Privacy Policy

01Scope and our two roles

This policy explains how Klaching, a sole proprietorship operated by Yaseen Khalil, handles personal information in connection with klaching.com and the Klaching platform.

Which rules apply depends on whose information it is:

• Customer information. If you hold a Klaching account, we are the business — the "controller" — for your account, billing and usage information. We decide how it is used, within this policy.
• Contact information. If you are a person a Klaching customer called, we are a service provider — a "processor" — acting on that customer's instructions. The customer decided to call you, chose to upload your number, and is the business responsible for that decision. We handle your information only to place the call and report the result back to them.

That distinction matters for your rights. Section 10 explains what to do if you received a call; Section 11 covers rights for both groups.

02Information we collect

a. Information customers give us

• Account: full name, business or company name, email address, phone number, and a password (stored only as a hash by our authentication provider — we never see it).
• Assistant configuration: the agent name, company name, greeting, pitch and pricing details you set for your AI Assistant.
• Signup record: your name, email and chosen plan, kept so we can follow up about the account.
• Billing: plan, subscription status, and identifiers issued by Stripe. Card numbers go to Stripe directly and are never transmitted to or stored on our systems.

b. Contact Data customers upload

When a customer imports a CSV or adds a lead by hand, we receive and store on their behalf:

• first and last name;
• telephone number;
• property address;
• email address, if supplied or captured during a call;
• free-text notes the customer adds;
• a status such as new, contacted, interested, declined or opted out;
• the basis on which the customer says they may call the number — for example that you enquired with them, are an existing client, or gave written consent. We record this so a call can be accounted for, and it determines whether your number is checked against the National Do Not Call Registry before dialing.

The uploaded CSV file itself is stored in our file storage so the import can be reprocessed or audited.

c. Information created by using the service

• Call records: a call identifier, status, direction, duration, minutes billed, the outcome the Assistant recorded, and any email address the person gave during the call.
• SMS records, where SMS is enabled for an account: message body, direction and delivery status.
• Usage and billing records: minutes used, call and message counts per day, and a credit ledger.
• Raw event payloads received from our voice and payment vendors, stored so that events are processed exactly once and can be reconciled. A call-analysis payload can contain a summary of what was said on the call.

d. Technical information

Our hosting providers process standard server logs — IP address, timestamp, request path, user agent — for security, abuse prevention and debugging. We do not use this to build a profile of you.

e. What we do not collect

We do not ask for and do not want Social Security numbers, financial account numbers, payment card numbers, government identifiers, precise geolocation, biometric identifiers, or health information. Do not upload them as Contact notes, and do not configure the Assistant to ask for them.

03AI calls, recordings and transcripts

Calls placed through Klaching are made by an artificial voice. The Assistant is configured to say that it is an AI assistant, and to name the business it is calling for, at the start of the call.

To hold a conversation, the audio of the call is processed in real time by our voice vendor, Retell AI, and the vendors it uses in turn. That processing involves:

• converting what the person says into text (speech recognition);
• sending that text, with the customer's configured script, to a large language model that generates the reply;
• converting the reply back into speech.

Calls may be recorded and transcribed, and a summary analysis of the call may be generated. Recordings and transcripts are produced and held by Retell AI under its own retention settings; Klaching stores the call metadata and outcome described in Section 2(c), and may store a link to a recording or transcript.

Where a call reaches a state that requires the consent of every party to a recording, the Klaching customer is responsible for ensuring the Assistant's opening discloses the recording. See Section 5 of the Terms.

04How we use information

• to create and run accounts, and to authenticate you;
• to place the calls a customer configures, and to return the results to that customer's dashboard;
• to meter usage, enforce plan limits, take payment and issue invoices;
• to send transactional email about an account, such as signup confirmations;
• to provide support and to answer questions you send us;
• to keep the service secure — detecting abuse, fraud and unauthorized access;
• to debug, monitor and improve reliability;
• to comply with law, and to establish, exercise or defend legal claims, including responding to a dispute about whether a call was authorized.

We do not use Contact Data for any purpose of our own beyond providing the service to the customer who uploaded it, other than as required by law or in aggregate form that identifies no one.

05Who we share it with

We do not sell personal information. We share it with the vendors below, which process it on our behalf under contract and may not use it for their own purposes:

We may also disclose information:

• to the Klaching customer who uploaded a Contact — that is the purpose of the service;
• when the law requires it, such as a valid subpoena or court order, or to protect someone's safety;
• in a business transfer, if the business is incorporated, merged, acquired or sold — in which case this policy continues to apply until updated;
• to professional advisers such as lawyers and accountants, under a duty of confidentiality.

06No sale, no advertising, no model training

To be explicit, because these are the questions people ask:

• We do not sell personal information, and have not in the preceding twelve months.
• We do not share personal information for cross-context behavioural advertising, and have not in the preceding twelve months.
• We do not use personal information, call recordings or transcripts to train our own or any vendor's AI models.
• We do not use personal information to profile anyone for decisions producing legal or similarly significant effects.
• We run no advertising networks, no data brokers and no third-party analytics on our site.

07Cookies and tracking

The marketing pages set no cookies. Once you log in, our authentication provider stores a session token in your browser so you stay signed in and so requests can be authorized. That token is strictly necessary for the application to function; clearing it logs you out.

We use no advertising cookies, no third-party analytics, no pixels and no cross-site trackers, so there is nothing here to opt out of. We do not respond to Global Privacy Control signals because we have no sale or sharing of personal information to which such a signal would apply.

