Privacy Policy

AI GG Corp (OneRingAway) · Last updated October 9, 2026

1. Who we are

OneRingAway is the public brand of AI GG Corp, a company based in New York, USA ("OneRingAway," "we," "us"). We provide an AI phone receptionist ("Amy") that answers calls, books appointments, and sends confirmation texts on behalf of local service businesses.

This Privacy Policy explains what information we collect when you visit oneringaway.com (the "Site"), when a business signs up for our service (the "Service"), and when someone calls a business that uses our Service — and how we use, share, and protect that information.

By using the Site or the Service, you agree to this policy. If you don't agree, please don't use them.

2. Information we collect

From website visitors:

• Basic, privacy-respecting analytics: pages visited, approximate region, device and browser type. We do not use advertising trackers or cross-site cookies.
• Contact details you volunteer — for example, your email address if you write to us or start a free trial.
• Billing information if you purchase a plan. Card details are collected and processed directly by Stripe, our payment processor — we never see or store your full card number.

From businesses that use the Service (account holders):

• Business name, contact name, email, phone number, and billing details
• The information you give us to train your AI receptionist: services, pricing hints, hours, greeting preferences, staff and routing rules
• If you connect your Google Calendar: the start and end times of events on your primary calendar, and the appointments we add — see "Google Calendar data" below for exactly what we read and write

From callers to businesses that use the Service:

• Call audio and transcripts of calls answered by the AI receptionist
• The caller's name, phone number, and any details they share during the call (such as appointment requests or service needs)
• Technical call metadata: time, duration, and outcome

3. Google Calendar data

Connecting Google Calendar is optional. When an account holder connects it from Settings, OneRingAway asks Google for one permission only — "See, create, change, and delete events on Google calendars you own" (the Google Calendar API scope calendar.events.owned). We ask for nothing else: no access to your other calendars, your calendar settings, your contacts, your email, or any other Google service. Here is exactly what that permission is used for and nothing more.

What we read: every two minutes — and once more, for that one time window only, at the moment Amy is about to book — we ask Google for the events on your primary calendar for the next few weeks, requesting only each event's start time, end time, free/busy setting, status, and our own booking tag. We do not request or store event titles, descriptions, locations, guests, attachments, or anything else about your events. Those times are used for one purpose: to mark the matching appointment slots as taken, so Amy never offers a time you are already busy. Once the busy slots are marked, the event times themselves are discarded.

What we write: when Amy books an appointment, we create one event on your primary calendar with the appointment details (the caller's name, phone number, address, and the reason for the visit). If the appointment changes, we update that event; if it is cancelled, we delete that event. Every event we create carries our own tag, and we only ever update or delete events we created.

What we never do: we never share your calendar data, in raw, aggregated, or derived form, with the AI voice provider, the language model, or any other third party. Your calendar times are processed only on our own servers. Amy is told which appointment slots are open — she is never given your events. We never use Google user data for advertising, we never sell it, and we never use it to train or improve any artificial-intelligence or machine-learning model, whether our own or anyone else's. No human at OneRingAway reads your calendar data except to fix a problem you ask us to fix, or as required by law.

How it is protected: the credential Google gives us to access your calendar (the refresh token) is encrypted at rest with AES-256-GCM using a key kept separately from the database, and it is transmitted only over TLS. The busy-slot markers we keep hold only a time and the words "on your Google Calendar". You can disconnect at any time from Settings, which deletes the credential and every busy-slot marker immediately, or by removing OneRingAway at myaccount.google.com/permissions; if Google revokes the credential, we delete it and the markers as soon as we notice. Deleting your account deletes it all.

Limited Use disclosure: OneRingAway's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

4. The OneRingAway mobile app

Account holders can also use the OneRingAway app for iPhone and Android. The app shows the same information as the website portal — calls, transcripts and recordings, bookings, texts sent, usage and billing — and lets the account holder change how the receptionist works, approve or move bookings, pause or resume the service, and delete data.

What the app collects: the email you log in with and your password (stored only as a salted one-way hash, never as the password itself; the one-time code used to create the account or reset the password is stored only as a hash too), and a session token kept in the phone's secure keychain. Nothing else is read from the phone: the only permission the app ever asks for is notifications, and only if you turn them on (so your phone can buzz when a booking needs your OK, a message or table request arrives, a call is missed or an emergency is put through — never for marketing); when you do, a push token for your phone is stored with your account and deleted when you log out or switch notifications off. No microphone, contacts, location, photos or camera. The app does not track you across other apps or websites, does not use advertising identifiers, and contains no analytics or advertising SDKs. Recordings are streamed for playback and are not saved on the phone.

The app talks only to our own servers over TLS. The keys for our phone, voice, payment and database providers live on our servers, never inside the app. Logging out deletes the session token from the phone; sessions also expire on their own after 30 days.

Payments: subscriptions are billed by Stripe on our website. The app shows your plan, the card on file (brand and last four digits only) and your invoices, and opens Stripe's own secure page for card changes; it does not take card numbers itself. Apple and Google are not involved in billing for the service.

5. How we use information

We use the information above to:

• Operate the Service — answer calls, book appointments, and send confirmation texts on behalf of your business
• Generate transcripts, summaries, and call logs for the account holder
• Configure and tune each business's individual AI receptionist — its instructions, hours, and routing rules (one customer's calls are never used to configure another customer's receptionist, and no customer data is used to train or improve any general AI model)
• Process payments and manage subscriptions via Stripe
• Respond to support requests and communicate about your account
• Meet legal obligations and protect against fraud or abuse

We do not sell personal information. We do not share it for cross-context behavioral advertising.

