Privacy policy

Who this is about

Ansabel is a product of Bright Thoughts Technologies. It answers the phone for other businesses, so two different sets of people show up in this policy.

• → Account holders — the businesses that sign up for Ansabel, and the teammates they invite. For their data, we are the controller and this policy applies directly.
• → Callers and website visitors — the people who ring an Ansabel number or use a customer's chat widget or web form. For their data, the business they contacted is the controller and we are its processor. We handle that data on that business's instructions, under our data processing addendum. If you called a business and want your record removed, ask that business; we will act on their instruction, and you can copy us at [email protected].

What we store about account holders

• → Email address and a password hash. Passwords are hashed with scrypt and a per-account salt; we never store or can recover the plaintext.
• → Business profile: name, industry, address, website, opening hours, timezone, booking link, transfer number, receptionist name, voice, greeting, custom instructions and FAQ answers.
• → Notification email addresses and the notification rules you configure.
• → Teammate email addresses and password hashes for anyone you invite.
• → Stripe customer and subscription identifiers, plan, status and renewal date. Never card numbers.
• → An audit log of security-relevant actions — who did what, and when.
• → A session record for each device you sign in on.

What we store about callers

When your receptionist answers a call and recording is switched on, we store:

• → The caller's phone number, the time of the call and how long it lasted.
• → A recording of the call audio, hosted by our voice provider, and a link to it.
• → A full written transcript of what both sides said.
• → An AI-written summary of the call and a sentiment label.
• → Details extracted from the conversation by AI: the caller's name, email address, company, why they called, a category, a priority, whether follow-up is needed, and the answers to any extra intake questions the business configured.
• → A contact record in that business's CRM keyed on the caller's phone number, and a ticket when the call needs follow-up.
• → Questions the receptionist could not answer, stored so the business can add an answer.

Chat widget and web form submissions store whatever the visitor types — typically name, email, phone number and a message — plus a ticket and a CRM contact.

Recording, transcription and telling people

Recording is on by default and, by default, callers are told two things before the greeting: that they are speaking with an AI assistant, and that the call may be recorded and transcribed. Account holders can edit both sentences and switch either off.

Turning recording off is real, not cosmetic: we instruct the voice provider to keep only basic call attributes, so no audio, transcript, summary or log is retained by it or by us — only that a call happened, when, and for how long.

Whether disclosure is legally sufficient depends on where the caller is. Twelve US states require every party to consent before a call is recorded, and pending litigation argues that automated transcription is itself an interception even when no audio is kept. Account holders are responsible for what their receptionist says; we make the default the safer one.

Cookies

One cookie, named sid (__Host-sid over HTTPS). It holds a random session token, is HttpOnly and SameSite=Lax, and expires after 30 days. It exists so you stay signed in.

There is no advertising, analytics, or third-party tracking on this site. No pixels, no tag manager, no cross-site profiling.

Where the data lives and who else sees it

Account and call records live in a SQLite database on our own server, hosted by Hostinger. Call audio is stored by our voice provider. Traffic to the site passes through Cloudflare.

We share data only with the vendors that make the product work — see sub-processors for the full list, what each one receives and a link to its own terms. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We also disclose data if the law requires it, and to protect the service against abuse.

AI processing

The call itself runs on Retell AI's speech and language models. Separately, when an account holder uses Ask Ansabel, recent call summaries, sentiment labels and caller phone numbers are sent to Anthropic to answer that question. Chat widget messages and the in-app support assistant also use Anthropic.

Neither provider is permitted to train models on this data under the commercial API terms we use. AI-written summaries and extracted fields are best-effort and can be wrong — they are a convenience, not a record of what was said. The transcript is.

How long we keep it

• → Call records, CRM contacts and tickets are kept until the account holder deletes them or closes the account. Plans differ in how many calls the inbox displays, not in how long the record survives.
• → Sessions expire 30 days after sign-in. Password reset links expire after one hour.
• → The notification send log keeps the most recent 500 entries per workspace.
• → When an account is closed we delete its workspace data within 30 days, except anything we must keep for accounting or legal reasons.

Your rights

You can ask for a copy of your data, correction of anything wrong, deletion, or export. Call records are downloadable as CSV from inside the app at any time. Depending on where you live you may also have rights to object, restrict processing, or complain to a supervisory authority.

Email [email protected] and we will answer within 30 days. If you are a caller rather than an account holder, tell us which business you called so we can route the request.

Security

• → Passwords hashed with scrypt; comparisons are constant-time.
• → HTTPS everywhere, with HSTS on the production domain.
• → Every database query is scoped to a single workspace, so one customer cannot read another's data.
• → Outbound webhooks are signed with HMAC-SHA256 so your automation can verify they came from us.
• → Card details are handled entirely by Stripe and never reach our servers.

No system is perfect. If you find a security problem, email [email protected] and we will work with you on it.

Children

Ansabel is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16.

Changes

If we change this policy materially we will email account holders and update the date below. Continuing to use Ansabel after that means the new version applies.

Last updated 9 August 2026. Questions: [email protected]. Postal address available on request.