This policy explains what information Recoverly ("we," "us") collects, how we use it, and who we share it with. It applies both to the HVAC businesses who subscribe to Recoverly ("Customers") and to the individuals who call or text a Customer's phone number and are contacted by our system on the Customer's behalf ("Callers").
1. Information we collect
From Customers (subscribing businesses): business name, contact name, email address, phone number, billing information (processed by Stripe — we do not store full card numbers ourselves), business hours, service area, and calendar access granted via Google OAuth.
From Callers (a Customer's own customers): phone number, any name or address provided during a text conversation, the content of SMS conversations with our AI system, call metadata (time, duration, whether answered), and, if voice recording is enabled by a Customer, call recordings and transcripts.
From website visitors: information submitted through our contact form (name, email, phone, message), and standard technical data collected by our hosting provider (IP address, browser type, pages visited) for security and analytics purposes. Our public marketing pages use Google Analytics, which uses cookies to measure traffic in aggregate. It is not used on your dashboard or in the calendar connection flow, and you can block it with your browser settings or a tracking-protection extension.
2. How we use this information
- To operate the missed-call recovery service: sending automated text messages, running AI-qualification conversations, scoring urgency, and booking appointments on a Customer's calendar.
- To generate the reporting dashboard shown to Customers (recovered calls, estimated pipeline, appointment status).
- To bill Customers for their subscription and metered usage.
- To respond to contact form submissions and provide customer support.
- To maintain the security and reliability of the service.
We do not sell Caller or Customer personal information to third parties, and we do not use Caller conversation data to train our own AI models.
3. Who we share information with
We use the following service providers to operate Recoverly, and each processes data under their own privacy and security terms:
- Twilio — sends and receives the SMS messages and phone calls that make the service work.
- Anthropic — processes conversation text via the Claude API to run the AI qualification conversation. Message content is sent to Anthropic's API for this purpose.
- Google — used to check calendar availability and book appointments, via a Customer's own connected Google Calendar.
- Stripe — processes Customer subscription payments.
- Our hosting and database providers, who store the underlying data securely.
We may also disclose information if required by law, or to protect the rights, safety, or property of Recoverly, our Customers, or others.
4. SMS & calling consent
When a Caller's call to a Customer's business line goes unanswered, our system sends an automated text message on the Customer's behalf in direct response to that missed call. By using Recoverly, Customers represent that they have the necessary rights and consent to communicate with their own callers in this way, consistent with applicable law (including the U.S. Telephone Consumer Protection Act, "TCPA").
Message frequency varies depending on the conversation (typically a handful of messages per interaction: an initial response, qualifying questions, and an appointment confirmation). Message and data rates may apply, based on your mobile carrier plan. We do not sell or share your mobile phone number with third parties for their own marketing purposes.
Under current FCC rules, a Caller may revoke consent to receive further automated messages in any reasonable manner that clearly communicates that intent — not only by replying STOP. Our system recognizes STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT, as well as common plain-language requests to stop being contacted, and honors them by ending automated messages to that number. Reply HELP for assistance, or START to resume messages after opting out. A revocation request that our automated detection doesn't clearly recognize may still require manual review — Customers remain responsible for honoring any clear opt-out request within the timeframe required by law.
5. Data & consent retention
We retain Customer and Caller data for as long as a Customer's account is active, and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. This includes timestamped records of messages sent and received, and of opt-out/opt-in events, which help Customers maintain consent records consistent with applicable regulatory expectations (for example, FTC Telemarketing Sales Rule guidance suggesting five years of retention for consent records) — though this is not a guarantee of compliance with any specific requirement applicable to a Customer's business, which Customers should confirm with their own counsel. Customers may request deletion of their account data by contacting us; Caller data tied to an active Customer account is deleted or anonymized on the same schedule unless a Caller has separately exercised deletion rights (see Section 7).
6. Security
We use industry-standard measures — encrypted connections (HTTPS/TLS), access controls, and secure hosting — to protect the information we hold. No system is completely secure, and we cannot guarantee absolute security.
7. Your rights
Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing (for example, under the California Consumer Privacy Act or similar state laws). To exercise these rights, contact us using the details below.
8. Children's privacy
Recoverly is a business tool and is not directed at children. We do not knowingly collect personal information from children under 13.
9. Changes to this policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do, and post material changes on this page.
10. Google user data (Google Calendar)
A subscribing business (or one of its technicians) can connect a Google Calendar to Recoverly so appointments can be booked automatically. When you connect a calendar, we ask Google for two permissions: the ability to see when the calendar is free or busy (calendar.events.freebusy) and the ability to create events on calendars you own (calendar.events.owned). Google describes the second permission as “See, create, change, and delete events on Google calendars you own.” We request it only so we can create appointment events, and Recoverly's software does not read, edit, or delete your existing events. Here is exactly how we use these permissions.
- Checking availability. We check when the connected calendar is free or busy during your business hours, so we only offer callers times that are actually open. We do not read, copy, or store the titles, descriptions, or attendees of your existing events.
- Booking appointments. When a caller picks an open time, we create one event on the connected calendar. The event includes the caller's phone number, service address, the type of issue, and the urgency, so your team has what they need.
- What we store. We store a Google authorization token so we can keep checking availability and booking without asking you to sign in again, along with the ID and time of each event we create.
- Who receives it. The open appointment times we offer (for example, "Tue, Sep 29, 12:00 PM") are included in the text sent to our AI provider, so the assistant can offer those times to the caller. We do not send your existing events, their details, or your calendar's busy times to the AI provider.
We do not sell Google user data, use it for advertising, or transfer it to data brokers. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. Our personnel do not read Google user data unless you give consent, it is needed to investigate abuse or a security issue, it is required by law, or the data is aggregated and anonymized for internal operations.
You can disconnect Recoverly at any time at myaccount.google.com/permissions. You can also ask us to disconnect your calendar and delete the stored authorization token by emailing support@recoverlo.com.
Recoverly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
11. Contact us
Questions about this policy or your data can be sent to support@recoverlo.com or through our contact page.