CallXTime Privacy Policy

How CallXTime collects, uses, stores, and protects personal information across the website and platform.

Last Updated: July 22, 2026

Operated by: Arohva Global

This Privacy Policy describes how CallXTime, operated by Arohva Global (“CallXTime,” “we,” “us,” or “our”), collects, uses, stores, shares, and protects personal information when you visit our websites, create an account, or use our power dialer, CRM, messaging, meetings, workflow, and related services (collectively, the “Service”).

By accessing or using the Service, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use the Service. Where we act as a processor of Customer Data on behalf of a business customer, that customer’s instructions and our Data Processing Agreement (where executed) also apply.

1. Scope, Roles & Definitions

This Policy applies to personal information processed in connection with callxtime.com, related domains, the CallXTime application, APIs, and customer support.

Roles:

• Controller: For account, billing, website analytics, and our own marketing, Arohva Global typically acts as a controller.
• Processor: For CRM contacts, call recordings, campaign content, and other Customer Data uploaded or generated by your organization, we act as a processor on your behalf.

“Customer Data” means data submitted to the Service by or for a customer workspace (tenant), including leads, contacts, call metadata, recordings (where enabled), messages, notes, and integration content.

“Personal Information” means information that identifies or can reasonably be linked to an individual.

This Policy does not cover third-party websites, apps, or services that we do not control, even if linked from the Service.

2. Information We Collect

We collect information in the following categories:

Account & organization information

• Name, work email, phone number, job title, company name, billing address, tax/GST identifiers where required
• Workspace (tenant) settings, roles, seats, and authentication identifiers
• Support tickets, chat transcripts, and feedback you send us

Customer Data you provide or generate

• Leads, contacts, companies, deals, notes, tags, custom fields, and pipeline activity
• Campaign lists, templates, dispositions, and workflow configurations
• Call logs, CDRs, recordings/transcripts where your workspace enables them, and related telephony metadata
• Email, SMS, WhatsApp, and in-app message content sent or received through the Service
• Meeting and calendar event details created or synced through integrations

Usage, device & technical data

• IP address, browser type, device identifiers, operating system, language, referring URLs
• Product analytics events, feature usage, performance metrics, and diagnostic logs
• Approximate location derived from IP for security and localization

Cookies & similar technologies

• Essential cookies for authentication and security
• Preference and analytics cookies as described in Cookies & Similar Technologies

Payment information

• Payment method metadata and transaction confirmations processed by our payment providers; we do not store full card numbers on CallXTime servers

Information from third parties

• Identity providers (e.g., Google, Microsoft) when you connect OAuth accounts
• Telephony and messaging carriers for delivery status and compliance signals
• Public or commercial data sources only where you or your organization lawfully configure such use

3. Tenant Isolation & Multi-Tenancy

CallXTime is a multi-tenant B2B platform. Each customer organization operates in a logically isolated workspace.

• Application requests are scoped to the authenticated tenant; data access checks are enforced in the application layer
• Users only see Customer Data permitted by their role and permissions within that workspace
• Cross-tenant access to Customer Data is not permitted except as strictly required for authorized support under customer instruction, security incident response, or legal obligation
• Administrators control inviting users, assigning roles, and revoking access

You remain responsible for how your users handle Customer Data inside your workspace, including exports and sharing outside CallXTime.

4. Google, Microsoft & OAuth Integrations

When you connect Google Workspace, Microsoft 365, or similar providers, CallXTime requests only the OAuth scopes needed for features you enable.

Typical Google scopes for CallXTime features include:

• Basic profile / Sign-In: openid, email, profile (and userinfo.email / userinfo.profile where applicable)
• Gmail: gmail.send (send mail you initiate from CallXTime)
• Calendar: calendar.events (create and manage events for meetings)
• Contacts / People API: contacts.readonly (optional CRM contact import)

How we use Google user data

• Send sales and transactional email you initiate from CallXTime
• Track open/click engagement for messages sent through CallXTime (where tracking is enabled)
• Create, update, and display calendar events related to meetings you schedule in CallXTime
• Optionally import Google Contacts (names, emails, phone numbers) into your CRM when you enable Contacts sync
• Maintain secure tokens so the integration continues to work until you disconnect it

Inbox and reply sync for CRM timelines is available via Microsoft Outlook / Graph where enabled. CallXTime does not request Gmail read (gmail.readonly) access and does not use Google Photos APIs.

