Privacy Policy

Last Updated: June 30, 2026

1. Who We Are

Cognify Insights LLC, doing business as Skite.ai ("Skite," "we," "us," or "our"), provides an AI-powered voice receptionist and appointment-booking service. Businesses across industries such as dental, medical, beauty, and home-service trades (plumbing, HVAC, electrical, and similar) use Skite to answer incoming phone calls, converse with callers using an AI voice assistant, schedule and manage appointments, send appointment confirmations and reminders, and relay call information back to the business.

Our registered business address is 30 North Gould Street, Sheridan, WY 82801. You can reach us at support@skite.ai.

2. Scope of This Policy and Who It Covers

Skite sits between two parties, and this policy is written to be clear about both:

• Business Clients — the companies (dental practices, medical clinics, beauty and salon businesses, and home-service trades such as plumbing, HVAC, and electrical) that sign up for and configure the Skite service. For data about a Business Client's own account, billing, and staff users, Skite acts as the data controller (or "business" under CCPA/CPRA).
• Callers — the customers, patients, or members of the public who call a Business Client's phone number and are answered by Skite's AI assistant, or who receive an appointment confirmation or reminder from a Business Client through Skite. For data generated during those calls and messages, Skite acts as a data processor/service provider on behalf of the Business Client, who remains the controller of their own customers' data. Our Business Clients are responsible for their own disclosures to their callers (for example, in their own patient intake forms or website privacy notices); this policy describes how we, as their vendor, handle that data.

Throughout this policy, "you" refers to whichever of these two roles applies to you — context will make clear which.

3. Speaking With an AI Assistant

When you call a business that uses Skite, you may be interacting with an AI-generated voice rather than a live person. Consistent with emerging state and international transparency requirements (see Section 13), Skite is designed so that:

• The AI assistant identifies itself as an artificial/automated assistant at the start of the interaction (or as soon as practicable), and states which business it is calling on behalf of.
• If a caller directly asks whether they are speaking with a person or a machine, the assistant will answer honestly.
• Where the Business Client has recording enabled (the default), the greeting states that the call is recorded. The AI and recording disclosures are appended to the greeting by Skite and cannot be edited away by the Business Client.
• Callers can request transfer to a human representative where the Business Client has configured this option.

4. Information We Collect and How We Use It

This section lists, in plain terms, each kind of information Skite handles, where it comes from, and what it is used for. Section 5 summarizes the purposes; Section 7 lists the companies that process it for us; Section 10 says how long it is kept.

4.1 Account data (sign-in)

• What: your email address, first name, and a user identifier issued by Clerk, our sign-in provider. We do not store passwords — sign-in is handled by Clerk.
• Why: to create and secure your account, tie your business to it, and send account emails (receipts, usage warnings, onboarding reminders).
• Notes: your email address is stored encrypted, with a one-way fingerprint used to look it up.

4.2 Business details entered in onboarding and Settings

• What: business name, business type, time zone, business address, contact email, website, opening hours, the services callers can book and their durations (and, for services performed at the customer's location, that fact), the assistant's name and welcome sentence, and — if you set one — a transfer number the assistant can hand calls to.
• Why: to configure the receptionist for your business (what it can book, when you are open, what it says), to match a local phone number to you, and to route transfers. The transfer number is stored encrypted because it is usually a staff member's personal mobile.

4.3 Your business phone number and the Skite-provisioned number

• What: the existing business phone number you enter during onboarding, and the phone number Skite provisions for you through Twilio, inside a Twilio subaccount dedicated to your business.
• Why: your business number is used to pick a Skite number in the same area code, to verify that call forwarding is on (Skite places a test call to it), to forward calls back to you when your subscription is not active, and — only if you turn on text alerts — to text you when a caller does something you need to act on. The Skite-provisioned number is the number your calls are answered on and, once carrier verification is complete (Section 4.11), the number your confirmations and reminders are sent from.
• Notes: both numbers are stored encrypted with a one-way fingerprint for lookup. Your business number is never replaced or ported by us unless you ask.

