Privacy Policy

1. Who we are and what laws apply

Carrtel Solutions Inc. is a corporation based in Calgary, Alberta. This policy is designed to comply with:

• The federal Personal Information Protection and Electronic Documents Act (PIPEDA);
• Alberta's Personal Information Protection Act (PIPA); and
• Canada's Anti-Spam Legislation (CASL).

We act in two different roles, and your rights depend on which applies:

• As a business in our own right (our website, our marketing, our billing of clients), Carrtel decides why and how your information is used. We are accountable for it directly.
• As a service provider to our clients (when we run automations for a client and process that client's customers' information), we act on the client's instructions. In that role the client is the organization accountable to its own customers, and we are the processor acting on its behalf. If you are a customer of one of our clients and want your information deleted, the fastest path is usually to contact that business directly, but you may also contact us and we will route your request and honour applicable rights.

2. Information we collect

2.1 — About you, our client (and website visitors)

• Name, business name, role — collected via contact form, onboarding, and account creation, to identify you and deliver and configure service.
• Email address — via contact form, onboarding, billing, login, for service delivery, login, billing, and support.
• Phone number — via contact form and onboarding, for account verification, support, and service alerts.
• Business & billing address — via onboarding and billing, for invoicing and GST/tax compliance.
• Payment details — processed by Stripe; we do not store full card numbers.
• Account credentials / API keys you give us — via onboarding, to connect your systems (calendar, review profiles, etc.) to your automations.
• Support and communication content — from email, SMS, and calls with us, to provide support, keep records, and resolve disputes.
• IP address, browser/device, pages viewed, referrer, cookies — collected automatically when you use our sites, for security, fraud prevention, analytics (including the Google Analytics advertising feature described in Section 11), and site operation.

2.2 — About your customers (processed on your behalf)

When we run automations for you, the following information about your customers passes through our systems so we can deliver the message or action you have configured:

• Customer phone number (from your CRM, booking tool, missed-call log, or lead form) — for sending SMS (reminders, missed-call text-backs, review requests, follow-ups, invoice reminders) and AI voice handling.
• Customer email address (from your CRM, booking tool, or lead form) — for sending email (reminders, follow-ups).
• Customer name and booking/appointment details (from your scheduling/CRM systems) — for personalizing messages and scheduling reminders.
• Message content and replies (generated by the automation; replies from your customers) — for delivering the service, recording opt-outs, and AI-generating message text.
• Call recordings and transcripts (when a caller reaches an AI receptionist line) — the call audio, a written transcript, the caller's number and the details they give, so the message reaches the business in writing and the wording can be improved. See Section 5.
• Review/reputation content (from Google / Facebook business profiles) — for review-generation and reputation-defender automations.

We access and process only the minimum customer information needed to run the automations you have configured. We do not use your customers' information for our own marketing, do not build profiles, and do not sell it.

3. How we use information

• To deliver the service you contracted for (contractual necessity): running automations, sending/receiving SMS, email and voice, configuring integrations, hosting your data, processing payments.
• To operate and secure our platform (legitimate interest / legal obligation): logging, fraud prevention, debugging, security monitoring, backups, abuse prevention, maintaining the SMS opt-out/suppression list.
• To communicate with you about your account (service messages — billing, outages, security, support). These are not marketing and are sent on the basis of our service relationship.
• For our own marketing to you (express consent only): newsletters, tips, case studies. You can opt out at any time. We do not use your customers' data for our marketing.

We never sell personal information, and we do not use automated decision-making that has legal or similarly significant effects on individuals.

4. SMS and electronic-message consent (CASL)

• Carrtel sends commercial electronic messages on behalf of our clients. The client is responsible for ensuring it has the consent required by CASL from each recipient before that recipient is added to an automation. This is a contractual requirement in our Service Agreement.
• Every text message we send on a client's behalf identifies the client as the business on whose behalf it is sent and includes a way to opt out, as CASL requires.
• Opt-out is always available. Any recipient can reply STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to stop text messages, or HELP for help. Replies are processed automatically: STOP adds the number to our suppression list, and once suppressed, our systems block all further outbound messages to that number across every automation. START re-subscribes. Marketing emails include an unsubscribe link.
• Service messages required to operate something the recipient asked for (e.g., a booking confirmation they requested) may be sent on the basis of implied consent or an existing business relationship, as permitted by CASL.

6. Service providers (sub-processors) and where data goes

We use the following providers to run the service. We share only the information each provider needs, and we require each to protect it.

• Twilio — SMS, MMS and voice delivery. Handles phone numbers, message and call content, and opt-out status. United States. (twilio.com/legal/privacy)
• ElevenLabs — the conversational voice AI behind the AI receptionist (the language model used during a call runs inside ElevenLabs). Handles call audio, transcripts, the caller's number and the details they give. United States (provider default). (elevenlabs.io/privacy-policy)
• Stripe — payment processing (client billing). Handles client name, email, billing details, and card data. United States. (stripe.com/privacy)
• Resend — transactional and notification email delivery. Handles email addresses and email content. United States. (resend.com/legal/privacy)
• OpenRouter — AI text generation for message drafts, with a self-hosted fallback model. Handles message prompts/snippets — minimized; not used to train models on your data where avoidable. United States. (openrouter.ai/privacy)
• Google — Calendar (booking), Places and Business Profile (reviews and reputation), and the appointment page used to book planning calls. Handles appointment data, business and review data, and booking contact details. United States. (policies.google.com/privacy)
• Carrtel-hosted infrastructure (n8n, PostgreSQL, and a local Ollama AI model on our own server) — workflow execution, data storage, and a fallback AI model. Handles all data passing through automations. Hosted on our dedicated server (Vultr; primary processing in Canada/North America).