6. Call recording notice

Calls answered by the AI receptionist are recorded and transcribed so the business owner can review them and so we can maintain quality. Callers are informed at the start of each call that they're speaking with an AI assistant and that the call may be recorded and transcribed.

Some US states (including California, Florida, and Pennsylvania) require all parties to consent to recording. If you are a business using the Service, you are responsible for informing us of any local requirements that apply to your callers, and our default disclosure script is designed to satisfy all-party consent rules. If you're a caller and don't want to be recorded, hang up and contact the business another way.

7. Text messaging (SMS)

When the AI receptionist books an appointment, it may send a confirmation text to the caller's number, with the caller's consent given during the call. Every message includes opt-out instructions — reply STOP at any time and that number will never be texted again (reply START to opt back in).

We comply with US A2P 10DLC registration requirements for business messaging. Message and data rates may apply depending on the recipient's mobile plan. We never use phone numbers collected through the Service for marketing texts.

8. Payments

Purchases on the Site are processed by Stripe, Inc. When you check out, your payment details go directly to Stripe over an encrypted connection and are handled under Stripe's own privacy policy (stripe.com/privacy). We receive only a confirmation, your plan, and the last four digits of your card — never the full number. Stripe is PCI-DSS Level 1 certified, the highest level of payment security certification.

9. Who we share information with

We share information only with the service providers we need to run the Service, each bound by terms that limit them to providing their service to us:

• Twilio (to carry calls and texts)
• Retell AI (the voice platform that runs the receptionist's conversation; it uses OpenAI language models and Deepgram speech recognition under its own agreements — none of which train on our customers' data)
• Anthropic (an AI model that reviews finished call transcripts for quality problems and reports them to our team; Anthropic does not train on data sent through its API)
• Railway and Neon (cloud hosting and the encrypted off-site database copy)
• Stripe (payments)
• Google (only if you connect Google Calendar — see "Google Calendar data")

What the AI providers receive is limited to what the conversation needs: the call audio, the words spoken, the business's instructions, and the open appointment slots Amy may offer. They never receive your Google Calendar data, your card details, or your account password.

Call recordings and transcripts for a business are visible to that business's account holder, and to a small number of our team members who need access for quality checks and support.

We may also disclose information if legally required (for example, a valid court order or subpoena), or as part of a merger or acquisition — in which case this policy continues to apply.

10. How long we keep information

Call recordings and transcripts are removed automatically 90 days after the call — from our database and from the voice provider that stores the audio. An account holder can erase any single call's recording and transcript, or everything about one caller, at any time from the OneRingAway app; that erasure is immediate on our side and sent to the voice provider the same minute. Text messages we sent are removed 90 days after they were sent. Booking and caller details are kept while the business's account is active, so repeat callers are recognised. When an account is closed, its callers, bookings, calls and texts are erased within 90 days — or immediately, when the account holder uses "Delete my account and all data" on their billing page, in the OneRingAway app (More → Privacy & your data), or at oneringaway.com/delete-account. Billing records are kept as required for tax and accounting purposes, with no call data in them.

11. Security

Data is encrypted in transit (TLS) and at rest. Call transcripts, recording links, and Google Calendar credentials are additionally encrypted (AES-256-GCM) inside our database with a key kept separately from the data, and every copy of the database that leaves our server — including our off-site backup — is encrypted (the off-site copy with that key, backup files with a separate passphrase that never leaves our office), so a copy on its own is unreadable. Payment data is handled entirely by Stripe's PCI-certified systems and never reaches us. Logins use a password or a one-time code or link; we never store a password itself, only a salted one-way hash of it, and one-time codes are stored only as hashes too. Every message from our phone and text providers is signature-checked before it is trusted. Access to production systems is limited to named team members using multi-factor authentication, including a texted code for our operations console. No method of transmission or storage is 100% secure, but we work to protect your information with these safeguards — and if a breach ever affects your data, we'll notify you promptly.

12. Your rights

Everyone: you can access, correct, export, or delete your personal information at any time — email info@oneringaway.com and a human handles it, usually within two business days. Account holders can delete their entire account and every record themselves, at once, from their billing page, from the OneRingAway app (More → Privacy & your data → Delete my account), or — without the app installed — at oneringaway.com/delete-account, which confirms the request with a code sent to the phone or email on the account.

US state residents (including California under the CCPA/CPRA): you have the right to know what personal information we hold about you, to request its deletion or correction, and to not be discriminated against for exercising these rights. Because we don't sell or share personal information for advertising, there is no "sale" to opt out of. Callers whose data appears in a customer's call logs can contact us the same way, and we will work with that customer to honor the request.

EEA/UK visitors: where the GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interest (running and improving the Site), and consent (newsletter, SMS). You have the right to lodge a complaint with your local data protection authority.

13. Children

The Site and Service are intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, email us and we'll delete it.

14. International transfers

We are based in the United States and process data there. If you use the Site or call a business using the Service from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from your country's.

15. Changes to this policy

If we change this policy in a way that matters, we will email account holders at least 14 days before the change takes effect, and we'll update the "last updated" date on this page. The current version is always available here.

16. Contact

AI GG Corp · New York, USA

Email: info@oneringaway.com

Phone: (347) 808-4082

Questions: info@oneringaway.com