1. Who we are and who this is for
Valistix Inc. ("Valistix", "we") provides websites, local SEO, ads management, an AI receptionist, follow-up, and automations to businesses in Canada and the United States. This policy explains what personal information we collect, why, who we share it with, and the choices you have.
It covers four groups of people:
- Visitors to valistix.com.
- Prospects and clients: people who book a call with us, sign up, or run a business we serve.
- Callers and customers of our clients: people who phone or text a business that uses our receptionist or follow-up. For them we act as the business's service provider, and section 8 is written for them.
- Anyone who emails us.
We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the substantially similar provincial laws where they apply (such as the Alberta and British Columbia PIPAs), and, where they apply, US state privacy laws.
2. What we collect
From website visitors
Our website has no accounts and no advertising trackers. Our hosting provider, Cloudflare, records standard server logs (IP address, browser type, pages requested, time) for security and to keep the site running, and provides page-view analytics that set no cookies and do not identify you; these are kept for a short period. Our typefaces are served from our own site. Calendly's booking script loads only when you use a booking link, and Calendly then sees your IP address and browser details and collects what you type into the booking widget, under its own privacy policy. The audit, contact and browser-call forms are protected by Cloudflare Turnstile, which runs a bot check in your browser and may store a short-lived token for that purpose. If you use the contact form, we receive what you type and use it only to reply to you.
From prospects and clients
- Contact and business details: your name, role, business name, email, phone, business address, and the answers you give when you book a call or request a free audit.
- Business contact details of prospective clients (name, role, business phone, business email) that we collect from public sources such as your own website, your Google Business Profile, and business directories. We use these only to contact you about our services, we record where we found each address, and we stop on request.
- What we need to build your services: hours, services and prices, scripts, calendar access, staff names and numbers for transfers, logins you choose to share for ad accounts and listings.
- Billing details: handled by Stripe. We see the last four digits of a card and the billing name and address; we never see or store full card numbers.
- Communications with us: emails, call notes, support requests.
- Service data: call logs, recordings, transcripts, texts sent, appointments booked, campaign results, website analytics we set up for you.
From callers and customers of our clients
- Phone number and, when given on the call, name, address, email, and the reason for calling.
- A recording and a transcript of the call, and any texts exchanged with the business's system.
- Appointment details.
We collect this on the business's instructions to answer and route its calls, book its appointments, and follow up. The business decides how long to keep it.
3. How we use it
- To deliver the services you bought: answering calls, booking, texting, building and hosting sites, running campaigns, and reporting.
- To produce the free audits you request and to email you the report.
- To bill you and to keep tax and accounting records.
- To support you, answer your questions, and fix problems.
- To improve your own receptionist and campaigns, using your own data inside your own account.
- To keep our systems secure and to detect abuse.
- To meet legal obligations and to enforce our agreements.
- To tell prospects about our services, only where the law allows: in Canada, with your express consent, an existing business relationship, or a business address you published without a no-solicitation notice (Canada's anti-spam law), and in the US under CAN-SPAM; always with a way to unsubscribe, which we act on within 10 business days.
What we do not do. We do not sell personal information. We do not share it with advertisers. We do not use client data or callers' data to train AI models. We do not build profiles of callers across different businesses. Mobile phone numbers and text-message opt-in information are never shared with or sold to third parties or affiliates for marketing or promotional purposes.
4. Who we share it with
We share personal information only with the providers that run parts of our service, each under a contract that limits what they may do with it:
| Provider | What it does | What it handles |
|---|---|---|
| Retell AI (with the speech and language model providers on its sub-processor list, such as OpenAI, Anthropic, and ElevenLabs) | Runs the AI receptionist | Call audio, recordings, transcripts, caller phone numbers, the business's script |
| Twilio (through Retell and HighLevel) | Telephone lines and text messaging | Phone numbers, call and message routing data |
| PandaDoc | Electronic signature of Order Forms | Names, emails, signatures, IP address, signing time |
| HighLevel (GoHighLevel) | CRM, texting, calendars, follow-up automations | Contact details, appointments, messages, notes |
| Stripe | Payments | Billing name, address, payment details |
| Calendly | Booking calls with us | Name, email, phone, booking answers |
| Google Workspace | Our email and documents | Anything you email us |
| Cloudflare | Website hosting and security | Server logs |
| Cloudflare Turnstile | Bot check on our forms and the browser call | IP address and browser signals, inside Cloudflare |
| Resend | Sends our transactional email (contact-form notices, audit reports) | Your email address and the message content |
| Anthropic (Claude API) | Reads the audited pages for the free audit's checks, including the wording checks, and writes the plain-language parts of the report | Text, links and forms of the audited business's pages; audit findings; never your name, email or phone number |
| Google (PageSpeed Insights and Places APIs) | Speed measurement and business lookup for the free audit | The website address and business name you enter |
| DataForSEO | Google listing details, map and search results for the free audit | The business's place identifier, category and city |
| Google, Microsoft and Meta | Advertising platforms, in accounts you own or, where your Order Form says so, in Valistix's ad account | Campaign data and, for form ads, the details people submit, which reach you in full |
We also send callers' details to the systems a client connects, such as its calendar or CRM, on that client's instructions.
We may also disclose information if the law requires it, to protect someone's safety, or to a buyer of our business, who would have to honour this policy. We tell clients before changing a provider that handles their callers' data.