4.4 Call audio recordings

• What: audio of calls answered by the assistant. Recording is on by default and is announced in the greeting; you can turn it off in Settings.
• Why: so you can listen back to a call from your dashboard when a summary or booking detail needs checking.
• Where and how long: audio is held by Twilio in your dedicated subaccount; Skite stores only an encrypted pointer to it. Recordings are kept for up to 12 months from the call and then deleted, both at Twilio and in Skite, by an automated nightly process — unless a Business Associate Agreement or your own instructions require a different schedule (Sections 9 and 10).

4.5 Transcripts, summaries and post-call analysis

• What: the text of what was said on the call, an AI-written summary, and a short structured analysis of the call (the caller's intent, whether they got what they called for, the outcome, and an overall sentiment).
• Why: to show you what happened on each call in your dashboard, to power notifications ("a callback was requested"), and to let you filter and count calls by outcome.
• Notes: transcripts, summaries and the full analysis are stored encrypted. Only the plain labels used for filtering (for example "book appointment", "booked") are stored unencrypted. Call metadata — caller number, times, duration, status — is stored alongside.

4.6 Caller profiles

• What: for each phone number that has called you, a profile holding the caller's number, the name they gave, notes your staff add, tags, how many times they have called, and their reminder consent — whether they said yes or no to appointment reminders, on which channels (text, call, or both), when, and on which call.
• Why: so a repeat caller is recognised and not asked the same questions twice; so consent to reminders is asked once, recorded, and honoured; and so an opt-out ("please don't contact me") is remembered across every channel.
• Notes: number, name and notes are stored encrypted. Consent is recorded only when the caller has answered the question out loud.

4.7 Bookings

• What: for each appointment booked, moved or cancelled through the receptionist: the customer's name, phone number, email address if they give one, any notes they mention, the service address for services delivered at the customer's location, the service, date, time and duration, and the call the booking came from.
• Why: to put the appointment on your calendar, to show it in your dashboard, to send the customer a confirmation and reminders (subject to their consent and to carrier verification), and to let you or the caller change or cancel it later.
• Notes: name, phone, email, notes, address and any service description are stored encrypted. Bookings are synced to the calendar described in 4.8.

4.8 Calendar access (Nylas)

• What: if you connect Google Calendar, Microsoft Outlook or Apple (iCloud) Calendar, the connection is made through Nylas, our calendar integration provider. Nylas holds the provider tokens; Skite stores only an identifier for the connection, which provider it is, and the address of the connected calendar account (encrypted). If you do not connect a calendar, bookings are kept on a Skite-hosted calendar.
• What we read and write: we read your availability (when you are free or busy) so the assistant never offers a slot you already have taken, and we create, update and cancel the calendar events for appointments booked through Skite. We do not read your email or the contents of unrelated calendar events.
• Your control: you can disconnect the calendar at any time from Settings → Integrations. Disconnecting revokes Skite's access immediately and moves your services back onto the Skite-hosted calendar.

4.9 Billing (Stripe)

• What: your plan, billing cycle, subscription status, trial and renewal dates, minutes used in the current period, invoices, and Stripe's identifiers for your customer record and subscription.
• Why: to bill you for your plan and any overage, to warn you at 80% and 100% of your minute allowance, and to decide whether the receptionist answers or forwards calls when a subscription is not active.
• Notes: payments are processed by Stripe. Skite never sees or stores your card number.

4.10 Email and text notification preferences

• What: whether you want to be alerted by email and/or text when a caller does something you need to act on (email is on by default; text is opt-in), your choices for categories of email (onboarding reminders, usage warnings, activity updates, invoices, product news), and a log of which transactional emails were sent to you and when. The log records the type of email, not its contents or your address.
• Why: to reach you the way you asked, and to avoid sending the same reminder twice. Genuinely transactional emails (a failed payment, an overage notice) are sent regardless of preference.

