Privacy Policy

Effective Date: September 29, 2025

Mykalan, LLC operates AI McFly, an AI-powered phone answering service for small businesses. This policy explains what information we collect, how we use it, who processes it, and how we protect your privacy.

Information We Collect and Store

Account Information

We store the following information in our database when you create an account:

• Your name, email address, and encrypted password
• Your company name and business phone number
• Business hours and appointment type preferences
• Voice preferences (male/female, voice provider selection)
• Your timezone setting

Google Calendar Connection

When you connect your Google Calendar, we securely store:

• Google access tokens and refresh tokens (encrypted)
• Your Google Calendar email address
• Connection timestamp

These tokens allow us to access your calendar on your behalf to check availability and create appointments when customers call.

Payment Information

For subscription billing, we store:

• Your Stripe customer ID and subscription ID
• Stripe processes and stores your actual payment card details - we never see or store complete card numbers

Phone Service Information

We store identifiers for your dedicated phone number from Twilio and VAPI (our voice platform provider) to route calls to your AI assistant.

Technical Information

Like most websites, we automatically collect:

• IP address and general location
• Browser type and device information
• Pages visited and login times

How Phone Calls Are Processed

When customers call your AI McFly number, our voice platform provider (VAPI) processes the conversation using AI technology from OpenAI, ElevenLabs, and Deepgram. When booking an appointment, we access your Google Calendar to check availability and create the appointment.

Call Data Storage

VAPI stores call-related information including:

• Call recordings (if recording is enabled)
• Call transcripts
• Call metadata (phone numbers, duration, timestamps)
• Call logs and outcomes

VAPI may retain this data to improve their AI services. Review VAPI's privacy policy at vapi.ai/privacy.

Google Calendar Data: Complete Disclosure

What We Access

We access your Google Calendar only when a customer is actively booking an appointment. Specifically, we:

• Read your calendar's free/busy status to find available time slots
• Check existing appointments to prevent double-booking
• Create new calendar events when appointments are confirmed

How We Use Calendar Data

• Check your availability in real-time during calls
• Create appointment entries with customer details
• Prevent scheduling conflicts

Calendar Data Storage

We do not store copies of your Google Calendar data. Here's what that means:

• We only access calendar information in real-time during active calls
• We don't download, backup, or archive your calendar events
• Once an appointment is created, we no longer access that information
• We only store the access tokens needed to connect to your calendar

Who Processes Calendar Data

During appointment booking, your calendar availability information is processed by our service providers (VAPI and OpenAI) only as needed to complete the booking conversation. This data is processed momentarily and is not stored afterward.

What We Don't Do With Calendar Data

• We don't sell or share your calendar information for advertising
• We don't use it to train AI models
• We don't read appointment details beyond what's necessary to check availability
• We don't access your calendar when no one is calling

Your Control Over Calendar Access

You can disconnect your Google Calendar anytime through your Google Account security settings or by contacting us. Disconnecting will disable appointment booking functionality, but you can reconnect at any time.

Third-Party Service Providers

We work with these companies to deliver our service:

VAPI (Primary Voice Platform)

VAPI provides our voice AI infrastructure and processes all phone calls. They store call recordings, transcripts, and logs. Review their privacy policy at vapi.ai/privacy.

AI Providers (via VAPI)

• OpenAI: Powers conversation understanding and response generation. Privacy policy: openai.com/policies/privacy-policy
• ElevenLabs: Provides natural voice synthesis. Privacy policy: elevenlabs.io/privacy-policy
• Deepgram: Transcribes speech to text. Privacy policy: deepgram.com/privacy

Payment Processing

Stripe: Securely processes all subscription payments. Review their privacy policy at stripe.com/privacy.

Phone Services

Twilio: Provides phone number services.

How We Use Your Information

• Provide the service: Route calls, manage your AI assistant, check calendar availability, create appointments
• Account management: Maintain your account, process authentication, handle password resets
• Billing: Process subscription payments through Stripe
• Customer support: Respond to your questions and resolve issues
• Service improvement: Analyze usage patterns to enhance features
• Communications: Send account updates, service announcements, and optional marketing (you can opt out)
• Legal compliance: Meet legal obligations and respond to valid legal requests

Data Security

We protect your information through:

• Encryption of sensitive data (passwords, tokens, payment information)
• Secure HTTPS connections for all data transmission
• Restricted access to customer data within our team
• Regular security reviews and updates
• Secure authentication and password requirements

While we implement strong security measures, no internet system can be guaranteed 100% secure. Please use a strong password and keep your login credentials confidential.

Data Retention

• Account data: Kept as long as your account is active
• Call data: Retained by VAPI according to their retention policies
• Google Calendar data: Never stored - only accessed in real-time during calls
• Payment data: Retained by Stripe according to their policies and legal requirements

When you close your account, we delete your data within 90 days unless we must retain it for legal, tax, or accounting purposes.

When We Share Information

We share your information only in these situations:

• Service providers: With VAPI, Stripe, Twilio, and Google to deliver our service
• Legal requirements: When required by law, court order, or to protect rights and safety
• Business transfers: If AI McFly is acquired or merged, information may transfer to the new owner
• With your consent: When you explicitly authorize sharing

We do not sell your personal information to anyone.

Your Privacy Rights

Rights Available to Everyone

• Access: Request a copy of your personal information
• Correction: Update or fix incorrect information in your account
• Deletion: Close your account and have your data removed
• Marketing opt-out: Unsubscribe from promotional emails (you'll still receive important account emails)
• Calendar disconnection: Revoke Google Calendar access anytime

Additional Rights for US Residents

If you live in California, Virginia, Colorado, Connecticut, or other states with comprehensive privacy laws, you also have:

• Right to know what personal information we collect and how we use it
• Right to request detailed categories of data collected
• Right to opt out of "sales" of personal information (we don't sell data)
• Right to non-discrimination for exercising privacy rights

How to Exercise Your Rights

Email us at support@aimcfly.com with your request. We'll verify your identity and respond within the legally required timeframe.

Cookies and Tracking

We use cookies to:

• Keep you logged into your account
• Remember your preferences
• Understand website usage and performance
• Prevent fraud and maintain security

You can disable cookies through your browser settings, though some features may not work properly without them.

International Data Transfers

Our servers and service providers are located primarily in the United States. If you're outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from your jurisdiction. By using AI McFly, you consent to this transfer.

Children's Privacy

AI McFly is designed for businesses and their adult owners. We don't knowingly collect information from anyone under 18. If we discover we've collected data from a minor, we'll delete it immediately. Contact us if you become aware of any such collection.

Changes to This Policy

We may update this privacy policy as our service evolves or laws change. We'll post the updated version here with a new effective date. For significant changes, we'll email you or post a notice in your account. Continuing to use AI McFly after changes means you accept the updated policy.

Contact Us

Questions or concerns about privacy? We're here to help: