Data retention policy
CallRail's data retention policy was created according to utilization we see across customer accounts. With our policy, we aim to follow best practices for data retention based on when customers use Personal Information. We'll delete Personal Information stored for our customers to ensure compliance with best practices for privacy regulations, which is subject to our internal retention periods. If at any time you need to preserve data outside of our retention rules, use this support article to see how to export data from your account.
CallRail has four categories of data which we consider for the purposes of defining data retention policies. Each type of data has unique ownership and retention policies. Use this article to understand how CallRail saves data for compliance and regulatory purposes.
Types of Data CallRail Stores
Marketing Data is data about customers or prospective customers. This includes contact information provided to us on our website or during signup or user account creation, as well as data obtained from other market research activities. CallRail owns and controls this data. Individuals can request that data about themselves be removed from these lists pursuant to GDPR or CCPA requirements by submitting a ticket to our Security team. This data is otherwise retained until it is deemed no longer valuable to the company.
Business Records are data about customer accounts. This includes contact information for the account owner, billing records, and payment information. CallRail owns and controls this data, and is required to retain this data (including some Personally Identifiable Information) for legal and financial control purposes. We will not use this data for marketing or other non-record-keeping purposes. This data is retained as long as our operations and accounting practices require it.
Customer Data is account-level data either configured by the customer or collected through the use of the service. It includes the tracking phone numbers owned by the customer, call flows, lists of authorized users, credentials for third-party integrations, and other similar configuration data. It also includes data about individual third-party consumers either uploaded to the service, or who have contacted a CallRail customer through the service. This consumer data may include Personally Identifiable Information (PII) such as name, phone number, or email address. CallRail’s customer owns and controls this data. CallRail will not use this data for purposes other than as directed unless the data has been anonymized for use in aggregate analysis. This data is retained for as long as the account is active and in good standing, although customers can request that some types of this data be deleted earlier by submitting a ticket to our Security team.
Communication Records are records of interactions and communications logged on behalf of our customers through the use of the platform. This may include phone calls, call recordings, text messages, chat logs, form submissions, web visitor sessions, and other types of data. This data includes Personally Identifiable Information (PII) for third-party consumers, such as names, phone numbers, email addresses, and possibly the contents of the communication. CallRail’s customer owns and controls this data. CallRail will not use this data for purposes other than as directed unless the data has been anonymized for use in aggregate analysis.
Communication Records are retained for 25 months, after which they are automatically deleted. If you need to retain your data for longer than 25 months, you'll want to export your data at the account-level. Your data can be deleted sooner than this by submitting a ticket to our Security team, but we're unable to extend the retention period.
Data archiving and removal policy
All data can be deleted by submitting a ticket to our Security team at https://support.callrail.com/hc/en-us/requests/new
For most Customer Data, CallRail provides ways for data to be deleted by the user. Deleted data is inaccessible to users, but may be retained in the platform to ensure accurate historical records and to provide undelete capabilities. As long as an account remains active we cannot accommodate deletion requests other or more permanent than what is offered within the platform because it may cause parts of the platform to function unexpectedly.
For Customer Data containing PII, and for all Communication Records, CallRail customers can request that we anonymize data about specific consumers and/or specific communication records. CallRail customers can also submit a request to delete this data entirely once they have been billed for the associated usage. For compliance reasons, all such anonymization or deletion requests involving PII are irreversible. Because CallRail is merely a processor of this data but does not own or control it, we cannot honor deletion requests directly from consumers. Data storage policy
All information is securely stored within AWS. Log files are routinely deleted after 30 days. Cloud based storage is used, all data is encrypted at rest and motion. All backups are also subject to encryption. AES-256 encryption for everything, AWS hosted in US data centers, data originates in US and does not cross borders.
Data center location(s)
United States
Data hosting details
AWS PostgreSQL
App/service has sub-processors
no