4.11 Carrier verification data for texting (A2P 10DLC)

• What: U.S. mobile carriers require every business that sends text messages to be registered under its own identity before any text can be delivered. To register your business we collect: your legal business name, business type (LLC, corporation, partnership, non-profit, or sole proprietorship), tax ID / EIN (or, for a sole proprietor without one, a mobile number for a one-time code), business address, website (or a business listing), and an authorized contact's name, title, email and phone number.
• Why: solely to register your business with Twilio and The Campaign Registry (the industry body that operates 10DLC registration on behalf of the carriers), so that confirmations and reminders can be sent from your number, and to keep that registration current. It is not used for anything else — not for marketing, not for analytics, not shared with anyone but Twilio and the registry.
• Notes: this information is stored encrypted. Until registration clears — typically 1-5 business days — no text can be sent from your number; the receptionist answers calls and books appointments regardless. The registration fees charged by the carriers are paid by Skite.

4.12 Automatically collected and technical data

• Website and dashboard analytics: we use PostHog for product analytics (pages viewed, features used, browser and device type) on our website and dashboard, served from our own domain. It is used to understand how the product is used and to fix problems, not for advertising.
• System and error logs generated by our infrastructure, which may incidentally include identifiers like a phone number or account ID.
• Bot protection on public demo endpoints, which checks that a request comes from a browser rather than a script.

4.13 Sensitive / special category data

Because Skite serves dental and medical practices, calls to those Business Clients may include health information from callers (symptoms, appointment reasons, provider names). We treat this as sensitive data and apply the additional protections described in Section 9 (HIPAA) regardless of which state or country the call originates from.

We do not knowingly collect Social Security numbers, government ID numbers, or payment card numbers through call audio; if a caller volunteers this information verbally, we minimize its retention and access as described in Section 10. The one government identifier we do collect deliberately is a Business Client's EIN, for the sole purpose in Section 4.11.

5. How We Use Information

• To operate the core service: answering calls, understanding caller intent, booking or modifying appointments, generating call summaries, and delivering that information to the Business Client's dashboard.
• To generate the AI voice response: caller speech is processed by our conversational AI systems (Section 6) to determine what to say back, and the response text is converted to speech.
• To notify Business Clients: e.g., a new appointment was booked, a call requires follow-up, or a call could not be completed — by email, in the dashboard, and by text where the Business Client has opted in.
• To send appointment confirmations and reminders: where a Business Client's plan includes them, we may send automated SMS text messages and/or place automated AI-voice calls to the caller ahead of a scheduled appointment. The assistant asks the caller out loud whether they want reminders and by which channel, records the answer (Section 4.6), and nothing is sent to a caller who declined. Because these are outbound, AI-generated communications, they are subject to TCPA consent requirements independent of the caller's existing relationship with the Business Client (see Section 13) — Business Clients remain responsible for the consent obtained on their behalf and for honouring opt-outs.
• To register Business Clients for texting: the carrier verification data in Section 4.11 is submitted to Twilio and The Campaign Registry and used for no other purpose.
• For billing: to charge Business Clients per their selected plan and usage.
• To maintain and improve the service: debugging, reliability monitoring, and — only in aggregated or de-identified form wherever possible — improving how our AI assistant handles calls.
• For security and fraud prevention: detecting abuse of the platform, unauthorized access, or fraudulent account activity.
• For legal compliance: responding to lawful requests, regulatory obligations, and enforcing our agreements.

We do not sell personal information, and we do not use caller data for advertising or to build profiles for any purpose outside operating the service for the relevant Business Client.

6. AI Systems That Process Conversations

Skite's assistant uses a pluggable AI architecture. Depending on configuration, call audio and transcripts may be processed by one or more of the following in order to run the conversation, generate a spoken response, and produce the summary and analysis described in Section 4.5:

• OpenAI — processes conversational audio/text to understand caller intent and generate a response.
• Google (Gemini) — may process conversational audio/text as an alternative conversational AI provider.
• Anthropic (Claude) — may process conversational audio/text as an alternative conversational AI provider.
• Self-hosted models — for some configurations, conversation processing occurs on infrastructure we operate directly rather than being sent to a third-party AI vendor; in that case, the data does not leave our own systems and is protected under the security measures in Section 11 rather than a third-party subprocessor agreement.
• ElevenLabs — converts text responses into synthesized speech (text-to-speech).

