Privacy policy

This privacy policy describes how eCaller.ai — operated by [TO BE COMPLETED — legal entity, RC/ICE] (the “Company”) collects, uses and protects your personal data, in compliance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data and the rulings of the CNDP.

1. Data controller

• Company: [TO BE COMPLETED — legal name, form]
• Registered office: [TO BE COMPLETED — full address, Morocco]
• RC / ICE: [TO BE COMPLETED]
• Website: ecaller.ai
• Privacy contact: contact@ecaller.ai

2. Data collected

We only collect information strictly necessary to deliver the service:

2.1. Customer-account data (you, the merchant)

• First and last name, email address, business phone number
• Store name, e-commerce platform, business sector
• Login credentials (passwords stored hashed — bcrypt/argon2)
• Voice agent configuration (script, voice, languages)
• Usage and login logs (IP address, user-agent, timestamps)

2.2. Data processed on behalf of the customer (orders & calls)

• Phone number, first name and delivery address of the call recipient (sourced from your store)
• Order details to confirm: SKU, variant, quantity, price, payment method
• Audio recordings of calls placed by the voice agent (outbound & inbound)
• Transcripts and AI-generated summaries from those recordings
• Call status (confirmed, postponed, refused, unreachable) and qualitative tags

In this respect, eCaller.ai acts as a processor within the meaning of Law 09-08; the customer (the merchant) is the controller of their end-customers' data.

2.3. Billing data

• Legal name, ICE, billing address
• Transaction reference, amount, status (no card credentials transit through our servers — see §5)

2.4. Browsing data

• Pages visited, time on site, device type, traffic source — via Google Analytics (§4)

3. Google connect (OAuth 2.0)

eCaller.ai optionally offers sign-in via Google OAuth 2.0 and integration with Google Sheets. No other Google API (Gmail, Drive, Calendar…) is requested.

Requested scopes

• openid email profile — to identify your eCaller.ai account from your Google identity.
• https://www.googleapis.com/auth/spreadsheets (optional) — only if you enable the Google Sheets integration to sync your orders or export call results.

Use of Google data

• Used only to perform the actions you configure (read orders to confirm, write call statuses).
• Never sold, never shared with third parties outside the technical subprocessors listed in §7.
• Compliant with the Google API Services User Data Policy, including the Limited Use requirement.

Revocation

You may revoke permissions at any time from your Google account: myaccount.google.com/permissions.

4. Audience analytics (Google Analytics)

Our site uses Google Analytics 4 to understand how visitors interact with ecaller.ai and improve the experience.

• IP addresses are anonymised before processing.
• Pseudonymised data: pages visited, time spent, device type, country, source.
• Hosted by Google Inc., subject to its own privacy policy.
• Opt-out via the browser add-on: tools.google.com/dlpage/gaoptout.

5. Secure payments

Subscription payments are processed by [TO BE COMPLETED — e.g. CMI, Payzone, Stripe], a PCI-DSS-certified provider. eCaller.ai never stores your card credentials on its servers.

• Card data is entered on the provider's secure platform.
• eCaller.ai only retains non-sensitive data: transaction reference, status, amount, currency.

6. Purposes of processing

• Provide and improve the eCaller.ai service (voice-agent quality, integrations).
• Manage your account, subscription and billing.
• Run the AI voice-agent features you enable (outbound calls, transcription, summaries).
• Measure site audience and improve UX.
• Send service-related communications (updates, alerts, invoices).
• Comply with legal and regulatory obligations (accounting, tax, judicial).

7. Subprocessors & data sharing

Your data is never sold. It is shared only with the following categories of subprocessors, under strict confidentiality and contractual limits:

• AI voice providers (speech recognition, synthesis, conversational model) — to run calls and transcription. Recordings are not used to train third-party models without your explicit consent.
• Telecom carriers & SMS gateways — to route calls and recap SMS.
• Cloud hosting provider — compute and storage (preferably EU/Morocco regions).
• Payment provider (§5) — transaction processing.
• E-commerce platforms you connect yourself (Shopify, Qunvert, YouCan, WooCommerce, Google Sheets) — only for the flows you enable.
• Google — OAuth authentication (§3) and audience measurement (§4).
• Competent authorities — only on valid legal request or judicial order.

8. Retention

9. Security

We implement proportionate technical and organisational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Passwords stored hashed (argon2 / bcrypt) — never in plain text.
• Access to data restricted to strict need-to-know (least-privilege), audited and logged.
• Two-factor authentication available for admin accounts.
• Encrypted backups with regular restore tests.
• Application monitoring and alerts on abnormal access.

10. Your rights (Law 09-08)

Under Moroccan Law 09-08, you have the following rights over your personal data:

• Right of access — get a copy of the data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to object — object to processing on legitimate grounds.
• Right to erasure — request deletion (subject to legal retention obligations).
• Right to portability — receive your data in a structured, machine-readable format (JSON / CSV).

To exercise a right: contact@ecaller.ai. Reply within 30 days. You also have the right to lodge a complaint with the CNDP (Moroccan personal-data authority).

11. Cookies

The ecaller.ai site uses two cookie categories:

• Essential cookies — necessary for site operation (session, language preference, security). No consent required.
• Audience cookies — Google Analytics (§4), set after your consent.

You can update your preferences anytime in your browser settings.

12. Minors

eCaller.ai is a B2B service intended for professionals. The service is not designed for individuals under 18, and we do not knowingly collect data about minors. If you become aware of such collection, contact us immediately for deletion.

13. Policy changes

This policy may evolve to reflect legal, technical or organisational changes. The applicable version is always the one published at this URL; for material changes we will notify you by email at least 15 days before they take effect.

14. Contact

• Email: contact@ecaller.ai
• Postal address: [TO BE COMPLETED — Morocco address]

eCaller.ai — Questions: contact@ecaller.ai.
See also: Terms of use · CNDP compliance.