Privacy Policy

Last updated: 21 October 2026

Callwarm is run by Maria Habibi, a sole trader in New South Wales, Australia (ABN 38 681 063 591), trading as Callwarm (“we”, “us”). We serve businesses in Australia and overseas. This policy explains what personal information we collect, how we use and protect it, and the choices and rights you have. We follow the Australian Privacy Principles, and where they apply to you, the EU and UK GDPR, the California Consumer Privacy Act (CCPA) and Canada’s PIPEDA.

Two kinds of people

• Business owners who sign up for Callwarm. We decide how your account information is used, as explained here.
• Their customers: people who call, text or send an enquiry to a business that uses Callwarm. We handle their information on behalf of that business, only to provide the service to it. The business is responsible for telling its customers how it uses their details. If you’re one of those customers, you can contact the business directly, or us, and we’ll help.

What we collect

• Account details: your name, business name, email, mobile number, industry, country and password (stored only in scrambled, hashed form).
• Business information you give the assistant: your answers to our set-up questions (such as services, prices, hours and areas) and, if you choose, your website address. If you ask us to fill in answers from your website, we read the public pages of that website.
• Customers’ details: the phone number of people who call while you can’t answer, the texts they exchange with your Callwarm number, and when it happened. For enquiry forms (Facebook and Instagram lead ads, or a form on your website), the name, phone number, email and answers the person filled in. If a booking is made, its time and job details.
• Payments: handled by Stripe (website) or Apple (iPhone app). We see your plan and payment status, never your full card number.
• Technical information: a login cookie, a cookie that remembers your chosen app language, and basic server logs (such as IP address and time) used for security and fixing problems. Our website and our sign-up and set-up pages use the Meta Pixel, which sets cookies so we can measure and improve Callwarm’s own advertising on Facebook and Instagram (for example, counting how many people sign up after seeing an ad). It never sees your customers’ messages or details. Once you’re logged in, the app itself and the iPhone and Android apps don’t use it, and the phone apps don’t track you across other companies’ apps or websites. You can limit this in your browser or Facebook ad settings.

How we use it

• To provide Callwarm: text missed callers and new leads back, hold the conversation, alert the business owner, show conversations and results, and book appointments.
• To run your account, bill you, give support and send important service messages (for example about your plan or text allowance).
• To keep Callwarm secure, prevent misuse and spam, and meet our legal obligations.
• To improve Callwarm, using information about how features are used. We don’t use customers’ messages to market to them, and we never sell personal information or use it for advertising.

If you’re in the EU or UK, the legal bases we rely on are: performing our contract with the business, our legitimate interests in running a safe and useful service, complying with the law, and your consent where we ask for it.

The AI assistant

Callwarm uses an AI model provided by Anthropic to write replies to callers and leads, using the business information the owner has given us, to translate messages, and to suggest set-up answers. The relevant messages and business information are sent to Anthropic for this. Anthropic acts as our service provider and, under its commercial terms, doesn’t use this information to train its models. AI replies can sometimes be wrong. Businesses can read every conversation, take over at any time, and turn the assistant off. If someone asks whether they’re talking to a person, the assistant says it’s the business’s automated assistant.

Facebook and Instagram

If a business connects its Facebook Page, Meta sends Callwarm the answers to that Page’s lead-ad forms so we can text the person back. We store an encrypted access key for the Page. We don’t post to the Page, read its messages or change its ads. The business can disconnect the Page in Callwarm at any time, or remove Callwarm in its Facebook settings, and access stops straight away. Our use of Meta data follows Meta’s Platform Terms.

Calendars and booking systems

If a business connects its calendar or booking system (such as Google Calendar, Microsoft Outlook, Cliniko or Square), Callwarm reads when the business is busy so it only offers free times, and adds the bookings it makes. We don’t read the details of other appointments, and the business can disconnect at any time in Settings. Connection keys are stored encrypted. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We only share personal information with service providers who help us run Callwarm, under agreements that require them to protect it and use it only for us:

• Vercel and Netlify (hosting), Supabase (database)
• Twilio (phone numbers, calls and texts)
• Stripe and Apple (payments and subscriptions)
• Resend (email)
• Anthropic (AI assistant and translations)
• Meta (the Meta Pixel on our website, to measure our own ads)
• Meta, Google, Microsoft, Cliniko or Square, only when a business connects them

We may also disclose information if the law requires it, to protect people’s safety, or as part of a sale of the business (in which case this policy keeps applying). Some of these providers store data outside Australia, mainly in the United States. We take reasonable steps to make sure they protect it to a standard similar to Australian law.

Texts and opting out

The first text a person receives from a Callwarm number tells them how to stop. Anyone can reply STOP at any time and that business’s Callwarm number won’t text them again unless they reply START.

How long we keep it

• We keep account and conversation data while the account is open, so the business can see its history.
• When a business deletes its account (Settings → Delete account), we delete its account, conversations, messages, bookings and connections straight away. Copies in our backups are overwritten within 30 days.
• We keep billing records for as long as tax laws require (generally 5 to 7 years).
• Server logs are kept for a short time, usually no more than 30 days.

Keeping it safe

Information is sent over encrypted connections, passwords are hashed, and access keys for connected services are encrypted. Only the people who need it to run Callwarm can access personal information. No system is perfectly secure, but if a data breach is likely to cause serious harm, we’ll notify the people affected and the regulator as the law requires, including under Australia’s Notifiable Data Breaches scheme.

Your rights

You can ask us to access, correct, delete or send you a copy of your personal information, or to stop using it for a particular purpose, by emailing hello@callwarm.com.au. We’ll reply within 30 days and won’t charge you for a reasonable request. We may need to confirm who you are first. Business owners can also update their details in Settings and delete their account in the app.

• EU and UK: you also have the right to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your local data protection authority.
• California: you have the right to know what we collect and how we use it, and to delete or correct it. We don’t sell or “share” personal information for cross-context behavioural advertising, and we won’t treat you differently for using your rights.
• Canada: you can access and correct your information and withdraw consent, subject to legal limits.

If you’re a customer of a business that uses Callwarm, we may pass your request to that business, because it controls your information.

Children

Callwarm is a business service for people aged 18 and over. We don’t knowingly collect information from children for our own purposes.

Changes to this policy

We may update this policy as Callwarm changes. We’ll post the new version here with a new date, and tell business owners by email or in the app about important changes.

Contact and complaints

Email hello@callwarm.com.au. If you’re not happy with our response, you can contact your privacy regulator. In Australia, that’s the Office of the Australian Information Commissioner at oaic.gov.au.