Dialcom ("Dialcom", "we", "us") provides a CRM and voice-AI platform that helps lending and sales businesses manage leads, place and receive calls, and book appointments. This policy explains what data we collect through the Dialcom portal and connected integrations, why we collect it, and how it's protected.
1. Who this applies to
This policy covers (a) businesses and their staff ("agents") who sign up for and use Dialcom, and (b) the leads/customers those agents contact through the platform, whose information is entered or imported by our customers as data controllers.
2. Data we collect
- Account data: name, email, and login credentials for agents and admins, managed via Supabase Authentication.
- Customer/lead records: name, phone number, email, mailing address, and notes that an agent or admin enters or imports (e.g. via CSV upload or a connected Google Sheet) into their own book of business.
- Call data: call metadata (time, duration, outcome), recordings, and transcripts of calls placed through the platform, generated via our telephony and voice-AI providers.
- Appointment & meeting data: scheduled times, calendar availability, and video-meeting join links generated when a booking is confirmed.
- Connected-account tokens: if an agent connects a third-party account (Calendly, Zoom, Google, or their own Twilio account) from Settings, we store the OAuth access/refresh tokens needed to act on their behalf. These are encrypted at rest before storage.
- Google user data:limited data from an agent's Google account when they connect Google Sheets or Google Meet. Exactly what we access, and how we use, share, protect, and delete it, is described in Section 6.
- Billing data: subscription and payment information is processed by Stripe; we do not store full card numbers ourselves.
- Usage data: basic technical data (e.g. session cookies) needed to keep you signed in and the app functioning.
3. How we use this data
- To operate the core product: placing/receiving calls, scheduling appointments, and creating video-meeting links.
- To import new leads from a Google Sheet the agent has selected, so the agent's AI assistant can call them.
- To create a Google Meet link for an appointment booked on the agent's behalf, when the agent has connected Google Meet.
- To let an agent see and manage their own book of business, and let admins manage their team.
- To send appointment confirmation emails and reminders to the leads a customer is contacting.
- To process subscription payments.
- To maintain the security, integrity, and reliability of the service.
We do not sell personal data.
4. Third parties we share data with
We rely on the following service providers to operate Dialcom. Each only receives the data needed to perform its function:
- Supabase — database, authentication, and backend hosting.
- Twilio — telephony (placing and receiving calls) and SMS appointment reminders.
- Vapi — voice-AI call handling, transcription, and recording. Within a call, Vapi uses OpenAI (language model), Deepgram (speech-to-text), and Cartesia (text-to-speech) to run the conversation.
- Calendly — appointment scheduling and availability.
- Zoom — creating video-meeting links for confirmed appointments, when an agent connects their own account.
- Resend — transactional email (appointment confirmations).
- Stripe — subscription billing and payment processing.
- Vercel — application hosting.
We do not share data with these providers for their own marketing purposes, and we do not sell or rent personal data to third parties. How Google user data specifically flows through these providers is described in Section 6.
5. Zoom integration specifically
When an agent connects their Zoom account from Settings, we request only the minimum OAuth scopes needed to (a) confirm which Zoom account is connected, and (b) create a scheduled Zoom meeting when a customer confirms a booked appointment. We do not access an agent's existing meetings, recordings, contacts, or any other Zoom data beyond what's needed for these two actions. Access/refresh tokens are encrypted before storage, and an agent can disconnect Zoom from Settings at any time, which removes the stored tokens.
6. Google user data
Dialcom offers two optional Google integrations, each connected separately by an agent from Settings: Google Sheets lead import and Google Meet video links. We never access Google user data unless the agent has connected the relevant integration.
6.1 Scopes we request
https://www.googleapis.com/auth/drive.file(Google Sheets lead import) — lets the agent choose one spreadsheet with Google Picker and lets Dialcom read only that file. We use this instead of broader Drive or Sheets scopes so that Dialcom cannot see, search, or open any other file in the agent's Drive.https://www.googleapis.com/auth/meetings.space.created (Google Meet) — lets Dialcom create a new Google Meet meeting space for a booked appointment. It only covers meeting spaces Dialcom itself creates.https://www.googleapis.com/auth/userinfo.email (both integrations) — lets us show the agent which Google account is connected.
