Privacy Policy
This policy explains what Kavara Inc. ("CommLocker", "we") collects when you use the
CommLocker apps and the website at commlocker.io, why, who helps us process it, how long we keep it,
and how you can see, change or delete it.
The short version
- We never sell your data, and we never share it for advertising.
- We never share mobile phone numbers or texting consent with anyone for their own marketing.
- Your business's records belong to your business. We process them only to run CommLocker for you.
- Your phone's contacts stay on your phone. They are never uploaded.
- AI features are off until your business turns them on. The AI providers we use keep nothing and train on nothing.
- When you delete your data, it is removed at once. Database backups keep deleted data for up to 35 days, then it is gone from them too.
Two kinds of data, two roles
Your account. Your name, email, sign-in details, devices and how your business uses its plan. For this data, CommLocker decides how it is used, as this policy describes.
Your business's records. The calls, texts, voicemail, email, meetings and messages your business captures, including what other people (your callers and customers) say in them. Your business decides what is captured and who on the team can see it. CommLocker processes these records on your business's behalf, as a service provider, under our Terms of Service and our Data Processing Addendum.
What we collect, and why
| What | Where it comes from | Why |
|---|---|---|
| Name, email address, phone number | You, when you sign in or are invited | Your account, sign-in, notices about your account |
| Business name, business address and 911 service address | You, during setup | Your business profile, exports, texting registration, 911 |
| Sign-in details | Apple, Google, or the code we email you | Signing you in. We never have a password for you |
| Device identifiers (push and calling tokens) | Your phone | Ringing your phone for calls and sending notifications |
| Call recordings, voicemail and greetings | Calls on your business's CommLocker numbers | Your business's records, transcripts and summaries |
| Texts, photos and files sent by text | Texts on your business's CommLocker numbers | Your business's records |
| Email, meeting recordings and transcripts, WhatsApp, Instagram and Facebook messages | The accounts your business chooses to connect | Your business's records |
| Documents you import | You, from the share sheet or file picker | Your business's records |
| Notes, Files, names you give people, Ask questions | You | Organising records and answering your questions |
| Help requests and problem reports | You, from Help in the app | Fixing problems |
| Crash reports | The app, through Sentry | Fixing crashes. Reports carry no record content, names or numbers |
| Plan, usage and billing status | Our servers and Stripe | Your plan, allowances and invoices |
| Card brand, last four digits, expiry and ZIP code | Stripe | Showing which card is on file. Your full card number goes to Stripe, never to us |
| Precise location | Your phone, only if you allow it, only during a 911 call | Sending responders to where you are |
What we don't collect:
- Your contacts. If you let CommLocker read your phone's contacts, matching happens on your phone. Your address book is never uploaded.
- Voiceprints. We don't identify people by their voice. Transcripts label speakers by which side of the call they were on.
- Your location, outside a 911 call. Location is used only to send with a 911 call, and is not kept beyond that call's record.
- Tracking or advertising data. We don't track you across other apps or websites.
AI
Ask, call summaries and meeting summaries are off until your business's Owner or an Admin turns AI on. Each person also agrees, once, before they first use Ask, and anyone can turn Ask off for themselves.
When AI is on, the parts of your records a question needs are sent through OpenRouter to a model from Anthropic, OpenAI or Google. The app names the providers in use before you agree. We use only providers that keep nothing and train on nothing (zero data retention), and every request we send requires it. We send the least a question needs, and only what the person asking is allowed to see. CommLocker does not run its own AI models.
Your Ask history is kept until you delete it, or until your account is deleted.
Google user data
CommLocker's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: Gmail and other Google data is used only for features you can see (your records, search, Ask and summaries). It is never used for ads, never sold, and never used to train AI models. No one at CommLocker reads it unless you agree, or a security or legal reason requires it.
Texting
- We never share mobile phone numbers, texting opt-in data or texting consent with anyone for their own marketing or promotional purposes. None of the sharing described in this policy includes texting opt-in data or consent.
- Every text, including STOP and START replies, is kept as a record for the business that sent or received it, so opt-ins and opt-outs are on file.
