Privacy Policy

This Privacy Policy describes how Ondara ("Ondara," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the Ondara website at tryondara.online and our AI phone-answering platform, including the calls it answers on behalf of our business customers (collectively, the "Service"). It applies to visitors to our website, to the businesses that subscribe to Ondara ("Customers"), and to the individuals who call, are called by, or otherwise interact with an Ondara-powered phone line ("Callers").

1. Our two roles: controller and processor

Ondara plays two different privacy roles, and your rights depend on which applies:

• As a controller. For our website, marketing, sales, and account administration, Ondara determines why and how personal information is processed. This Privacy Policy governs that activity.
• As a processor / service provider. When our AI agent answers a Customer's calls, we process Caller information on that Customer's behalf and under their instructions. The Customer is the controller of that information. Our handling of it is governed by our agreement and Data Processing Addendum with the Customer. If you are a Caller and want to exercise rights over your information, please contact the business you called; we will assist that business as required.

2. Information we collect

Information Customers provide

Account and profile details (name, business name, email, phone number, mailing or service address, industry), configuration you enter (greetings, business hours, call scripts, transfer numbers, integration settings), and billing information (processed by our payment processor; we do not store full card numbers).

Call information we process for Customers

Because the Service answers telephone calls, we necessarily process the contents and metadata of those calls, which may include: audio recordings; machine-generated transcripts; the Caller's telephone number and, where available, name; the date, time, duration, direction, and outcome of the call; and any information a Caller provides during the call (such as name, address, email, the reason for the call, appointment preferences, and other details relevant to the Customer's business). This information belongs to the Customer.

Information we collect automatically

When you use our website or dashboard, we collect log and device data such as IP address, browser and device type, pages viewed, referring URLs, and timestamps, and privacy-friendly analytics about site usage.

Marketing information

If you request a demo, subscribe to updates, or contact us, we collect the details you submit (name, email, business, phone, message) and how you found us.

3. How we use information

• To provide, operate, secure, maintain, and improve the Service, including answering, transcribing, routing, and logging calls, booking appointments, capturing leads, and sending notifications.
• To authenticate users, administer accounts, process payments, and provide support.
• To communicate with you about the Service, respond to inquiries, and — where permitted — send marketing you can opt out of.
• To monitor, detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To comply with law and enforce our agreements.
• To develop and improve models, features, and quality. We do not use Customer call content to train third-party foundation models, and our AI subprocessors are contractually restricted from training their models on data we send through the Service.

4. Call recording and consent

The Service records and transcribes telephone calls. Recording of calls is regulated, and many U.S. states require the consent of all parties. Ondara provides an in-call recording disclosure and consent tooling, but the Customer deploying the Service is responsible for lawful notice and consent for its calls. See our Call Recording and Consent Notice for details.

5. How we disclose information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising. We disclose information only as follows:

Mobile and SMS information is never shared for marketing. No mobile information — including mobile phone numbers and text-messaging opt-in data and consent — is shared, sold, rented, or leased to third parties or affiliates for their own marketing or promotional purposes. Text-messaging originator opt-in data and consent are expressly excluded from every category of information sharing described in this Policy. Where a Customer directs us to send a text on their behalf (for example, an appointment confirmation), we transmit only what is necessary to deliver that specific message through our messaging provider, and for no other purpose.

• To subprocessors that help us run the Service, under contracts limiting their use of the information. See our Subprocessors page.
• To integrations you authorize. When a Customer connects a third-party tool (for example Google Calendar, Microsoft, Slack, HubSpot, Salesforce, Pipedrive, Zoho, Jobber, or QuickBooks), we transmit relevant data to that tool at the Customer's direction. The third party's own privacy terms then apply.
• For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety, and property of Ondara, our Customers, Callers, or the public.
• In a business transfer — as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

6. Retention

We retain account and Customer configuration data for as long as the account is active. Call recordings, transcripts, and related records are retained for the period the Customer configures, and by default while the account is active, after which they are deleted or de-identified within a commercially reasonable period unless a longer period is required for legal, tax, security, or dispute-resolution purposes. Marketing records are kept until you unsubscribe or ask us to delete them.

7. Security

We use technical and organizational measures designed to protect information, including encryption of data in transit (TLS) and at rest, row-level data isolation between Customers, role-based access controls, least-privilege access, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security.

8. International data transfers

We are based in the United States and process information there. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses for transfers of personal data from the EEA, UK, and Switzerland.

9. Your privacy rights

U.S. state privacy rights (including California)

Depending on your state, you may have the right to know or access the personal information we hold about you, to request correction or deletion, to obtain a portable copy, and to opt out of the sale or sharing of personal information and of certain profiling. Ondara does not sell or share personal information. We will not discriminate against you for exercising these rights. You may use an authorized agent to submit a request.

EEA / UK rights

If you are in the EEA or UK, you may have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent, as well as to lodge a complaint with your supervisory authority. Our legal bases include performance of a contract, our legitimate interests in operating and securing the Service, consent (where required, such as for certain marketing), and compliance with legal obligations.

To exercise any right, email hello@tryondara.online. If you are a Caller, direct requests about call information to the business you called; we will support that business in responding.

10. Cookies and analytics

We use only essential cookies needed to run the site and secure your session, plus privacy-respecting, cookieless analytics. See our Cookie Policy.

11. Children's privacy

The Service is intended for businesses and is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. SMS and mobile messaging

If you provide a mobile number and agree to receive text messages in connection with the Service — for example, by giving your number and consenting during a call answered by an Ondara agent — the following applies:

• No sharing of mobile data. No mobile information, and no text-messaging opt-in data or consent, is shared with third parties or affiliates for marketing or promotional purposes. This information is not sold, rented, or leased.
• Message types. Messages are service-related — for example, appointment or booking confirmations and reminders, lead or call alerts, and account or security notices.
• Frequency. Message frequency varies based on your activity and settings.
• Cost. Message and data rates may apply according to your mobile plan and carrier.
• Opt-out and help. You can reply STOP to any message to opt out at any time, or HELP for assistance.

For full messaging terms, see our SMS & Messaging Terms.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new effective date and, for material changes, provide additional notice where appropriate.

14. Contact us

For privacy questions or requests, email hello@tryondara.online. This is the mailbox that receives privacy and data-protection inquiries for Ondara.