business's account is active, because they are that business's record of its calls. When a business closes its account we delete its call records within 30 days. If you called a business and want your recording deleted sooner, email [email protected] with the number you called from and roughly when; we'll confirm with the business and delete it.
We also run a public demo line that answers for a fictional business. Calls to it are recorded and transcribed the same way and reviewed to improve the agent; demo recordings are never used for marketing and you can have yours deleted the same way.
Text messages
Toori sends and receives text messages on a business's behalf — for example, when a business misses a call, the caller receives a follow-up text so their inquiry isn't lost, and can carry on the conversation by text, or a customer can text the business's number directly. Replies in those conversations are written by the business's AI receptionist, which identifies itself as an automated assistant. If you text with a business through Toori, we process your phone number and the message content in order to deliver the service: to generate the reply, to show the conversation to the business on its dashboard, and to let the business owner know when something needs them. Nothing else.
If you're a Toori subscriber, we also process the mobile number you give us at signup to send you the alerts you asked for — texts about calls the AI answered for your business, such as emergencies, bookings, and callback requests. You consent to these when you check the SMS box at signup; consent is optional and not a condition of using Toori.
Messaging happens only in response to contact you initiated, such as calling a business's phone number. Message and data rates may apply. Reply STOP at any time to stop receiving texts, or HELP for assistance. Consent to receive texts is never a condition of buying anything.
Mobile opt-in data, phone numbers collected for SMS, and text-messaging consent are not shared with, sold to, or transferred to any third party or affiliate for marketing or promotional purposes.
How long we keep it
Account and setup information is kept for as long as your account exists. Delete your account and we delete it, along with your setup answers, call records, recordings, transcripts, text conversations and bookings, within 30 days — except anything we're required to keep for legal or accounting reasons, such as invoices and the record of which agreement version you accepted.
Analytics data is aggregate and is not tied to you. Server logs are kept for a short period for security purposes.
Your choices
Whatever state or country you're in, you can ask us to:
- Tell you what we hold about you.
- Send you a copy of it.
- Correct it if it's wrong.
- Delete it and close your account.
Email [email protected] and we'll handle it. We won't charge you, and we won't treat you differently for asking. We may need to confirm you are who you say you are before acting on a request about an account.
California residents have specific rights under state privacy law, including the right to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. We don't sell or share personal information, so there's nothing to opt out of — but the other rights are available to you above, and we honour them regardless of whether we're legally required to.
Security
Data is encrypted in transit and at rest. Our database uses row-level security, which means an account can only ever read its own rows — the restriction is enforced by the database itself rather than by application code that could have a bug in it. Access to production systems is limited and protected by separate credentials.
No system is perfectly secure. If we ever discover a breach affecting your information, we will tell you.
Children
Toori is a service for businesses and is not directed at children. We don't knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.
Changes to this policy
When we change this policy we'll update the date at the top. If a change materially affects how we handle your information — the call recording section, for instance — we'll email account holders rather than relying on you to check.
Contact
Questions, requests, or complaints: [email protected].
Toori, Inc., San Francisco, California.