Skite may switch between providers during a call if one is unavailable. These providers process data solely to return a result to Skite and, in turn, to the Business Client — not to train their own general-purpose models on our data, consistent with their enterprise/API data-use terms. We maintain data processing agreements with these providers, and, for Business Clients in regulated healthcare verticals, Business Associate Agreements (BAAs) covering any Protected Health Information that passes through these systems (Section 9).

7. How We Share Information (Subprocessors)

We do not sell personal data or share it with third parties for their own marketing. We share data only with the service providers below, each of whom is contractually limited to using data solely to provide their service to us.

SMS opt-in data. We do not sell or share your SMS opt-in data. Mobile phone numbers and the consent you give to receive text messages — whether you are a Business Client opting in to text alerts or a caller opting in to appointment reminders — are used only to send the messages you agreed to. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text-messaging originator opt-in data and consent are excluded from every category of sharing described in this Policy, other than with the messaging providers needed to deliver the messages themselves.

For configurations using our self-hosted conversational AI model rather than a third-party LLM provider, conversation data stays on infrastructure we operate directly and is subject to the same security measures described in Section 11 rather than a third-party subprocessor agreement.

We may also disclose information:

• To the Business Client — call summaries, transcripts, recordings, caller profiles and appointment data are, by design, delivered to the relevant Business Client's dashboard.
• For legal reasons — in response to a valid subpoena, court order, or other lawful request, or to protect against fraud, security threats, or harm; we will notify the affected Business Client of such a request unless legally prohibited from doing so.
• In a business transfer — if Skite is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this policy or a policy providing at least equivalent protections.

8. Call Recording and Consent

Call recording laws vary by state. Roughly a dozen U.S. states require all-party consent to record a phone call, while the rest require only one-party consent. Where a call crosses state lines, the stricter law generally governs. Skite's greeting announces that the call is recorded whenever recording is enabled, and that announcement cannot be removed by the Business Client; a Business Client may instead turn recording off in Settings. Business Clients remain responsible for compliance with the recording laws of the jurisdictions they operate in.

Separately, and regardless of recording, several states now require disclosure that a caller is interacting with an AI system (Section 13). Our assistant makes this disclosure in its greeting.

9. HIPAA and Protected Health Information (PHI)

Because Skite serves dental and medical practices, some Business Client accounts are flagged internally as handling PHI. For those accounts:

• We act as a Business Associate under HIPAA with respect to PHI processed on behalf of the Business Client (who is the HIPAA Covered Entity).
• Where a subprocessor may handle PHI for a Business Client subject to HIPAA, we execute a Business Associate Agreement with that subprocessor before enabling it for that account. Where a configuration uses our own self-hosted conversational AI, no third-party agreement applies, because the data does not leave infrastructure we operate — that data is covered by the safeguards in Section 11 instead.
• We apply the HIPAA Security Rule's required and addressable safeguards to PHI in our systems, including access controls, audit logging, and encryption in transit and at rest.
• We limit use and disclosure of PHI to the minimum necessary to provide the service.
• In the event of a breach involving unsecured PHI, we will notify the affected Business Client without unreasonable delay, consistent with HIPAA's breach notification requirements, so that the Business Client can meet their own notification obligations to patients and, where required, regulators.
• PHI retention follows the terms of the applicable BAA and the Business Client's own record-retention obligations under state law (which commonly range from several years to longer for medical records); we do not independently shorten or extend that schedule without the Business Client's instruction.
• Business Clients that are not in regulated healthcare verticals (e.g., a plumbing or HVAC business) are not treated as HIPAA Covered Entities, and no PHI-level handling is applied to their data, since none is expected.

Skite does not claim to be "HIPAA certified" — no government body certifies software as HIPAA compliant. Skite supports a HIPAA-compliant configuration through the measures above and the agreements it signs; the Business Client's own configuration and handling of patient data complete the picture.