5. Where it is stored
Our providers store data in Canada and in the United States, and some process it in other countries where they operate. That means your information, and your callers' information, may be stored or accessed outside Canada, where local authorities may have the right to access it under local law. We choose providers with strong security and contractual commitments, but we cannot change the laws of the country where data sits.
6. How long we keep it
- Visitor server logs: up to 30 days.
- Free audit results: 90 days. Audit request logs: up to 30 days, with IP addresses hashed.
- Prospect details: until you ask us to delete them, or two years after our last contact.
- Client account and contact details: for the length of our relationship and 30 days after, then deleted, except records we must keep.
- Call recordings and transcripts: 90 days by default, or the period the client sets, up to 12 months. Deleted 30 days after the client leaves unless the client has asked for an export, in which case deletion waits until the export is delivered.
- Billing and tax records: seven years, as Canadian tax law requires.
7. How we protect it
Data is encrypted in transit and at rest by our providers. Access to client and caller data is limited to the people who need it to deliver the service, and every account we use is protected by two-factor authentication or by single sign-on to an account that is. Recordings and transcripts are available only inside authenticated accounts. No method of storage or transmission is perfectly secure. If we learn of a breach of security safeguards that creates a real risk of significant harm, we report it to the Privacy Commissioner of Canada and notify the affected people and clients as soon as feasible, and we keep a record of every breach, reportable or not, for at least 24 months.
8. If you called or texted one of our clients
When you phone a business that uses Valistix, a virtual assistant may answer. It tells you it is a virtual assistant, and the greeting tells you the call is recorded. The recording and transcript belong to the business you called, and we hold them on its behalf.
Calls to our own demo line, including calls started from the "Talk to Riley" button on our website, are recorded and transcribed so we can review how the demo went and follow up if you asked us to. They are not used to train AI models. We keep them for 90 days and delete them sooner on request to hello@valistix.com. If you book a call with us during a demo, the name, email, business name, and mobile number you give are sent to our scheduling provider (Calendly) to create the booking and the calendar invite.
- To ask what a business holds about you, to correct it, or to have it deleted, contact the business first. Its details are on its website and on the confirmation texts you received.
- If you cannot reach the business or would rather ask us, email hello@valistix.com with the business name and the number you called from. We will confirm what we hold and pass your request to the business, or act on it directly where the law lets us.
- To stop receiving texts from a business's system, reply STOP to any message. Reply HELP for help.
9. Free online-presence audit
If you request a free audit on valistix.com, we collect the business name or website you enter, the city and category you confirm, your email, your first name and, if you give it, your mobile number. We use these to produce the audit and to email you the report, and one of our specialists may call that number or email you about your results. We do not send text messages to the number you give in this form. Marketing emails need the separate box: only if you tick it do we send you a short series of emails, until you unsubscribe.
To produce the audit we read public information only: after checking the site's robots.txt file, we fetch the home page of the website once (and one contact page if the home page links to one) and make one request to its http:// address to see whether it redirects to https, we request speed results from Google's PageSpeed Insights API, we look up the business through Google's Places API to confirm which business you mean, and we collect Google listing details and search results through DataForSEO. We send the text, links and forms of the pages we fetched, and the results of the checks (never your name, email or phone number), to Anthropic's Claude API, which reads the pages for some checks and writes the plain-language parts of the report. We do not call or contact the business to produce the audit.
We keep the audit result for 90 days so your report link keeps working, and for 7 days a repeat request for the same business returns the same report. We keep the Google place identifier for the business; we do not store anything else from Google Places. We keep your contact details and scores as prospect details (section 6). Anyone can request an audit of a public website; the report describes public information and does not imply that the requester owns the business. Site owners can keep our fetcher off their site; see valistix.com/audit-bot.
The report email has a "Delete my report" link, which removes your email address, your name, your phone number and the record of your request from our audit records; the copy of your request in our inbox is deleted within 30 days. If you unsubscribe, or an email to you bounces or is reported as spam, we keep a coded form of your address that cannot be turned back into the address (a keyed hash), only so that we do not email it again. That record stays after you delete your report.
10. Your rights and choices
You can ask us, at any time and at no cost to you, to tell you what personal information we hold about you, to correct it, to delete it, or to stop using it for a purpose you no longer agree to. Email hello@valistix.com. We may need to confirm who you are. We respond within 30 days, and we tell you if the law lets us keep something you asked us to delete (for example, billing records).
Canada. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
United States. Where a state privacy law gives you rights, we honour them. For information we hold as a service provider to a business, we pass your request to that business. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information beyond what the service requires.
Marketing email. Every marketing email from us has an unsubscribe link, and we act on it within 10 business days.
11. Cookies
valistix.com sets no advertising or analytics cookies. We use Cloudflare Web Analytics, which counts page views without cookies and without identifying you. The only cookies that may be set are those strictly necessary for the site to function, those set by Calendly when you open the booking widget, and a short-lived token Cloudflare Turnstile may store when it checks that a form is being used by a person. If we ever add advertising or tracking tools, we will update this policy and, where the law requires, ask for your consent first.
12. Children
Our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18, other than incidentally when a minor calls one of our clients, in which case section 8 applies.
13. Changes to this policy
We update this policy when our practices change. The effective date at the top tells you when. For material changes we email our clients at least 30 days before the change takes effect.
14. Contact
The person accountable for this policy is our Privacy Officer, Valistix Inc., reachable at hello@valistix.com (write "Privacy" in the subject line) or by post at the mailing address on any invoice or Order Form. Tell us first if you think we have handled your information badly; if you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.