Privacy policy

Last updated September 2026

Pending attorney review. This is a draft, not final legal advice. Nothing on this page creates an attorney-client relationship, and it has not been approved by Opexlane's legal counsel yet.

What we collect

  • Account details — name, email, password or OAuth identity, and business settings you configure.
  • Call data — recordings, transcripts, caller phone numbers, and call metadata needed to run the AI receptionist.
  • Customer records — contacts, bookings, and notes you create, including optional voice-recognition data (see below).
  • Billing data — subscription and invoice data handled by our payment provider; we never store full card numbers.
  • Usage data — minutes used, feature usage, and basic error logs used to keep the service running.

Why we collect it

To answer your calls, keep your calendar, and show you what happened. Recordings power features like missed-call transcripts and caller recognition — only for your business, never for advertising, and never sold.

What we never do

We never sell your data or your customers' data, never use call content for advertising, and never share recordings with third parties except the infrastructure providers listed below that run the service.

Call recordings

Every inbound call opens with a spoken disclosure that the call may be recorded and that the caller is speaking with an automated assistant. Recordings are captured by our telephony provider, downloaded to encrypted storage, and kept for 90 days, after which they are automatically purged nightly. To request deletion of a specific recording before the 90-day purge, contact support@opexlane.com. Only your account's users and Opexlane support (for troubleshooting) can access recordings. [Attorney to confirm: retention period and disclosure wording.]

Voice biometrics

If you use caller recognition, Opexlane derives a voiceprint from call audio: a 256-number mathematical embedding stored with the contact record, not a copy of the raw audio. Voiceprints are used only to recognize returning callers for your business. A voiceprint is deleted when you delete the contact, and all voiceprints are removed when you close your account. Email support@opexlane.com at any time to have a voiceprint deleted on request. [Attorney to confirm: state biometric-privacy requirements, e.g. Illinois BIPA.]

Your control

Delete customers, recordings, and documents from Settings at any time. Email support@opexlane.com to export or fully delete your account.

Cookies

We use only the cookies needed to keep you signed in and remember your theme. No tracking cookies.

Subprocessors

These providers process data on our behalf to run the service — purposes only, no data is sold or shared for their own use:

  • Telnyx — voice telephony: call control, phone numbers, SMS delivery, and call recording capture.
  • Stripe — billing: subscription management, checkout, and payment processing.
  • Supabase — database and file storage for accounts, calls, contacts, and recordings.
  • Vercel — application hosting.
  • Resend — transactional email (welcome, billing, and quota notices).
  • Google (optional, only if you connect it) — calendar integration via Google Calendar OAuth.

Data processing addendum (DPA)

Roles. For data about your customers (call recordings, transcripts, contacts), your business is the data controller and Opexlane is the data processor, acting only on your instructions — the instructions embodied in your use of the service and these terms.

Processing limits. We process customer data only to provide the service, only through the subprocessors listed above, and we do not use it to train models for other customers.

Retention. Call recordings are purged automatically 90 days after the call. Other customer data is kept while your account is active.

Deletion on account closure. Closing your account in Settings (Danger zone) triggers the same full-cascade deletion the product performs today: Stripe subscription canceled, Google token revoked, Telnyx number released and AI assistant deleted, tenant rows removed from the database via the atomic cascade, and recordings removed from storage. Subprocessor copies are deleted or anonymized per each provider's retention controls. [Attorney to confirm: deletion timelines and subprocessor-pass-through terms.]

Security. Data is encrypted in transit and at rest, access is scoped per tenant with row-level security, and destructive operations require explicit confirmation. [Attorney to confirm: security measures and breach-notification obligations.]

Your rights

  • Access and export — view your data in Settings at any time; email support@opexlane.com for a full export of your account data.
  • Deletion — delete individual records in Settings, or close your account in the Danger zone for full-cascade deletion.
  • Correction — fix contacts, bookings, and business settings directly in Settings.
  • Text opt-out — reply STOP to any text from us; see the Terms of Service for consent details.

Children

Opexlane is a business service and is not directed at children under 13. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy as the service evolves. Material changes will be announced in-app or by email before they take effect.

Contact

Privacy questions or requests: support@opexlane.com.