10. Data Retention

• Business Client account data (Sections 4.1-4.3, 4.9, 4.10): retained for as long as the account is active. Upon account closure, we delete or anonymize this data within 90 days, except where longer retention is required for legal, tax, or dispute-resolution purposes.
• Call recordings (Section 4.4): retained for up to 12 months from the call, then deleted at Twilio and in Skite by an automated nightly process, unless PHI retention rules (Section 9) or a Business Client's own instructions require a different schedule. A Business Client can turn recording off at any time.
• Transcripts, summaries and call analysis (Section 4.5): retained by default for up to 12 months from the call to allow the Business Client to review its call history, after which they are deleted or archived, unless PHI retention rules (Section 9) or a Business Client's own instructions require a different schedule.
• Caller profiles and bookings (Sections 4.6-4.7): these are the Business Client's own customer and appointment history and are retained while the account is active. They are deleted with the account on the 90-day schedule above, or earlier on the Business Client's request, subject to PHI retention rules.
• Calendar connection (Section 4.8): retained until the Business Client disconnects the calendar or closes the account, at which point Skite's access is revoked.
• Carrier verification data (Section 4.11): retained for as long as the texting registration it supports is active, because carriers may require it to be re-verified or corrected; deleted with the account. The registration itself is cancelled when the account closes.
• Billing records: retained as required by tax and accounting law (typically several years).
• Logs and backups: rotated and purged on a regular schedule; encrypted backups are retained only for disaster-recovery purposes for a limited time.

Deletion requests from a Business Client or, where applicable, a caller exercising their own privacy rights, will be honored as described in Section 14, except to the extent we are legally required to retain certain records.

11. Data Security

• Encryption: all data in transit between Skite, Business Clients, and our subprocessors uses TLS/HTTPS. Sensitive fields at rest — phone numbers, names, email addresses, addresses, transcripts, summaries, recording pointers, calendar account addresses, and carrier verification data including the EIN — are encrypted. Fields that need to be looked up (such as a phone number) additionally carry a keyed one-way fingerprint so they can be matched without being decrypted.
• Access controls: access to production systems, call recordings, and databases is restricted to personnel who need it, authenticated, and logged.
• Infrastructure isolation: each Business Client's telephony and messaging is provisioned through a dedicated Twilio subaccount, limiting cross-account data exposure.
• Vendor vetting: subprocessors are evaluated for security practices and, where relevant, compliance certifications (e.g., SOC 2).
• Monitoring: we monitor for suspicious activity and maintain an incident-response process to contain, investigate, and notify affected parties of any security incident as required by law.

No method of transmission or storage is 100% secure, but we follow industry-standard practices to protect data across the service.

12. International Data Transfers

Skite's infrastructure and subprocessors are primarily based in the United States. If a Business Client, caller, or their data originates outside the U.S. (including the EEA, UK, or elsewhere), data may be transferred to and processed in the U.S. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent legally recognized transfer mechanisms with our subprocessors to protect data transferred internationally.

13. AI-Specific Disclosure Laws

Regulation of AI voice systems is evolving quickly. As of this policy's last update:

• Federal (FCC/TCPA): The FCC has clarified that calls using AI-generated voices are treated as "artificial voice" calls under the TCPA for outbound calling, but has stated that TCPA consent requirements do not extend to technologies used to answer inbound calls — which is Skite's core function. Our outbound appointment-reminder feature, which uses both SMS text and AI-generated voice calls, remains subject to TCPA consent rules independent of any prior business relationship with the caller; the assistant asks for and records that consent on the call, Business Clients are responsible for the consent obtained on their behalf and for honouring opt-outs, and AI-generated text messages must disclose their AI-generated nature.
• Federal (carrier registration): U.S. mobile carriers, through The Campaign Registry, require every business sending application-to-person text messages from a standard 10-digit number to be registered under its own identity (A2P 10DLC). Section 4.11 describes what we collect for this and why.
• California: AB 2905 requires disclosure when a caller is interacting with an AI agent, and AB 489 specifically prohibits AI systems from falsely claiming healthcare credentials and requires disclosure when AI communicates with patients — directly relevant to our dental/medical Business Clients. SB 1001 requires bot disclosure in calls intended to incentivize a commercial transaction.
• Maine: 10 M.R.S. §1500-DD (effective September 2025) requires disclosure when a caller is interacting with a voice-based automated system.
• Texas: TRAIGA (HB 149), effective January 1, 2026, imposes AI-interaction disclosure requirements on certain regulated industries.
• EU AI Act, Article 50 (effective August 2, 2026): providers of voice assistants and chatbots that interact directly with people in the EU must ensure users are informed they are dealing with AI, no later than the first interaction, in a way that's perceivable within the interaction itself (not just buried in a privacy policy).
• Colorado: the original Colorado AI Act's risk-based framework has been substantially narrowed and its effective date delayed to January 1, 2027; it now focuses on disclosures around automated decision-making rather than a broad risk-management regime, and its scope (employment, housing, healthcare, etc.) should be monitored for relevance as it's finalized.

