Privacy Policy

1. Introduction

Pickup Technologies ("Pickup", "we", "us", or "our") is committed to protecting the privacy of our customers and their callers. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with the Pickup AI receptionist platform.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. By using our Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create a Pickup account, we collect:

• Name and email address
• Business name and province
• Mobile phone number (for SMS notifications)
• Payment information (processed and stored by Stripe — we do not store your full card details)

2.2 Call Data

When your AI receptionist handles calls, we collect and process:

• Caller phone numbers
• Call recordings and audio files
• Full call transcripts
• AI-extracted information: caller name, service requested, location, project timeline, and appointment details
• Call metadata: duration, start time, status, and outcome

Voice recordings and audio data may constitute sensitive personal information and, in some jurisdictions, biometric data. We treat all call audio with heightened care proportionate to its sensitivity.

2.3 Usage and Technical Data

We automatically collect certain technical information when you use our platform:

• Log data (IP address, browser type, pages visited, timestamps)
• Device information
• Feature usage patterns

2.4 Google Calendar Data

If you connect Google Calendar, we access your calendar solely to create appointment events on your behalf. We do not read, store, or share your existing calendar events.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Pickup Service
• Answer inbound calls and generate AI summaries and transcripts
• Send you call notifications via SMS and email
• Book appointments into your connected calendar
• Process subscription payments and send billing receipts
• Send weekly digest emails summarizing your call activity
• Respond to your support requests and inquiries
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your call data or customer information to train AI models without your explicit consent.

We may use aggregated, de-identified data — which cannot reasonably be used to identify any individual — to analyse service performance and improve the platform. This is separate from, and not in conflict with, our commitment not to train on identifiable personal information.

4. Third-Party Service Providers

We share information with trusted third-party providers only as necessary to deliver the Service. These providers are contractually bound to handle your data securely and only for the purposes we specify.

5. Data Storage and Transfers

Pickup's primary database infrastructure (Supabase) stores data in Canada. However, some of our third-party providers (including Twilio, Vapi, Stripe, and Clerk) may process or store data outside of Canada, including in the United States. Where cross-border data transfers occur, they are made in compliance with PIPEDA requirements and subject to the provider's applicable data protection commitments.

Quebec residents: If you are located in Quebec or serve callers in Quebec, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64) applies. Law 25 imposes stricter requirements than PIPEDA, including a privacy impact assessment before transferring personal information outside Quebec, and heightened disclosure obligations around automated processing. Some of our sub-processors operate outside Quebec. By using the Service in connection with Quebec-based data, you acknowledge these transfers and the protections in place under each provider's data protection commitments. If you require a Quebec-specific privacy impact assessment for your use of Pickup, contact us at privacy@use-pick-up.com.

6. Data Retention

We retain your data for as long as your account is active. Specific retention periods:

• Call recordings: Retained for 12 months, then permanently deleted unless you request earlier deletion
• Transcripts and call records: Retained for the duration of your active subscription
• Account data: Retained for 90 days after account termination, then permanently deleted
• Billing records: Retained for 7 years as required by Canadian tax law

You may request deletion of specific call recordings or transcripts at any time by contacting us at privacy@use-pick-up.com.

7. Caller Privacy and Recording Consent

7.1 Recording Disclosure

When your AI receptionist answers a call, it announces at the start of every call that the call may be recorded. This verbal disclosure is delivered automatically before the conversation proceeds, informing callers of recording as required under PIPEDA's knowledge and consent principle. For businesses serving Quebec callers, this disclosure also is intended to support compliance with the notice requirement under Quebec Law 25 for automated processing of personal information; the AI also identifies itself as an automated system at the outset of each call.

Account holders are responsible for ensuring their agent greeting retains this disclosure and for obtaining any additional jurisdiction- or industry-specific consent their circumstances require.

7.2 Data Controller and Processor Roles

Pickup processes caller data — recordings, transcripts, and AI-extracted information — as a data processor acting on your instructions as the data controller. The controller/processor relationship means:

• You determine the purpose for which caller information is used after it is collected
• Pickup is responsible for the security and integrity of the data during processing and storage
• You are responsible for using caller information only for lawful purposes consistent with PIPEDA, CASL, and applicable provincial legislation
• You must not use caller contact information for unsolicited marketing without appropriate consent

7.3 Caller Data Requests

Callers who wish to access or request deletion of their information should contact you directly as the data controller. If a caller contacts us directly, we will direct them to you. In cases where a data controller cannot be identified or is unresponsive, we may assist the caller at our discretion.

8. Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security reviews of our infrastructure
• Webhook signature verification to prevent unauthorized data injection

No system is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by law.

9. Your Privacy Rights

As a resident of Canada, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request corrections to inaccurate or incomplete information
• Withdrawal of consent: Withdraw consent for certain uses of your data (note: some processing is necessary to provide the Service)
• Deletion: Request deletion of your personal information, subject to our legal retention obligations
• Complaint (federal): Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

Quebec residents have additional rights under Law 25, including the right to be informed of automated decision-making that affects you, the right to data portability, and the right to lodge a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

To exercise any of these rights, contact us at privacy@use-pick-up.com. We will respond within 30 days.

10. Cookies and Tracking

Our website and application use essential cookies required for authentication and session management (via Clerk). We do not use third-party advertising cookies or cross-site tracking technologies. You may disable cookies in your browser, but this may affect your ability to log in and use the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before the changes take effect. Your continued use of the Service after that date constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints, contact our privacy officer at:

General inquiries: hello@use-pick-up.com