Privacy Policy

Customer Data. For information a Customer and its users bring into the Service, such as CRM records, emails, call recordings, transcripts and website visitor data, foly processes the information on the Customer's behalf and under its instructions, as a processor or service provider. The Customer decides what is collected and why, and its own privacy notice applies to the people it contacts. If you are a prospect, caller or website visitor of one of our Customers, please contact that business first; we will help it respond.

Our own information. For account, billing, security and website information about our own users and visitors, foly decides how the information is used and acts as a controller or business.

Account and profile information

Your email address and password, or a Google or company single sign-on login; your name, phone number, job title, role, time zone and profile photo; the name of your organization; the email addresses of teammates you invite; and multi-factor authentication settings. New passwords are checked against a public list of breached passwords in a way that never sends the password itself.

Billing information

Payments are handled by our payment processor. We share your email address and organization name with it and keep its customer and subscription references. We do not receive or store full card numbers.

CRM data

When an administrator connects a CRM, such as Salesforce, HubSpot, Zoho or Pipedrive, we read and, where you authorize it, write records such as accounts, contacts, leads, opportunities, tasks and activity history, including the names, emails, phone numbers and notes those records hold.

Email and calendar data

When you connect a Google or Microsoft mailbox, we receive message details such as sender and recipient addresses, subject, a short preview, dates and threading information, so we can show email activity on your accounts and contacts. For this activity view we store the subject and preview, encrypted, and not the full message. We also create drafts and send emails that you or your organization's users write or approve, and we read and create calendar events and availability to schedule follow-ups. Section 5 explains how we handle Google user data.

Email Desk

If your organization uses Email Desk and chooses a mailbox as an intake source (a user's connected mailbox or a shared mailbox granted to foly), we also read and store the text of incoming messages in that mailbox. We remove payment card and account numbers, store the text encrypted, and process it with AI so the Service can understand the request and prepare a response.

Calls, recordings and transcripts

When your organization uses foly calling, through phone numbers we provide or your own phone system account such as RingCentral, we process call audio, phone numbers, caller ID and call details. Whether calls are recorded depends on your organization's settings, which its administrators control, including the disclosure callers hear. We transcribe calls and generate notes, summaries and scores. Practice calls with AI buyers produce audio, transcripts and scorecards in the same way.

AI voice agents

When an AI Coworker places or answers calls for a Customer, we process the call audio, transcript and outcome to run the call and report it to the Customer.

The desktop app

During a call you start, the foly desktop app captures your microphone and your computer's system audio and streams it for live transcription. It uploads transcripts, scores and notes, not the raw audio. On macOS it asks for the Screen Recording permission only because the operating system requires it for system audio; it does not capture your screen.

Website tracking

Customers can add the foly tracking script to their own websites, and we use it on ours. It sets a first-party cookie holding a random identifier, which lasts for a period the website owner chooses (about 13 months by default). The script records page views (the page address without its query string, the page title, the referrer and campaign parameters) and the values entered in website forms, except password, payment, one-time-code and similar sensitive fields. An email address entered in a form can link the visitor to a contact in the Customer's CRM. The visitor's IP address is used only briefly to limit abuse and is not stored. The script honors the browser's Do Not Track signal by default.

Research and enrichment

When enabled, we look up companies and people in business data sources, public web search and public records (for example, US federal motor carrier records) to research accounts and complete contact details.

Usage and device information

We collect product usage events, error reports and application logs, page performance data, and standard server logs such as browser type and request times. Usage events are associated with your user ID, name, email address and organization.

Cookies and similar storage

We use cookies to keep you signed in and to secure sign-in and connection flows, browser storage for product analytics, and the tracking cookie described above.

• To provide the Service: coaching, scoring, practice calls, calling, call notes, research, email and calendar follow-ups, and the work AI Coworkers do for Customers.
• To run AI features, as described in section 4.
• To write results back to the systems you connect, such as your CRM, mailbox, calendar or workplace messaging, when you or your administrators direct it.
• To send service emails, such as invitations, security notices, export links and deletion confirmations.
• To bill Customers, prevent abuse, secure accounts and keep the Service reliable.
• To measure and improve the Service using aggregated or de-identified information, as described in section 4.
• To comply with law and enforce our terms.

AI processing

Many features send content such as transcripts, call audio, CRM context, email text and draft text to AI service providers, or to models we host, so they can produce a result for you. Some workspaces can supply their own AI provider key for AI chat; that provider then processes the content under the Customer's own account.

Call content is made available to outside AI tools and API clients that a Customer connects only if a workspace owner turns on call-content sharing. It is off by default. When it is on, it covers kept calls only, and transcripts are automatically redacted of common personal details first.

Product improvement

We use aggregated or de-identified information about how the Service operates, such as usage counts, reliability and performance measures, and whether features work well, to improve the Service and develop new functionality. We apply safeguards designed to prevent this information from identifying individuals or revealing a Customer's confidential information.