This area changes often; we review our disclosure practices periodically against new state and international requirements as they take effect.

14. Your Privacy Rights

14.1 If you are a Business Client

You can, at any time and from your own account:

• View and correct your business details, hours, services, assistant settings and notification preferences in Settings.
• Turn call recording off, set or remove a transfer number, and choose whether you are alerted by email, text, or both.
• Connect or disconnect your calendar (Settings → Integrations); disconnecting revokes Skite's access immediately.
• Cancel your subscription (Settings → Billing), after which your data is deleted on the schedule in Section 10.

You can also email support@skite.ai to request a copy of the personal data we hold about your account, correction of anything inaccurate, or deletion of your account and its data, subject to the retention exceptions in Section 10.

14.2 If you are a Caller

• Reminders and texts: you are asked on the call whether you want appointment reminders, and by which channel; you can say no. You can stop text messages at any time by replying STOP to any message, and you can tell the assistant on any call not to contact you again. Either is recorded as an opt-out across every channel for that business.
• Your data: you can ask to access, correct or delete the information a business holds about you through Skite. Because we process caller data on behalf of the Business Client, we will typically direct your request to that business (which controls the data) or notify it of your request, and we will act on the business's instruction, consistent with our obligations as its service provider.

14.3 U.S. State Privacy Laws (CCPA/CPRA and similar)

Residents of California, and increasingly other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others), generally have the right to:

• Know what personal information we collect and how it's used
• Access a copy of that information
• Correct inaccurate information
• Delete personal information (subject to legal exceptions)
• Opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising, and we do not sell or share SMS opt-in data — see Section 7)
• Limit use of sensitive personal information
• Not be discriminated against for exercising these rights

14.4 GDPR / UK GDPR (where applicable)

If you are located in the EEA or UK, you have the right to access, rectify, erase, or restrict processing of your personal data; to data portability; to object to certain processing; and to lodge a complaint with your local supervisory authority. Our legal bases for processing include performance of a contract with the Business Client, our legitimate interests in operating and securing the service, and — for certain health-related data — explicit consent or another applicable Article 9 condition.

14.5 How to Exercise These Rights

Contact us at support@skite.ai. We may need to verify your identity before fulfilling a request.

15. Children's Privacy

Skite's service is directed at businesses and their adult customers, not children. We do not knowingly collect personal information from children under 13 (or the relevant age of digital consent in your jurisdiction) through our dashboard. Call interactions are answered without age verification, as is standard for business phone lines; if we become aware that a caller is a child and personal information has been retained inappropriately, we will take steps to delete it upon request from a parent, guardian, or the Business Client.

16. Cookies and Website Data

Our website and dashboard use cookies or similar technologies for authentication, basic product analytics (Section 4.12), and remembering preferences. We do not use cookies for cross-site advertising tracking.

17. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, our technology, or legal requirements. We will update the "Last Updated" date above, and for material changes, we will provide more prominent notice (such as an email to Business Clients).

18. Contact Us

Questions about this policy or how Skite handles your data can be directed to support@skite.ai, or by post to Cognify Insights LLC, 30 North Gould Street, Sheridan, WY 82801.