Privacy Policy

1. Overview

This Privacy Policy applies to all users of the Auto QC platform, including our website at autoqc.ai and any related services. By using our Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.

We process personal data in two distinct roles. For information collected directly from you — account information, billing details, usage data — we are the data controller. For call recordings, transcripts, and metadata that you upload or send to the Service, which may contain personal data about call participants (for example, your customers or agents), you or your organization are the data controller and we act as your data processor (or "service provider" under US state privacy laws): we process that content only to provide the Service and on your instructions. Call participants who have questions about how their data is handled should contact the business that recorded the call; we will refer any such requests we receive to the relevant customer.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, company name, password, and other registration details (including your role perspective and industry, if provided at signup)
• Payment Information: Card details and billing information are collected and stored by Stripe, our payment processor. We never store your full card number; we retain only references such as card brand, last four digits, and transaction records
• Call Content: Audio recordings, transcripts, and call metadata you upload or send via our API or integrations, including any speech, voices, or conversations contained therein
• Communications: Messages you send to our support team, support tickets, and feedback
• Team Information: Names and email addresses of teammates you invite, and the roles you assign them (admin, editor, or viewer)

2.2 Information We Collect Automatically

When you use our Service, we automatically collect:

• Usage Data: Features used and actions taken within the Service (for example, audit logs of account activity)
• Device Information: Browser type and operating system, as reported by your browser with each request
• Log Data: IP addresses, access times, requested pages, and error logs
• Referral Data: If you arrive via a referral link, the referral code that brought you (see Section 8)

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Payment Processor (Stripe): Transaction confirmations and fraud prevention signals
• Google reCAPTCHA: A risk assessment of signup and login attempts, used to block bots and abuse
• Integration Partners: If you connect third-party systems to pipe calls into your account

2.4 Call Recording Data and AI Processing

When you upload or send call recordings and transcripts for analysis, we process that content to provide our Service. This processing includes:

• Transcription of spoken words (where a transcript is not supplied)
• Analysis of conversation patterns and quality metrics through processing pipelines configured for your account
• AI-assisted scoring against the criteria you configure, using large language models — including Anthropic's Claude API
• Generation of quality scores, summaries, and compliance assessments

Our in-app AI assistant also uses Anthropic's Claude API: when you ask it questions, relevant data from your account may be sent to Anthropic for processing in order to generate a response. We do not use your call content to train AI models, and our AI subprocessors process your content only to provide the service to us — not to train their models.

Important: Call recordings and transcripts may contain personal information about third parties (e.g., customers, clients, agents). As described in Section 1, you are the controller of that data. You are responsible for ensuring you have the legal right to record and upload these conversations and for informing affected parties as required by applicable law. AI-generated scores and analyses are advisory; our Terms of Service require human review before they are used in decisions that significantly affect an individual, such as employment decisions.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing the Service

• Processing and analyzing your call recordings
• Generating transcripts, quality scores, and reports
• Managing your account and authenticating your identity
• Processing payments and managing billing
• Providing customer support

3.2 Improving Our Service

• Analyzing usage patterns to improve features and user experience
• Developing new products and services
• Improving scoring configurations and prompts (we do not use your call content to train AI models)

3.3 Communications

• Sending service-related notifications and updates
• Responding to your inquiries and support requests
• Sending marketing communications (with your consent, where required)
• Providing product announcements and tips

3.4 Security and Compliance

• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service
• Complying with legal obligations
• Protecting our rights and the rights of others

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers and Subprocessors

We work with a small set of third-party service providers (subprocessors) who assist us in operating our Service. As of the "Last Updated" date, they are:

• Amazon Web Services (AWS): Cloud hosting and infrastructure, including storage of call recordings and data (United States)
• Stripe: Payment processing; collects and stores card details on our behalf
• Anthropic: AI processing via the Claude API, used for the in-app assistant and AI-assisted scoring
• Google reCAPTCHA: Bot and abuse protection on signup and login
• Google (Gmail/SMTP): Delivery of transactional email such as verification, invitation, and notification messages
• n8n (self-hosted): Workflow engine that runs our call-processing pipelines; self-hosted within our own infrastructure rather than operated by a third party

