AI Receptionist Privacy: Where Caller Data Goes

An AI receptionist collects more than a human one would: a full transcript of every call, an AI-written summary, the caller's number, anything they say about themselves, and sometimes the audio. That data passes through the phone provider and one or more AI providers. Before going live, know what's collected, who processes it, how long it's kept, and what you'll tell callers.

General information, not legal advice. Privacy obligations vary by state and industry.

What gets collected on a typical AI call

Data	Where it comes from	Typically stored?
Caller's phone number	Caller ID	Yes, in the call log
Name, email, address	What the caller says	Yes, in transcript and messages
Reason for calling	Conversation	Yes, in summary
Full transcript	Speech recognition	Yes
Audio recording	Call recording, if enabled	Depends on settings
Contact history	Your contacts database, if the agent looks up callers	Already stored; the agent reads it
Texts or emails sent by the agent	Agent actions	Yes

Callers also volunteer things you didn't ask for: health details, account numbers, family situations. Assume anything said ends up in the transcript.

Who touches the data

A single AI call can involve several companies:

1. Your phone system provider routes the call and stores the records.
2. The voice AI provider runs speech recognition, the language model and voice generation.
3. Messaging and email providers deliver texts or emails the agent sends.
4. Your own team reads summaries, transcripts and messages.

Each provider should be processing data on your behalf under a contract with confidentiality and security obligations. Ask your vendor for its list of service providers.

Questions to ask your vendor

• What do you store from each AI call: audio, transcript, summary?
• Where is it stored, and is it encrypted?
• How long is it kept, and can I delete it?
• Which AI providers process call audio and text?
• Do you or your providers train AI models on my calls?
• Can I export a caller's data if they ask for it?
• Who on your staff can access my call data, and why?
• What happens to my data if I cancel?

The FTC has warned companies against quietly changing terms to allow AI training on customer data, so get the training answer in writing and check it when terms change.

Your obligations to callers

Notice. Tell callers that calls may be recorded and transcribed and that an AI assistant may answer. See recording AI phone calls and AI disclosure laws.

Privacy policy. Update it to cover:

• Calls may be answered by an AI assistant.
• Calls may be recorded, transcribed and summarized.
• Service providers, including AI providers, process this data for you.
• How long you keep call data.
• How people can request access or deletion.

Consumer rights. Under the California Consumer Privacy Act and similar laws in other states, consumers covered by those laws can request to know, delete or correct personal information. Not every small business meets those laws' thresholds, but having a process is good practice regardless.

Security. The FTC's guide to protecting personal information applies: know what you have, keep only what you need, protect it, dispose of it properly, and plan for incidents.

Minimize what the agent collects

The simplest privacy control is collecting less. Write instructions that keep the agent to what's needed:

Collect only: name, callback number, what they need, and
preferred time. Do not ask for dates of birth, Social Security
numbers, card numbers, account passwords or medical details.
If the caller starts sharing these, say "You don't need to share
that with me. A team member will handle it securely."

See keeping sensitive data off AI calls for specifics.

Retention policy for call data

Set a retention period and stick to it. Example policy:

Data	Keep for	Why
Call log (number, time, duration)	Life of the account	Billing and history
AI summaries	2 years	Customer history
Transcripts	1 year	Quality review, disputes
Audio recordings	90 days	Quality review
Consent and opt-out records	At least 4 years	TCPA defense

Your industry may require longer or shorter periods. Whatever you choose, schedule a monthly or quarterly cleanup.

Access inside your team

• Limit transcript and recording access to people who need it.
• Remove access promptly when someone leaves.
• Don't forward transcripts to personal email or chat tools.
• Review who has admin access each quarter.

Responding to a caller's data request

When a caller asks "what do you have on me?" or "delete my recordings," a simple process avoids scrambling:

1. Verify the request. Confirm the person is who they say they are, for example by calling back the number on file.
2. Find the data. Search your phone system by number for call logs, recordings, transcripts, summaries, voicemails and texts. Check your contacts database and any notes.
3. Check for reasons to keep it. Legal holds, consent and opt-out records, and records you're required to keep may be exceptions.
4. Act and confirm. Export or delete what was requested and tell the person what you did.
5. Log it. Record the request date, what was done, and when.

Run through the process once with a test number before a real request arrives, so you know where everything lives.

Privacy questions in specific industries

Some businesses have rules beyond general privacy law:

• Healthcare providers handle protected health information under HIPAA, which affects which vendors can process calls. See AI receptionists in medical and dental offices.
• Law firms have confidentiality duties to prospective clients. See AI receptionist for law firm intake.
• Businesses taking payments by phone must keep card data out of recordings and transcripts under PCI DSS guidance.

Lawsuits to know about

California's wiretapping law has been used in class actions arguing that AI providers on customer service calls are unannounced third-party listeners. In Ambriz v. Google, a federal court in 2025 let such claims proceed. Clear notice to callers and contracts that limit providers' use of data are the two main defenses businesses rely on.

How Callata handles caller data

Callata's privacy policy says it doesn't sell personal information and doesn't use your communications content to train AI models. Call records, messages, recordings, voicemails, transcripts and AI summaries are kept until you delete them or delete your account; deleted account data is removed from active systems promptly and from backups within 30 days unless law requires longer. Recordings are stored privately and shared through short-lived signed links, each business's data is isolated, and provider credentials you connect are encrypted at rest. Callata shares data with carriers, payment, hosting, and speech and AI providers only as needed to run the service. Account owners can export or delete business data.

AI agents can look up callers in your contacts, including notes and a history of past AI summaries, so keep contact notes free of anything you wouldn't want read back on a call.

Callata Office is $99 a month with five users included ($20 per extra user). Start with Callata.