You can revoke access at any time from CallXTime integration settings or your Google / Microsoft account security page. Revocation stops new API access; previously synced Customer Data remains in your workspace until you delete it according to retention settings.

See Google Limited Use Requirements & AI/ML for additional Google-user-data commitments.

5. Telephony, Messaging & Communications

CallXTime processes communications data to deliver dialer, SMS, WhatsApp, and email features:

• Call setup, routing, disposition, duration, recording/transcription (if enabled by your workspace)
• Message bodies, delivery receipts, open/click engagement signals (where tracking is enabled), and unsubscribe preferences
• Carrier and provider metadata required for delivery, billing, spam prevention, and regulatory compliance

Your organization is responsible for obtaining and documenting lawful consent, honoring Do Not Call / DND / opt-out requests, and complying with telemarketing, spam, and messaging laws in every jurisdiction where you contact individuals.

We may process limited engagement and delivery events (e.g., opens, clicks, bounces) to operate analytics, improve deliverability, and honor unsubscribe requests.

6. Cookies & Similar Technologies

We use cookies and similar technologies to:

• Authenticate users and maintain secure sessions
• Remember preferences and UI settings
• Measure site and product performance
• Prevent fraud and abuse

Essential cookies are required for the Service to function. Analytics or marketing cookies (if used) may be controlled via cookie banners or browser settings where required by law.

You can typically block or delete cookies in your browser; doing so may impair login or certain features.

We do not respond to every “Do Not Track” browser signal in a uniform way because there is no consistent industry standard; we honor legally required opt-outs for marketing where applicable.

7. Payment Processing

Subscription billing is processed by certified payment service providers (for example, Stripe or regional payment gateways).

• Card numbers and sensitive payment credentials are handled by the payment provider under their PCI DSS obligations
• CallXTime stores billing profile details, invoices, tax identifiers, plan entitlements, and payment status needed to operate your subscription
• Payment providers may process limited personal information as independent controllers or processors under their own privacy notices

Failed payments, chargebacks, and fraud checks may involve sharing necessary account and transaction data with the payment provider.

8. How We Use Information

We use personal information to:

• Provide, operate, maintain, and improve the Service
• Authenticate users, manage seats, roles, and workspaces
• Process transactions, invoices, and customer support
• Enable dialer, CRM, campaigns, messaging, meetings, and integrations you configure
• Detect, investigate, and prevent security incidents, spam, fraud, and abuse
• Generate product analytics and aggregated, de-identified insights that do not identify individuals
• Communicate service notices, security alerts, and (where permitted) product updates or marketing
• Comply with law, enforce agreements, and protect rights, safety, and property

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws, except where a disclosure is required by law or you direct us to do so through an integration you enable.

9. Legal Basis For Processing

Where the GDPR, UK GDPR, or similar laws apply, we rely on one or more of the following bases:

• Contract: To provide the Service you request and perform our agreement with you
• Legitimate interests: To secure and improve the Service, prevent abuse, and communicate important updates — balanced against your rights
• Consent: Where required (for example, certain cookies or marketing emails); you may withdraw consent at any time
• Legal obligation: Tax, accounting, regulatory, and lawful requests

When we process Customer Data as a processor, the customer (controller) is responsible for establishing a lawful basis for collecting and instructing us to process that data.

10. Data Sharing & Service Providers

We share personal information only as needed to operate the Service:

• Infrastructure and hosting providers
• Telephony, SMS, WhatsApp Business API, and email delivery providers
• Payment processors and invoicing tools
• Analytics, logging, error monitoring, and customer support tools
• Professional advisors (legal, accounting) under confidentiality
• Affiliates of Arohva Global that assist in delivering the Service under this Policy

Service providers are bound by contractual confidentiality and data-protection obligations and may process data only on our documented instructions (or, where they are independent controllers, under their own notices).

We may disclose information if required by law, legal process, or governmental request; to protect users, the public, or CallXTime; or in connection with a merger, acquisition, financing, or sale of assets (with appropriate safeguards).

A current subprocessors overview is available to enterprise customers upon request.

11. International Data Transfers

CallXTime and its providers may process data in India, the United States, the European Economic Area, and other countries where we or our subprocessors operate.

Where required, we use appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions, or equivalent safeguards, and implement supplementary technical and organizational measures as needed.

By using the Service, you understand that your information may be transferred to and processed in countries that may have different data-protection laws than your own.

