Privacy Policy

1. Introduction and scope

This Privacy Policy describes how Workless, provider of the business phone service Callizy, processes personal information in connection with the provision of the service.

Callizy is a service intended for businesses, organizations and self-employed workers. It is not designed as a consumer service. Registration presupposes professional use and implies acceptance of the Terms and Conditions of Sale and the Acceptable Use Policy (AUP).

This policy applies to any person whose personal information is processed in the course of the use of Callizy: the Client, its authorized Users, and any natural person whose data passes through the service (correspondents, imported contacts, recipients of calls or SMS messages).

2. Who we are

The Callizy service is operated by Workless, whose head office is located at:

Workless
325-2114 Sainte-Catherine Street East
Montréal, Québec H2K 0G2
Canada

Workless is subject to Canadian legislation, including Quebec's Act respecting the protection of personal information in the private sector (Quebec's Law 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA, federal).

3. Role of Workless: controller and service provider

Depending on the nature of the data processed, Workless acts either as controller or as service provider (mandatary) of the Client. This distinction is important because it determines who must respond to requests from the persons concerned.

3.1 Workless acts as controller

For information collected directly by Workless for the purposes of the contractual relationship with the Client. This includes, in particular:

• registration and account data (last name, first name, email address, phone number, company);
• billing and payment information;
• access logs, session identifiers, security data;
• exchanges with support and associated tickets;
• browsing data strictly necessary for the operation of the service.

3.2 Workless acts as service provider to the Client

For personal information that the Client imports, generates or passes through the service in the course of its own activities. This includes, in particular:

• contacts and call lists imported by the Client;
• call recordings enabled by the Client;
• voicemail messages and their transcriptions;
• the content of SMS messages sent or received through the service;
• scripts, instructions, configurations and results of AI voice agents configured by the Client;
• data exchanged through the API or third-party integrations set up by the Client.

In this context, the Client remains the controller of this data. It is the Client's responsibility to establish the legal basis for collection, to inform the persons concerned, to obtain their consent where required by law and to respond to their requests to exercise their rights. Workless processes this data solely on behalf of the Client, in accordance with its instructions and this policy.

4. Information collected

4.1 Registration and account data

• last name and first name;
• business email address;
• phone number;
• company name and address;
• position or role within the organization.

4.2 Billing and payment data

Payments are processed by Stripe. Card information does not pass through Workless servers and is not retained by Workless. Workless receives only the information necessary for billing (payment token, status, Stripe customer identifier, invoices issued).

4.3 Telecom operational data

• phone numbers assigned to the Client by Callizy;
• numbers ported by the Client to the service;
• call logs: numbers, duration, timestamp, status, direction;
• SMS logs: sender, recipient, timestamp, status;
• content of SMS messages when they pass through the service;
• voicemail messages and associated audio files;
• call recordings when the feature is enabled by the Client;
• transcriptions and summaries generated from recordings or voicemail messages.

4.4 Data relating to AI voice agents

• scripts, instructions and configuration data provided by the Client;
• contact lists used by campaigns or agents;
• content of voice interactions generated by AI agents;
• transcriptions, summaries and context data produced by agents;
• execution logs and associated call statuses.

4.5 Technical and security data

• connection IP address;
• browser and device type;
• session identifiers and authentication tokens;
• cookies strictly necessary for the operation of the service (see section 13);
• security logs (login attempts, sensitive operations, fraud alerts).

4.6 Exchanges with support

• content of support tickets, emails and attachments;
• history of requests and resolutions.

5. Purposes of processing

Workless processes personal information for the following purposes:

• to provide, operate and maintain the Callizy service;
• to create and manage Client and User accounts;
• to route calls, SMS messages and associated communications;
• to carry out the features enabled by the Client (voicemail, recording, transcription, AI voice agents, integrations);
• to process billing and payments;
• to provide technical support and respond to the Client's requests;
• to ensure the security of the service, and to prevent and detect fraud, abuse and uses contrary to the AUP;
• to comply with applicable legal, accounting and regulatory obligations;
• to improve the service through aggregated and anonymized analyses that do not allow the re-identification of individuals.

6. Legal bases for processing

Depending on the case, processing is based on:

• The performance of the contract entered into with the Client (account creation, provision of the service, billing).
• The legal obligations to which Workless is subject (accounting record retention, cooperation with authorities, telecommunications compliance).
• The legitimate interest of Workless in securing the service, preventing fraud and improving the experience through aggregated data.
• The consent of the persons concerned, where required by law (in particular for certain processing of sensitive data, certain marketing communications or certain automated processing).