- Anyone who texts a business on CommLocker can reply STOP to stop texts from that business, and HELP for the business's name and how to reach it. More in our Terms of Service.
Who processes data for us
These companies process data only to provide CommLocker, under contracts that require them to protect it as we do.
| Who | What for |
|---|---|
| Amazon Web Services | Hosting, storage, databases, sign-in and email, in the United States |
| Telnyx | Phone numbers, calls, texts, voicemail, 911, number porting, texting registration, live and voicemail transcripts (<transcription engine and how long Telnyx keeps audio and text>) |
| OpenRouter, and Anthropic, OpenAI and Google models | AI features, only when your business turns them on, with zero data retention |
| Stripe | Payments, invoices and the card on file |
| Sentry | Crash reports, with personal data removed |
| A communications tax service | Working out telecom taxes on your invoices |
| Apple and Google | Sign in with Apple or Google, and delivering notifications and incoming calls to your phone |
When your business connects email, meetings or messaging (Google, Microsoft, Zoom, Meta), we receive data from those services at your business's request.
Once we have stored a call recording, we delete the carrier's copy.
How long we keep data
| Data | How long |
|---|---|
| Your business's records | While your business has a plan, and for 90 read-only days after the plan ends, so you can export everything and move your number. Then they are deleted. A business can also choose to keep records for less time |
| A record someone deletes | Removed from CommLocker at once. The stored copy stays in locked storage and is erased when its lock ends, 90 days later. The app tells you the date |
| Export files | 30 days. An export can be made again |
| Ask history | Until you delete it, or your account is deleted |
| Your account | Until you delete it, or your business's data is deleted after its plan ends |
| Database backups | Deleted data stays in database backups for up to 35 days, then it is gone |
Why records are locked. Every record is stored in write-once storage when it is captured. No one, CommLocker included, can change it or delete it before its lock ends. This is what lets your business show that a record hasn't changed.
What "deleted" means. When an Owner deletes the account or all data, each business's records are encrypted with that business's own key, and we switch the key off. Within minutes no one, CommLocker included, can open them. The locked copies are then erased when their lock ends, and the app shows that date before you confirm.
Your choices and rights
Everyone who uses CommLocker has these rights, wherever they live in the US:
- See and get a copy of your data. Use Export everything on the Data page in the app.
- Correct it. Edit your profile and your business details in the app's settings.
- Delete it. Delete your account in the app (Me, then Delete account), or request it at
commlocker.io/account/delete. An Owner deleting their account closes the business, after being offered an export. A team member deleting their account removes their personal data; the records they captured stay with the business. - Withdraw consent. You agreed to the Terms of Service and this policy separately when you signed up; your consent history is on the Legal page in the app. To withdraw, delete your account. You can turn off AI for yourself, and any notification type, at any time.
- Opt out of sale or sharing. There is nothing to opt out of: we don't sell or share personal data.
- Limit use of sensitive data. The only sensitive data we use on our own account is precise location, and only during a 911 call you make.
- No discrimination. Using these rights never changes your price or your service.
To make a request, email support@commlocker.io. We confirm we received it within 10 business days and answer within 45 calendar days. If we need longer, up to 90 days in total, we tell you why.
If you called or texted a business that uses CommLocker, that business decides what it keeps about you. We pass your request to the business, which has the tools in CommLocker to act on it.
How we protect data
- All data is encrypted in transit and at rest.
- Each business's records are encrypted with its own key.
- Sign-in tokens are kept only in your phone's secure storage. You can lock the app with Face ID, fingerprint or passcode, and hide message previews on your lock screen.
- Every person at CommLocker with access to our systems uses two-step sign-in, and each system has only the access it needs.
- Every change a person makes in your business, such as exports, deletions, role changes and the recording notice setting, is kept in your business's audit log.
- Our logs never contain message content, recordings or sign-in tokens.
Email from us
We send account emails: sign-in codes, invites, receipts, payment and trial notices, number and registration updates, and integrity and 911 alerts. Any email offering something carries an unsubscribe link, and unsubscribing takes effect at once.
Contact
Kavara Inc., 21900 Burbank Blvd #3008, Woodland Hills, CA 91367. Email support@commlocker.io.