Home › Privacy Policy
Privacy Policy
What we collect, how long we keep it, who else touches it, and what you can ask us to delete.
1. Who we are
Brimeo builds and operates AI voice agents that answer the phone for small and mid-sized businesses. The service is provided by Creatrixe Solutions Limited, a company incorporated in British Columbia, Canada, which operates Brimeo.
Brimeo is operated by a Canadian company. Call data is stored in the United States, and our engineering and operations team works from Pakistan. We explain that in section 14 rather than leaving you to find out later.
2. Where we operate
Brimeo is offered for use in the United States only. Clients may not make the agent available to callers in other countries. If we open other markets we will update this policy with the disclosures those markets require.
3. The two roles we play
We handle personal data in two distinct roles, and the difference decides which rules apply:
- As a controller — for people who visit brimeo.io, email us, or book a demo. We decide what is collected and why. This policy governs that data.
- As a processor — for calls handled on behalf of a client business. The client decides what is collected and why; we act on their instructions. Our Data Processing Addendum governs that data, and the client's own privacy notice applies to their callers.
This policy does not cover what our clients do with the data they collect through the service. If you called a business and have a question about your data, contact that business.
4. What we collect from website visitors
- Contact details you give us — name, business name, email, phone number — when you book a demo or get in touch.
- Demo call audio if you call our agent or use the browser microphone on this site. That is a call with us, not with a client, and we hold it as controller.
- Analytics — we use Google Analytics to see which pages are viewed, how people arrive, roughly where they are and what device they use. It uses cookies. We use it for measurement only: advertising features are switched off and we do not combine analytics data with anything that identifies you. Google processes this under its own terms — see How Google uses information from sites that use its services. You can opt out with the Google Analytics Opt-out Browser Add-on or by blocking cookies in your browser.
- No advertising trackers. We do not run retargeting pixels, we do not build advertising profiles, and we do not sell any of it.
5. What the agent collects on a client's calls
When our agent answers a call for a client it may capture the caller's phone number, anything the caller says, an audio recording, a written transcript, a summary, and any detail needed to complete the request — a name, a callback number, an appointment time, the reason for calling.
That data belongs to the client. We store and process it so the client can see and use it, and for no other purpose. Recordings and logs are written to storage we control, so the retention schedule in section 11 is ours to enforce.
6. Real-time processing
A live call is processed as it happens, which means a caller's conversation may be accessible to Brimeo and to our technology providers simultaneously and in real time while the call is in progress. Anyone who does not want that should end the call and contact the business another way.
7. The agent identifies itself as AI
Our agents are built to state plainly that they are an AI assistant when a caller asks whether they are speaking to a person. Clients can also configure a disclosure at the start of every call, and in some situations that is required rather than optional — Utah, for example, requires disclosure during interactions involving health or financial information, and Maine requires notice wherever a reasonable person could be misled.
We will not configure an agent to deny being AI, or to impersonate a specific named individual.
8. Call recording and consent
Most US states allow a call to be recorded with the consent of one party. A minority — including California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania and Washington — require every party to consent.
Because a caller's location is not reliably known at pickup, we recommend a recording disclosure on *every* call regardless of where the caller is. Where a disclosure is played, staying on the line after hearing it is treated as consent; a caller who does not consent can end the call or ask not to be recorded.
Clients choose their own configuration and are responsible for the consent obtained on their line. We provide template disclosures as a convenience. We do not warrant that any template, default setting or configuration meets a particular business's legal obligations, and clients rely on them at their own risk.
9. Voice recordings and biometric data
A recording of someone's voice is not automatically biometric data. It becomes biometric when it is analysed to identify or distinguish a particular speaker — a voiceprint. Illinois, Texas and Washington regulate that specifically, and Illinois allows individuals to sue directly.
Brimeo does not create, extract, store or use voiceprints. We do not run speaker identification, voice authentication or voice-based fraud detection. Speaker diarization is switched off in our transcription configuration, so no speaker representation is produced or retained. We do not use caller audio to train or clone voices.
10. Training on your calls
We do not use client call data to train AI models, ours or anyone else's, and we do not sell it or share it for advertising. Training on customer data is disabled in our provider configurations, and our contracts do not permit providers to use client call data to train models that serve other customers.