6.2 Data we access
- Google Sheets:the name and ID of the single spreadsheet the agent selects, its column headers (so the agent can map which column holds the lead's name, phone, email, and call type), and new rows added to it. We read the sheet periodically to pick up newly added rows. From each new row we store only the mapped values — the lead's name, phone number, email, and call type — as a lead in the agent's account. Our access is read-only: Dialcom never edits, creates, or deletes anything in the sheet or anywhere in Google Drive.
- Google Meet:when an appointment is booked, we create a new Meet meeting space and store its join link with that appointment. We do not access the agent's Google Calendar, contacts, existing meetings, recordings, or any other Google data.
- Both:the email address of the connected Google account, and the OAuth tokens needed to act on the agent's behalf.
6.3 How we use it
Google user data is used only to provide the user-facing features the agent turned on: turning new sheet rows into leads that the agent's AI assistant calls, and giving booked appointments a Google Meet link. We do not use Google user data for advertising, for credit or lending decisions, or for any purpose unrelated to these features, and we do not sell it.
6.4 Who we share it with
- Supabase stores leads, meeting links, and encrypted tokens as our database provider.
- When the agent's AI assistant calls a lead imported from Google Sheets, the lead's name, phone number, and email are sent to Vapi (and, through Vapi, to OpenAI, Deepgram, and Cartesia) and to Twilio, solely to place and conduct that call.
- A Google Meet join link is sent to the lead the appointment is with, by email through Resend and by SMS through Twilio.
We do not share Google user data with anyone else, except where required by law. Our staff do not read Google user data unless the agent asks us to (for example, for support), it is needed for security purposes, or the law requires it.
6.5 How we protect it
OAuth access and refresh tokens are encrypted at rest (AES-GCM) before storage, and all data is transmitted over encrypted (HTTPS) connections. Imported leads and meeting links are visible only to the agent who owns them and that agent's admins. Sheets access is limited to the one file the agent chose, and is read-only.
6.6 Retention and deletion
- When an agent disconnects Google Sheets or Google Meet in Settings, we immediately delete the stored OAuth tokens and Google account email for that integration. For Google Sheets, we keep the selected spreadsheet's ID and the agent's column mapping so that reconnecting doesn't require setting it up again; these are deleted on request.
- Leads already imported from a sheet become part of the agent's book of business. They stay until the agent deletes them in the portal, or until the account is deleted.
- Meeting links are kept with their appointment for as long as the appointment record exists.
- To have any of this deleted, including all data derived from Google, email support@dialcom.ai. We complete deletion requests within 30 days.
- Agents can also revoke Dialcom's access at any time from their Google Account at myaccount.google.com/permissions.
6.7 Limited Use and AI/ML
Dialcom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google Workspace user data to develop, improve, or train generalized AI/ML models, and we do not transfer it to third-party AI services for their model training. The AI providers listed in Section 6.4 process a lead's name, phone number, and email only to conduct the call the agent requested.
7. Data retention
We retain account, customer, call, and appointment data for as long as the related business account is active, or as needed to comply with legal obligations. A business can request deletion of their account and associated data at any time by contacting us below. Google user data follows the more specific rules in Section 6.6.
8. Security
Access to customer data is scoped so agents only see their own book of business; admins see their whole team. Connected-account tokens (Calendly, Zoom, Google, Twilio) are encrypted before they're stored. Data is transmitted over encrypted (HTTPS) connections.
9. Your rights
Depending on your location, you may have the right to access, correct, or delete your personal data, or to object to certain processing. To make a request, contact us at support@dialcom.ai.
10. Children's privacy
Dialcom is a business tool and is not directed at children. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the effective date above.