08How long we keep it

• Account and configuration data — for as long as the account is open, then deleted or anonymised within 90 days of closure, unless we must keep it longer.
• Contact Data — for as long as the customer keeps it in their account. Deleting a customer account cascades to delete their Contacts, imports, campaigns and calls.
• Call and messaging records — retained while the account is open and for a period afterwards, because telemarketing claims can be brought years after a call and both the customer and Klaching may need the record to answer one. We consider four years an appropriate floor, aligned with the federal statute of limitations.
• Recordings and transcripts — held by Retell AI under its retention settings, not on Klaching infrastructure.
• Billing records — kept as long as tax and accounting law requires, typically seven years.
• Server logs — kept for a short operational period by our hosting providers.

A do-not-call or opt-out record is kept even after other data is deleted, because deleting it would let the same number be contacted again. That is the one case where deletion makes things worse.

09How we protect it

• All traffic to the site and API is encrypted in transit with TLS.
• Data is stored by our database provider with encryption at rest.
• Every table carries row-level security so one customer's records cannot be read by another; API access is authenticated with signed tokens.
• Administrative keys are held server-side only and are never exposed to the browser.
• Access to production data is limited to the operator of the business.

We are a small operation and hold no formal security certification such as SOC 2. No system is perfectly secure; we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any regulator as the law requires.

10If you received a call from Klaching

You reached this page because an AI assistant called you and named Klaching, or named a real estate business using Klaching. Here is what that means and what you can do.

The call was placed on behalf of a real estate professional who uploaded your phone number to our platform. That business — not Klaching — chose to call you and is responsible for having a lawful basis to do so. We supply the technology.

Before each call we check your number against the customer's own do-not-call list and, where no established business relationship or written consent is recorded, against the National Do Not Call Registry.

To stop the calls, you can do any of the following, and you do not need to use specific wording:

• Tell the assistant, during a call, to stop calling you or to take you off the list. We check both the call's summary and a transcript of what you said, so ordinary wording works — you do not need a keyword.
• Ask the business that called you directly. They must add you to their internal do-not-call list.
• Email us at yaskhalil@klaching.com with the phone number that was called. We will record the opt-out and forward the request to the business that placed the call.

Under FCC rules a revocation must be honoured within ten business days, and it can be made by any reasonable means. We aim to act on requests sent to us much faster than that.

You may also ask us what information we hold about you, ask for it to be corrected or deleted, and ask who called you. Because we act as a service provider, we may need to pass the request to the business that uploaded your number, and we will tell you when we do. Emailing us is the fastest route, and we will not charge you for it.

You can register your number with the National Do Not Call Registry at donotcall.gov, and report unwanted calls to the FTC there.

11Your privacy rights

a. Rights available under U.S. state privacy laws

A growing number of states have comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. The details differ, but the core rights are similar, and we extend them to everyone who asks, wherever you live, rather than checking your state first:

• Know and access — what personal information we hold about you, where it came from, why we have it, and who we disclosed it to.
• Correct — fix information that is inaccurate.
• Delete — have your personal information erased, subject to the exceptions in Section 8.
• Portability — receive a copy in a portable, machine-readable format.
• Opt out of sale, sharing, targeted advertising and profiling — we do none of these, so there is nothing to opt out of, but the right is yours to exercise.
• Non-discrimination — we will not deny service, change prices or degrade quality because you exercised a right.
• Appeal — if we decline a request, you may appeal, and we will respond with a written explanation. If we deny the appeal we will tell you how to complain to your state Attorney General.

b. Additional notes for California residents

Under the CCPA as amended by the CPRA, in the preceding twelve months we have collected the categories of personal information described in Section 2 — identifiers such as name, email address and telephone number; commercial information such as plan and usage; internet or network activity such as server logs; audio information in the form of call recordings and transcripts held by our voice vendor; and professional information such as company name.

We collect these from you, from the Klaching customer who uploaded your information, and from your use of the service. We disclose them for business purposes to the service providers listed in Section 5. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. You may designate an authorised agent to make a request; we will ask for proof of that authorisation.

c. If you are outside the United States

The service is intended for use in the United States and calls are placed to U.S. numbers. If you are in a jurisdiction with a data protection law such as the UK or EU GDPR and you believe we hold your information, contact us and we will handle your request in line with that law to the extent it applies.

12How to exercise your rights

Email yaskhalil@klaching.com and tell us what you want. Include the email address on your account, or — if you were called — the phone number that was called, so we can find the right records.

We will acknowledge within 10 days and respond substantively within 45 days, extending once by a further 45 days if a request is complex, and we will tell you if we need the extension. We must verify who you are before disclosing or deleting anything; the verification will be proportionate to the sensitivity of the request, and we will not ask for more information than we need.

Requests are free unless they are manifestly unfounded or excessive, in which case we will tell you before doing anything.

13Children

The service is for business use by adults. We do not knowingly collect personal information from anyone under 18, and the Assistant is not designed to converse with children. If you believe a child's information has reached us, contact us and we will delete it.

14Where data is processed

Klaching and its vendors process data in the United States. If you contact us from another country, understand that your information will be transferred to and processed in the U.S., where privacy law differs from your own.

15Changes to this policy

We will update this policy when our practices change, and will revise the "last updated" date above. If a change is material — a new category of information, a new purpose, a new kind of disclosure — we will give notice by email or in the application before it takes effect.