11. How long we keep things
| What | How long | Then |
|---|---|---|
| Call recordings | 90 days | Permanently deleted |
| Transcripts and call summaries | 90 days | Permanently deleted |
| Contact details captured on a call | 90 days | Permanently deleted |
| Demo call audio with our own agent | 90 days | Permanently deleted |
| Website enquiries | 24 months from last contact | Permanently deleted |
| Billing and tax records | As required by law | Retained |
Clients can set a shorter period, turn recording off entirely, and delete any individual call from the dashboard at any time.
12. Who else touches the data
We use a small number of vendors to run the service. Each is bound by contract to process data only on our instructions and to keep it secure.
| Vendor | What it does | Where |
|---|---|---|
| Vapi | Runs the live voice conversation | United States |
| Deepgram | Speech-to-text transcription | United States |
| ElevenLabs | Text-to-speech — the agent's voice | United States |
| OpenAI | Language model that decides what the agent says | United States |
| Supabase | Database and stored call data | United States |
| Vercel | Hosting for the website and dashboard | United States |
| Website analytics (Google Analytics) | United States | |
| Airwallex | Payment processing and subscription billing — we never see full card numbers | United States |
| Twilio | Telephony — carries calls and provides phone numbers | United States |
| Telnyx | Telephony — carries calls and provides phone numbers | United States |
If you ask us to connect your own scheduling or job-management system, that vendor becomes a subprocessor for your account and we will name it in your agreement before we connect it. Nothing of that kind is connected today.
We give 30 days' notice before adding a vendor that processes call content. We do not sell personal data and we do not share it for cross-context behavioural advertising.
13. Google data
Where a client connects Google Calendar or another Google service, Brimeo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
14. Where data is held and accessed
Brimeo is operated from Canada by Creatrixe Solutions Limited. Call data is stored in the United States. Our engineering and operations team accesses systems from Pakistan, under contractual confidentiality obligations, role-based access limits, multi-factor authentication and access logging.
This means information about US callers is held in the United States and handled by a Canadian company with staff in Pakistan. Canadian privacy law may require us to disclose personal information to Canadian authorities in limited circumstances, and US law may require the same of our US-based providers.
We state this plainly because some vendors bury it. If cross-border access is a problem for your business, raise it before you sign rather than after.
15. Your rights
Depending on where you live you may have the right to know what we hold about you, get a copy, correct it, delete it, limit how it is used, port it, and not be discriminated against for asking. Residents of California, Colorado, Connecticut, Texas, Utah, Virginia and other states with consumer privacy laws have some or all of these rights.
Because we are a Canadian company, PIPEDA also applies to how we handle personal information, and gives you the right to access what we hold about you and to challenge its accuracy.
Email our Privacy Officer at privacy@brimeo.io. We respond within 30 days under PIPEDA, and within 45 days where a US state law sets that deadline, and we will tell you if we need an extension. We may need to verify who you are first, and will ask for the minimum needed to do that.
Automated decision-making. Our agents use generative AI, which may count as automated processing under some state laws. A caller can avoid it by asking to speak to a human or by ending the call and contacting the business another way.
16. If you called a business that uses Brimeo
Your data belongs to that business, not to us. The fastest route is to contact them directly. If you cannot, email us with the number you called from and roughly when, and we will pass the request on and help them action it.
17. Children
The service is designed for adults. Clients must not use it to interact with callers under 16. If we discover we hold information from a child under 16 we will delete it.
18. Security
Data is encrypted in transit and at rest. Access is limited to staff who need it, protected by multi-factor authentication, and logged. Team members with production access are background checked. Our Security page sets out the detail, including what we have not done yet.
No system is perfect. If a breach creates a real risk of significant harm we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as PIPEDA requires, and we keep a record of every breach for 24 months.
19. Health information
Brimeo is not a HIPAA business associate and does not sign Business Associate Agreements. The service must not be used to receive, store or transmit Protected Health Information. If you are a healthcare provider, the service is not appropriate for calls involving patient health information. See the Terms of Service.
20. Changes and contact
If we change this policy we will update the date at the top, and for anything material we will email account holders before it takes effect rather than relying on you to notice.
Questions, requests or complaints: privacy@brimeo.io.