Legal
Privacy
prepaid.ai is a trading name of PAID AI LIMITED (NZBN 9429053109132), a company registered in New Zealand, which is the data controller. Privacy questions and requests: privacy@prepaid.ai.
What we hold
Your account and workspace
The email address you signed in with, your business name, country and time zone, and who else you have invited.
What we receive if you sign in with Facebook, Google, Apple or Microsoft
If you use one of the sign-in buttons instead of an email link, we receive your name, your email address, your profile picture, and the account identifier that provider uses for you — that identifier is how we recognise you the next time you press the same button. We ask for nothing beyond the provider’s basic profile and your email address. We use your name and email address to create and identify your account; the picture is stored with your login record and is not shown anywhere in the product, because the picture in your console is one you chose or uploaded yourself. We never post anything, we do not read your friends, contacts, pages or posts, and we do not use the connection for advertising. Signing in this way is optional — an email link does the same job. If a provider gives us no email address we stop and ask you for one rather than guessing, because it is how we reach you.
What you teach your AI
What we read from the website you gave us, the services and hours you set, your greeting, and the words you flag as urgent.
Your calls
For each call your AI answers: the caller’s number as the carrier presents it, when it happened and how long it lasted, a recording and a written transcript where the law of that number’s country allows one, what the AI did, and any message it took.
People who contact you
Names, numbers and notes for contacts you import or that your AI collects on a call, and any bookings made.
Money
Your plan, your credit balance, and an append-only ledger of every charge and top-up. We never hold your card number.
Who else touches it
These companies process data on our behalf so the product can work. Each does one job, and none of them is given data for their own purposes.
| Who | What for |
|---|---|
| Telnyx | carries the phone calls and runs the AI that answers them |
| Supabase | stores the database and manages sign-in |
| Vercel | runs and serves the application |
| Stripe | processes payments — card numbers never reach us |
| Resend | delivers the email we send you |
| Anthropic | reads your website to build your AI, and writes call summaries |
| Composio | connects the tools you choose to link, only if you link one |
Callers’ data, and whose responsibility it is
When your AI answers a call, the person calling is your customer, not ours — you are responsible for the notices and consents your own callers are owed. Two things we do by default to help: the AI says at the start of every call that it is an AI, in wording set per country, and recording follows the rules of the country the number belongs to rather than a single global setting.
How long it is kept
Call recordings are deleted after 90 days and written transcripts after 365 days. The account audit log is kept for 2 years. Your contacts, your bookings and your billing ledger are not on a timer — the first two are your own business records, and the ledger stays because tax law says it must. A job runs every night and deletes whatever is past its date; it does not wait for anyone to ask. These periods are the same for every account and there is no setting for them today, so if you need something shorter, write to us. Deleting your account removes the rest — see the deletion page.
What we do not do
We do not sell personal data, we do not use your calls or your customers’ data to train anybody’s general-purpose model, and we do not hold your card number — Stripe does.
Your choices
You can see and correct everything your AI knows about your business from the console at any time, export your call history, and ask for the account to be deleted. Requests are read by a person.