7. No training of artificial intelligence models

Workless does not use the content of calls, voicemail messages, SMS messages, transcriptions, AI-generated summaries, agent scripts or data imported by the Client to train artificial intelligence models, whether models belonging to Workless or third-party models.

The models used by Callizy for transcription, speech synthesis or voice agents are provided by specialized service providers (categories described in section 8) and are operated in inference mode only, without reuse of Client content for training.

8. Sharing with service providers

To provide the service, Workless uses specialized service providers, contractually bound to respect confidentiality and to limit processing to the agreed purposes. The categories of service providers used are:

• Payment: Stripe (payment processing, billing, subscription management).
• Telecommunications / VoIP carrier: routing of calls and SMS messages, assignment of numbers, STIR/SHAKEN attestation.
• Hosting and cloud infrastructure: running applications, storing databases, storing audio files.
• Transactional email: sending account-related emails (verification, notifications, support).
• Transcription and speech synthesis: speech-to-text conversion of voicemail messages and calls, voice generation for AI agents.
• Artificial intelligence models: generation of responses and summaries by AI voice agents, in inference mode only (see section 7).
• Security and anti-bot: detection of automated sign-ups, protection against fraud.
• Monitoring and logging: technical supervision of the service, incident management.

Workless does not share Client data for advertising, commercial or brokerage purposes.

9. Hosting and transfers outside Quebec / outside Canada

Workless is established in Quebec. The Callizy service is hosted primarily in Canada and the United States. Certain data may be processed or stored outside Quebec or Canada, in particular by the technical, telecom, cloud, payment, support, security and AI service providers mentioned in section 8.

These transfers are governed by contractual commitments requiring each service provider to maintain a level of protection equivalent to that provided by applicable Canadian and Quebec legislation. Before any transfer outside Quebec, Workless carries out the privacy impact assessment required by Quebec's Law 25.

The Client acknowledges that the use of certain features (in particular transcription, AI voice agents and international telecom routing) necessarily involves processing outside Quebec and, in some cases, outside Canada.

10. Retention periods

Unless a longer legal obligation applies or the Client has chosen a different configuration, the indicative retention periods are as follows:

• Account data: term of the contract, then 3 years after termination.
• Billing data and invoices: 7 years from issuance, in accordance with Canadian accounting and tax obligations.
• Call logs: 12 months.
• SMS logs: 12 months.
• Voicemail messages: 30 days (automatic deletion), unless downloaded or explicitly retained by the Client.
• Call recordings: 30 days by default, unless a different configuration is set by the Client. The Client may configure a shorter period or enable immediate deletion.
• Transcriptions and summaries: 30 days by default, aligned with the retention period of the source recording.
• AI voice agent data and configurations: term of the contract; deletion of active configurations upon termination, unless the Client requests retention.
• Imported contacts and call lists: term of the contract; deletion upon termination, unless the Client requests otherwise.
• Security logs: up to 24 months.
• Support tickets: 3 years from the closing of the ticket.

Upon expiry of the applicable periods, data is securely deleted or anonymized. The Client may, at any time, manually delete its own data through the interfaces of the service, to the extent permitted by law.

11. Security

Workless implements reasonable technical and organizational measures to protect personal information, including:

• encryption of data in transit (HTTPS/TLS);
• encryption at rest for sensitive data;
• authentication, access control and the principle of least privilege;
• logging of access and sensitive operations;
• protection against automated sign-ups (anti-bot mechanisms);
• verification of the origin of telecom requests (carrier signatures);
• regular backups and continuity procedures;
• periodic review of access and configurations.

As no measure is infallible, Workless cannot guarantee absolute security. In the event of a confidentiality incident presenting a risk of serious injury, Workless will notify the Commission d'accès à l'information (Quebec) and the persons concerned in accordance with Quebec's Law 25.

12. Rights of the persons concerned

In accordance with Quebec's Law 25, PIPEDA (federal) and, where applicable, the European Union's General Data Protection Regulation (GDPR), the persons concerned have the following rights with respect to their personal information:

• Right of access: obtain confirmation that processing exists and a copy of the information held.
• Right to rectification: have inaccurate, incomplete or equivocal information corrected.
• Right to deletion: request the deletion of information when the legal conditions are met.
• Right to withdraw consent: withdraw at any time a consent previously given, without retroactive effect on processing already carried out.
• Right to object: object, on legitimate grounds, to certain processing.
• Right to portability: receive, in a structured and commonly used technological format, the information actively provided.
• Right to de-indexing: request that the dissemination of information cease or that it be de-indexed under the conditions provided by law.
• Right to file a complaint with a competent supervisory authority, in particular the Commission d'accès à l'information (Quebec) or the Office of the Privacy Commissioner of Canada.

