Privacy policy

Two different relationships, worth keeping apart

When a business hires Sonora AI, that business decides what its callers' data is used for: it is the controller. We process it on their behalf and on their instructions, as a processor.

When you use this site or the portal — as a client or as a partner — we are the controller, CODEFORGE LLC.

What is processed during a call

The call audio and its transcript. A summary of what was asked and whether it was resolved. The number the person called from and, if given, their name. The details of any appointment, order or message left.

Card details are never taken by voice. When there is a payment, a link from the payment provider is sent and the card is entered there, never in our systems.

Recording and notice

The assistant announces at the start of the call that the conversation is being recorded. Anyone who does not wish to continue can hang up, and can ask for what was recorded to be deleted.

How long it is kept

Recordings, transcripts, summaries and free text tied to a contact are kept for 90 days and then removed from the records. Minimal billing data and usage records are kept as long as accounting and tax rules require.

Who it is shared with

Only the providers needed to run the service: Vapi (call processing, which in turn uses language-model and speech vendors), Twilio (telephony and messaging), Stripe and Mercado Pago (payments), Render (hosting and database), and — when the client connects a calendar or CRM — whichever provider they chose: Cal.com, Google Calendar, Calendly or GoHighLevel.

We do not sell personal data and do not share it for advertising.

Google Workspace data (when Google Calendar is connected)

If the client connects their Google Calendar, the app accesses that calendar only, under two permissions: reading availability, and creating or changing the appointments the assistant books. It does not access mail, contacts, files or any other data in the account.

Use of that information is limited to operating the scheduling feature the client can see: checking free times, creating an appointment, and rescheduling or cancelling one at a caller's request. It is not used for advertising, is not sold, is not shared with third parties for marketing, and is not used to train artificial-intelligence models, ours or anyone else's. No human reads it, except where strictly necessary to resolve a technical problem the client has reported, to comply with a legal obligation, or to investigate a security incident.

Access tokens are stored encrypted, and the client can disconnect the integration at any time, which deletes them.

Site measurement

We count how often each page is viewed and how far down people get, so we can tell whether the site makes sense. The measurement is our own: there is no third-party provider, the data stays in our database, and it is not shared.

Nothing is stored on your device — no cookies, no local storage — and no identifier is recorded: not your IP, not your browser, not a session number. We keep only which event happened, on which page, in which language, and whether the screen was phone- or desktop-sized.

That is why there is no consent banner: there is nothing to consent to. These measurements are about pages, not people, and an individual visit cannot be reconstructed from them.

Your rights

You can request access, correction or erasure at contact@codeforgeworks.com. We can export and erase everything tied to a phone number.

In Argentina the Agencia de Acceso a la Información Pública supervises personal data (Ley 25.326) and you may address it directly.