These providers are contractually obligated to protect your information and may only use it to perform services on our behalf. We will update this list when our subprocessors change.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Subpoenas, court orders, or legal process
• Requests from law enforcement or government agencies
• To protect our rights, privacy, safety, or property
• To enforce our Terms of Service
• In emergency situations involving potential threats to safety

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

4.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. Data Retention

We retain your information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations
• Resolve disputes and enforce our agreements
• Fulfill the purposes described in this Privacy Policy

5.1 Retention Periods

• Account Information: Retained while your account is active, and afterwards only as needed to satisfy legal obligations and resolve disputes
• Call Recordings, Transcripts, and Scores: Retained while your account is active, so your history and reporting remain available; deleted on request (see 5.2)
• Payment Records: Retained as required by tax and accounting regulations; card details are held by Stripe, not by us
• Log Data: Retained for a limited period for security and debugging purposes

5.2 Deletion

There is currently no self-serve deletion tool in the product. To request deletion of specific data or of your entire account, contact us at [email protected] or [email protected]. We will process your request within 30 days, subject to our legal obligations to retain certain information.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in Transit: Data is encrypted in transit using TLS
• Encryption at Rest: Data is stored on AWS infrastructure with encryption at rest
• Access Controls: Role-based access within accounts (admin, editor, viewer) and company-scoped isolation between customer accounts in our multi-tenant system
• Infrastructure: Hosted on AWS, whose data centers maintain independent security certifications
• Payment Security: Card details are handled by Stripe, a PCI-DSS certified payment processor, and never touch our servers

While we strive to protect your information, no method of transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

7.1 Access and Portability

You have the right to access your personal information and receive a copy in a portable format. You can export call and reporting data from within the platform, or contact us at [email protected] for a copy of your personal information.

7.2 Correction

You can update your account information at any time through your account settings. If you need assistance correcting other information, please contact us.

7.3 Deletion

You can request deletion of your personal information. We will comply with your request unless we have a legal obligation to retain the data or need it to complete a transaction.

7.4 Opt-Out

You can opt out of marketing communications by clicking the "unsubscribe" link in our emails or by updating your notification preferences in your account settings.

7.5 California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt out of the sale of personal information. We do not sell personal information.

7.6 European Privacy Rights

If you are in the European Economic Area (EEA) or UK, you have rights under the GDPR, including the right to object to processing and the right to lodge a complaint with a supervisory authority.

8. Cookies and Tracking Technologies

We use a minimal set of cookies and browser storage. We do not use third-party advertising trackers, and we do not currently use third-party analytics cookies.

8.1 What We Store in Your Browser

• Authentication (localStorage): When you sign in, a session token is stored in your browser's localStorage to keep you signed in. It is not an advertising identifier
• Preferences (localStorage): Interface settings and your cookie-consent choice are stored in localStorage
• Referral Cookie: If you arrive through a referral link, a first-party cookie named ref_code stores the referral code for 30 days so we can credit the referrer if you sign up. It is cleared after signup
• Google reCAPTCHA: reCAPTCHA, which protects our signup and login pages, may set its own cookies subject to Google's privacy policy

8.2 Your Choices

Most browsers allow you to control cookies and clear site data through their settings. Clearing this data will sign you out and reset your preferences, and blocking the reCAPTCHA cookies may prevent signup or login from completing.

9. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

If you believe we have inadvertently collected information from a child, please contact us immediately at [email protected].

10. International Data Transfers

Auto QC is based in the United States, and your information may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate.

If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States. By using our Service, you consent to the transfer of your information to the United States.

For transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying a notice in the Service

We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For GDPR, CCPA, or other data protection inquiries and rights requests, contact [email protected].