12. Data Retention & Deletion

We retain personal information only as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical practices:

• Account and billing records: retained for the life of the account plus periods required for tax, audit, and dispute resolution
• Customer Data: retained until deleted by your administrators, upon workspace termination subject to backup windows, or according to retention settings you configure
• Security and audit logs: retained for operational security and compliance periods
• Backups: rotated on a scheduled basis; deleted data may persist in encrypted backups until those backups expire

Google user data obtained via OAuth is retained only while the integration is connected and as needed to provide the requested features. After disconnect or deletion requests, we delete or de-identify Google user data from active systems within a commercially reasonable period, subject to legal hold and backup cycles.

Workspace admins may request deletion of Customer Data by contacting support. Individuals may submit rights requests as described below; for Customer Data we process as a processor, we will refer you to the relevant customer or act on that customer’s instructions.

13. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, encryption at rest for platform data stores, access controls, tenant isolation, logging, and employee access restrictions.

No method of transmission or storage is 100% secure. You are responsible for safeguarding account credentials, configuring workspace permissions appropriately, and securing devices used to access CallXTime.

For a fuller description of controls, see our Security page at /security.

14. Your Privacy Rights

Depending on your location, you may have rights to:

• Access and receive a copy of personal information we hold about you
• Correct inaccurate or incomplete information
• Delete personal information (subject to legal exceptions)
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is based on consent
• Opt out of marketing communications
• Lodge a complaint with a supervisory authority

California and similar U.S. state residents may have additional rights regarding access, deletion, correction, and opting out of “sale” or “sharing” of personal information. We do not sell personal information. To exercise rights, email [email protected] or [email protected] with sufficient detail to verify your identity and locate your data.

If your data was submitted by a CallXTime customer (for example, you are a lead in a customer CRM), please contact that organization directly; we will assist them as their processor.

15. Google Limited Use Requirements & AI/ML

The use of raw or derived user data received from Google APIs (including Gmail, Google Calendar, and Google Contacts / People API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

CallXTime’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, with respect to Google user data obtained via Google OAuth:

• We use Google user data only to provide and improve user-facing features that are prominent in CallXTime (Gmail send you initiate, Calendar events for meetings, and optional Contacts import into your CRM)
• We do not use Google user data for serving advertisements
• We do not sell Google user data
• We do not use Google user data for creditworthiness or lending decisions
• We do not allow humans to read Google user data except: (a) with your affirmative agreement for specific messages; (b) for security, abuse, or legal compliance investigations; or (c) when the data is aggregated and anonymized for internal operations where no longer attributable to you or Google accounts

AI / machine learning

• We do not use Google user data (including raw, aggregated, or derived Workspace data) to develop, improve, or train foundational or generalized AI and/or ML models
• We do not transfer Google Workspace user data to third-party AI/ML services that use that data to train their models
• We do not integrate commercial LLM APIs (for example OpenAI, Anthropic, or Google Gemini API) with Gmail, Calendar, or Contacts user data
• In-product features labeled “AI” (such as routing or insights) run on CallXTime servers using application logic and heuristics; they do not send Google Workspace user data to third-party LLM providers
• Optional translation or speech components, if enabled, process non-Workspace content you provide (for example user-authored scripts) and do not receive Google OAuth Workspace API user data
• Workspace AI features (if enabled) operate on Customer Data within your tenant under your configuration and do not use Google user data to build models shared across unrelated customers

For more detail, see Google’s API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

16. Marketing Communications

We may send service-related messages (billing, security, product changes) that are not marketing.

Where permitted, we may send product news and offers. You can unsubscribe using the link in the email or by contacting us. Unsubscribing from marketing does not stop transactional or security notices needed to operate your account.

Customers who use CallXTime to send campaigns are solely responsible for their own marketing content, recipient consent, and unsubscribe handling for their lists.

17. Children's Privacy

CallXTime is a business service and is not directed to children. We do not knowingly collect personal information from individuals under 16 years of age (or the minimum age required in your jurisdiction).

If you believe a child has provided us personal information, contact [email protected] and we will take appropriate steps to delete it.

18. Updates To This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the latest revision.

Material changes will be posted on this page and, where required by law or contract, communicated by email or in-product notice. Continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy, except where additional consent is required by law.

19. Contact Information

Controller / operator: Arohva Global (CallXTime)

Privacy requests: [email protected] General support: [email protected] Website: https://callxtime.com Security: [email protected] or see /security

For Data Processing Agreements, subprocessors lists, or enterprise due-diligence questionnaires, contact us via /contact or [email protected].