Model training

Processing content to produce a result for you is different from using it to train AI models. We do not use identifiable call recordings, transcripts or other Customer Data to train generalized AI models unless the Customer explicitly authorizes it. Training is optional, declining it does not limit access to the core Service, and a Customer can withdraw its authorization for future training at any time. Google user data is never used to train generalized models (section 5).

If you connect a Google account, foly asks for permission to read, compose and send email in Gmail, to view and edit events in Google Calendar, and to see your email address. Signing in with Google uses only your basic profile and email address.

• We use Gmail access to read message details and previews, so we can show email activity on your accounts and contacts, link emails to CRM records and notice replies; to read the text of incoming messages in a mailbox your organization chooses as an Email Desk intake source; and to create and send emails that you or your organization's users write or approve.
• We use Calendar access to read your availability and to create and update the events you schedule through foly.
• We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI or machine learning models.
• We transfer Google user data to others only as needed to provide or improve the features you use (for example, to the hosting and AI processing providers described in section 7), for security, to comply with law, or as part of a merger or acquisition with notice to you.
• People at foly do not read your Google user data unless you ask us to, it is needed for security or to comply with law, or it has been aggregated and anonymized.
• Google user data we store is kept as described in section 8. You can disconnect a mailbox at any time in settings, or revoke access from your Google account; we then stop accessing your account.

foly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft mailboxes and calendars you connect are handled the same way, and you can disconnect them in settings or revoke access from your Microsoft account.

• Within your organization. Administrators and managers in your workspace can see information according to the roles they hold.
• With service providers that process information for us under contract (section 7).
• With systems you connect, such as your CRM, mailbox, calendar, phone system, workplace messaging or AI tools, when you or your administrators direct it. Those services' own terms and policies apply.
• For legal reasons, when required by law or to protect rights, safety and the Service.
• In a business transfer, such as a merger or acquisition, subject to this policy.

We use service providers that process personal information on our behalf to provide their services to us. Some are used only when a feature that needs them is turned on. They fall into these categories:

• Hosting, storage and infrastructure, to run the Service and store its data, including account, Customer Data and logs.
• Payments, to process subscription payments, using billing contact details.
• Communications, to place and receive calls, provide phone numbers, record and transcribe calls, and send service email.
• AI processing, to transcribe audio and to generate notes, scores, drafts, research and voice responses from the content a feature uses.
• Analytics and reliability, to measure product usage, performance and errors, using usage events linked to your account.
• Security, to protect accounts and the Service and to limit abuse.
• Research and enrichment, when enabled, to look up business information about companies and contacts.

Customers can request information about the service providers that process their Customer Data by emailing legal@foly.com.

• Call and practice recordings, and transcripts of calls answered by an AI Coworker, are deleted automatically after the period the Customer chooses, from 30 to 365 days (90 days by default). Longer periods depend on the Customer's plan.
• AI processing records, such as the working state of AI runs, are deleted automatically after a limited period unless a legal hold applies.
• Data exports: the download link expires after 24 hours, and the file is then removed.
• Deleted user accounts and organizations: see section 9.
• Other information, including other transcripts, Email Desk message text, scores and notes, is kept while the Customer's account is active and is deleted when the organization is deleted.
• Logs, backups and service provider copies are kept for limited periods under those systems' own retention settings, so information can remain in them for some time after it is deleted from the Service.

• Access and export. Workspace owners can export their organization's data from settings, delivered as a download link that expires after 24 hours.
• Correction. You can update your profile in settings.
• Deleting your account. You can ask to delete your user account in settings after confirming your password. Deletion runs 48 hours later, and we email you a link to cancel it. We then remove your sign-in, membership and profile photo and replace your name with "Deleted User". Content that belongs to your organization stays under its control and its retention settings.
• Deleting an organization. A workspace owner can schedule deletion of the whole organization after confirming their password. The owner can cancel for 30 days. After that, the organization's data, stored files and user sign-ins are deleted.
• Disconnecting integrations. You can disconnect a CRM, mailbox, calendar or other connection at any time.
• Privacy rights. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict some processing, and to appeal our decision on a request. We will verify your identity before acting on a request, and we will not discriminate against you for making one.

To make a request, email legal@foly.com. If your information is in the Service because a Customer contacted you, we will refer your request to that Customer and help it respond.

We use administrative, technical and physical safeguards designed to protect information. Data is encrypted in transit, and connection credentials and stored email content are encrypted at rest. Workspaces are kept separate from each other, sensitive actions such as deleting an account require your password, and multi-factor authentication is available. No method of storing or sending information is perfectly secure. Report security issues to legal@foly.com.

We and our service providers may process information in the United States and in other countries, which may have data protection laws different from those where you live. Questions about cross-border processing can be sent to legal@foly.com.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact legal@foly.com and we will delete it.

We will post changes on this page and update the effective date. If a change is material, we will notify Customers by email or in the Service before it takes effect.

foly, llc. Email for privacy requests, data deletion, security disclosures and other legal questions: legal@foly.com.