Privacy Policy
Effective date: July 13, 2026 · Version 2.1
1. Information we collect
We collect only what's needed to run the service. Specifically:
- Account & business information — business name, owner name, email address, business phone number, and date of birth, collected when you sign up.
- Configuration data — your forwarding number, service area, working hours, blocked dates, AI tone preference, and Google review link, if you set one.
- Your customers' data — the phone numbers, names, and message content of the people who call or text your business, plus quote and invoice details you create.
- Billing information — handled entirely by Stripe. We never see or store your card number; we only store which plan you're on and your subscription status.
- Technical data — IP addresses (used to prevent abuse and enforce fair-use rate limits on sign-in and API requests) and standard browser/device information sent by your browser with every request (this is generic HTTP header data, not a device fingerprinting or tracking technique).
- Session data — your login session is kept in your browser's local storage, not a tracking cookie. It identifies your logged-in session only and is not used to track you across other websites.
2. Cookies & tracking
CallNura does not use advertising cookies, third-party analytics scripts, or cross-site tracking of any kind. The only browser storage we use is local storage to keep you signed in and to remember your light/dark mode preference.
3. How we use your information
We use it to: operate the missed-call, quote follow-up, and invoice reminder automation you've configured; authenticate your account and enforce security (including 2FA and rate limiting); process billing through Stripe; send service-related communications (like verification codes and receipts); and respond when you contact support.
4. Your customers' data
CallNura processes messages and call metadata between you and your customers solely to deliver the automation you've configured — texting back missed callers, following up on quotes, and reminding about unpaid invoices. We do not sell this data, and we do not use it to train AI models or for any purpose beyond operating your account.
5. Third-party service providers
We rely on the following categories of providers to operate CallNura, each bound by their own privacy policy and data protection obligations:
- Payment processing — Stripe, which handles all card data directly; we never receive or store raw card numbers.
- SMS & voice — Twilio, which delivers the text messages and routes the forwarded calls.
- AI processing — Anthropic (Claude API), which generates the automated reply text based on your conversation. Message content is sent to Anthropic to generate a response; it is not used to train Anthropic's models under our agreement with them.
- Hosting & database — Supabase (database) and Railway/Vercel (application hosting), which store and serve your account data.
- Email delivery — Resend, used to send verification codes, receipts, and account notifications.
6. SMS communications, consent & opt-out
CallNura sends text messages to end users (customers of HVAC businesses) on behalf of those businesses. Below is a complete description of every opt-in pathway and the disclosures provided at the time of consent.
Opt-in Method 1 — Missed call follow-up (implied consent)
How it works: A customer calls the HVAC business's phone number. The call goes unanswered. CallNura automatically sends the customer one (1) SMS on behalf of the business, identifying the business by name and asking how it can help. All messages include the disclosure: “Reply STOP to opt out.”
Basis for consent: The customer initiated contact by placing the call. Sending a single text reply to someone who called is analogous to returning a voicemail — the customer's act of calling constitutes implied consent to receive a follow-up from that business. No further messages are sent unless the customer replies and continues the conversation.
Opt-out: Customers reply STOP at any time. CallNura immediately records the opt-out and sends no further messages to that number from that business.
Opt-in Method 2 — Online booking form (express written consent)
How it works: A customer visits the business's public booking page (hosted at callnura.com/book/[business-slug]) and submits a booking request. Before submitting, the form displays the following disclosure directly above the submit button:
“By booking, you agree to receive a confirmation text and appointment reminders from [Business Name]. Message and data rates may apply. Reply STOP to opt out.”
Basis for consent: The customer actively fills out and submits the form after reading the disclosure. This is express written consent.
Messages sent after opt-in: Appointment confirmation SMS, appointment reminder (24 hours before), and an optional follow-up after the appointment (if enabled by the business owner).
Opt-in Method 3 — Existing customer relationship (transactional)
How it works: An HVAC business owner sends a quote, invoice, or appointment reminder to a customer they have an existing service relationship with. The business owner enters the customer's phone number in the CallNura dashboard to initiate the message.
Basis for consent: The customer has a pre-existing business relationship with the HVAC company (e.g., they were a previous service customer or requested a quote). The business owner is responsible for ensuring they have the appropriate basis to contact this number. CallNura's Terms of Service require business owners to comply with applicable laws.
Messages sent: Quote notification, invoice notification, payment reminders, and a Google review request after a paid invoice (Growth/Pro plans).
All messages include opt-out instructions. Every SMS sent by CallNura on behalf of a business includes “Reply STOP to opt out” (for initial messages) or honors the STOP keyword for subsequent messages. Opt-outs are processed immediately and are permanent per phone number per business. Message and data rates may apply. For help, customers can reply HELP or contact the business directly.
7. Data retention
We retain your account and customer data for as long as your account is active, plus a limited period afterward to comply with billing, tax, and legal record-keeping obligations. Expired verification codes and pending signup/change requests are automatically purged. If you cancel your account, you can request deletion of your data at any time as described below.
8. Your privacy rights
You can request the following at any time by emailing us at the address below:
- Access — a copy of the personal data we hold about you.
- Correction — fixing inaccurate account or business information.
- Deletion — permanent removal of your account and associated data, subject to the retention exceptions in Section 7.
We will respond to verified requests within 30 days.
9. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, request deletion of it, and opt out of its "sale" or "sharing." CallNura does not sell or share personal information with third parties for cross-context behavioral advertising. To exercise any of these rights, contact us using the email below.
10. Children's privacy
CallNura is a business tool intended for use by HVAC business owners and their staff, not by children. We do not knowingly collect personal information from anyone under 18 through the service.
11. Security
Passwords are hashed with bcrypt and never stored in plain text. Data is encrypted in transit (HTTPS/TLS) and at rest in our database. Access to customer data is scoped so that each business can only see its own data. Two-factor authentication is available and recommended for all accounts.
12. Changes to this policy
We'll update the effective date above whenever this policy changes, and post the updated version here. Material changes will also be communicated by email.
13. Contact
Privacy questions or requests? Email us directly at callnurasupport@gmail.com, or use the CallNura AI assistant available anywhere on the site.