About AI processing: Most automated message text is generated by an AI model. Our primary AI provider is OpenRouter (United States); when it is unavailable we fall back to a self-hosted Ollama model running on Carrtel's own server, which keeps that processing on infrastructure we control. We send AI providers only the minimum content needed to generate a message and do not send them more of your customers' data than necessary.

Cross-border transfers. Several providers operate in the United States, so some personal information is processed there and is subject to US law, which differs from Canadian law and may permit lawful access by US authorities. We reduce this risk by (a) choosing providers with recognized security practices, (b) requiring data-protection commitments in our contracts, and (c) transferring only the minimum necessary data.

We may also disclose information where required by law, to enforce our agreements, to prevent fraud or harm, or in connection with a sale or reorganization of our business (subject to confidentiality).

7. How we protect information

• Encryption in transit (TLS) and at rest where supported; secrets and API keys held in protected server environment variables, not in source code.
• Access on a least-privilege basis; authentication on administrative systems; access logging and audit trails.
• A maintained SMS suppression list that blocks messages to anyone who has opted out.
• Encrypted backups and documented incident-response procedures.
• No security is perfect; we cannot guarantee absolute security, but we take commercially reasonable measures appropriate to the sensitivity of the data.

8. Data retention

• Client account information — term of contract + 1 year (service, support, dispute resolution).
• Financial / payment records — 6 years (Canada Revenue Agency / Excise Tax Act).
• Your customers' data processed for automations — term of contract; deleted within 30 days of termination unless you ask for earlier deletion or we must retain it by law.
• Call recordings and transcripts — on a client's line, for as long as the client chooses within the contract, then handled like the rest of that client's customer data (deleted within 30 days of termination); on Carrtel's own line, only as long as they are needed to follow up the enquiry and correct the assistant's wording. Either way, a recording or transcript is deleted on request (Section 5).
• Opt-out / suppression records — retained indefinitely while the number/email is active in our system, so we can keep honouring the opt-out (we must remember who said STOP).
• Communication / support records — 2 years after last contact.
• Marketing-consent records (our own marketing) — until consent withdrawn + 2 years (proof of consent under CASL).
• Server, security and automation logs — up to 12 months.

We securely delete information when it is no longer needed, and can provide a certificate of destruction on client offboarding.

9. Your rights

Subject to legal limits and identity verification, you (and, where applicable, your customers) may:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Withdraw consent or request deletion (we may be unable to delete information we must keep by law, e.g., tax records, or opt-out records we must retain to keep honouring a STOP request); and
• Complain to a regulator (below).

We respond within 30 days. To exercise a right, email support@carrtelsolutions.com with the subject line “Privacy Request.” If you are a customer of one of our clients, we may need to forward your request to that business, since they control that data.

10. Opt-out and unsubscribe (quick reference)

• Stop our marketing email to you: click unsubscribe in any marketing email.
• Stop text messages (you or your customers): reply STOP. For help, reply HELP.
• All other requests: email support@carrtelsolutions.com.

12. Children

Our services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect children's information.

13. Changes

We may update this policy; we will post the revised version with a new “Last Updated” date and, for material changes, notify active clients by email.

Changes on October 3, 2026: removed the Whop Pixel, an advertising measurement tool from Whop, Inc., from this site and from Sections 2.1 and 11. Section 11 is called “Cookies and analytics” again. The Whop Pixel ran on this site from October 2, 2026 to October 3, 2026. It no longer collects anything, and nothing on this site reads the IDs it stored in visitors' browsers or sends them to Whop any more. What it collected while it ran was sent to Whop, Inc., which handles it under its own privacy policy. Sections 2.1 and 11 now also describe Google signals, an advertising feature of Google Analytics that is turned on for this site and was already on before this change, and how to turn off ad personalization.

Changes on October 2, 2026: added the Whop Pixel to Section 11 and to the purposes listed in Section 2.1 (removed on October 3, 2026). Corrected the opt-out information in Section 11: a Global Privacy Control signal turns off Microsoft Clarity only, and nothing on this site acts on a Do Not Track signal.

Changes on October 1, 2026: added Section 5 (phone calls, recordings and the AI receptionist), added ElevenLabs to the service providers in Section 6, described what OpenRouter and Google are used for more precisely, and added call recordings to the retention list in Section 8. Later sections were renumbered.

14. Complaints / regulators

• Office of the Privacy Commissioner of Canada — 1-800-282-1376, priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta — 1-888-878-4044, oipc.ab.ca

15. Contact us / Privacy Officer

We aim to acknowledge privacy inquiries within 5 business days.