To exercise these rights, contact Workless at privacy@callizy.ca. Workless endeavours to respond within 30 days, in accordance with Quebec's Law 25.

Special case - data processed on behalf of the Client. For the data described in section 3.2 (contacts, recordings, transcriptions, AI agents, etc.), Workless acts as service provider to the Client. Requests to exercise rights relating to this data should in principle be addressed directly to the Client. Workless will assist the Client in responding to them.

13. Cookies and trackers

The Callizy website and application use only cookies strictly necessary for the operation of the service, including:

• authentication and session cookies;
• preference cookies (language, interface settings);
• security cookies (protection against automated attacks).

Workless does not currently use advertising cookies, marketing tracking pixels (Meta, LinkedIn, Google Ads) or behavioural profiling for advertising purposes. Any change will be announced and subject to obtaining the prior consent required by law.

14. Marketing communications

Workless may send the Client and its Users transactional emails (account verification, invoices, security alerts, significant changes to the service) which are part of the performance of the contract and cannot be disabled while the account is active.

Workless may also send commercial communications (product news, offers, announcements) on the basis of an existing business relationship or consent, in accordance with Canada's Anti-Spam Legislation (CASL). Each commercial communication includes a clear and accessible unsubscribe mechanism.

15. Call recording

The service allows the Client to enable call recording and the prior voice announcement informing the other parties. The associated rules, responsibilities and legal obligations are detailed in section 7 of the AUP.

The Client remains responsible for the lawfulness of the chosen configuration, in particular for obtaining the consent required in all-party consent jurisdictions. Workless acts as service provider for the storage and transcription of these recordings.

16. AI voice agents

When the Client configures and deploys an AI voice agent, Workless acts as service provider for the processing of the associated interactions, transcriptions and results. The Client's obligations are described in section 8 of the AUP.

In accordance with section 7 of this policy, the content of interactions with AI voice agents is not used to train AI models, whether belonging to Workless or to third parties.

16.1 Google Workspace (Google Calendar) data and AI

Callizy may use the Client's Google Calendar data to provide features requested by the user: checking availability, displaying appointments, and creating, modifying or cancelling an appointment, including when these actions are performed through Callizy's AI voice agents.

Data obtained through the Google Workspace APIs is used solely to provide these features. It is not used to train, develop or improve generalized AI or machine learning models (so-called "foundation models"). When calendar data is transmitted to a third-party AI provider (for example so that the voice agent can state an availability), this transmission is strictly limited to what is necessary for the requested feature.

Callizy's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google Workspace Data and AI. Callizy may use Google Calendar data to provide user-facing features such as checking availability and creating, updating or cancelling appointments through Callizy, including through its AI voice agents. Google Workspace API data is used only to provide these requested features and is not used to train, develop or improve generalized or foundational AI/ML models. Callizy's use of information received from Google Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

17. Minors

Callizy is a service intended for businesses, organizations and self-employed workers. It is neither designed for nor offered to minors. Workless does not knowingly collect personal information relating to minors. If Workless becomes aware that an account has been created by a minor or that a minor is the subject of non-compliant processing, the information will be deleted as soon as possible.

18. Changes to the policy

Workless may amend this policy to adapt it to changes in the service, applicable laws, industry practices or regulatory requirements. Substantial changes will be notified to the Client by email or by notice in the application at least thirty (30) days before they take effect. The version in force is always available on this page, with the date of the last update shown at the top.

19. Person in charge of the protection of personal information

In accordance with section 3.1 of Quebec's Law 25, Workless has designated a person in charge of the protection of personal information. Any question or request relating to the processing of personal information may be addressed to this person at:

privacy@callizy.ca

20. Contact

For any question regarding this policy:

Privacy: privacy@callizy.ca
General support: support@callizy.ca
Mailing address: Workless / Callizy - 325-2114 Sainte-Catherine Street East, Montréal, Québec H2K 0G2, Canada
Phone: +1 (438) 533-8446

21. Governing law

This policy is governed by the law applicable in the Province of Quebec and by the applicable federal laws of Canada, without prejudice to the mandatory provisions applicable in the jurisdiction of residence of the person concerned.