Five at a Time (getfiveatatime.com and the app behind it) is run by 2587689 Alberta Ltd., a corporation incorporated in Alberta, Canada, operating as Five at a Time (“we”, “us”). This policy covers what we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it. It applies to the businesses and people who use Five at a Time and to the people they call.
1. Your role and ours
Five at a Time is calling software for businesses. For the leads you upload and the calls your team places, your business is the controller and we are a processor (a “service provider” under some laws): we handle that data on your instructions, to run the Service for you. You are responsible for having a lawful basis to collect and call those contacts, and for any notice or consent you owe them.
For your own account, your business verification and your billing, we are the controller.
2. What we collect
- Account details: your name, email address and password, or your name and email address from Google if you sign in with Google, and your team and role.
- Business verification: before anyone on a team can call, the business's owner or a team admin gives us its legal name and trading name, business type, tax ID (EIN or Business Number), website, address, trade and a rough number of dials a day per rep, plus a contact person's name, title, work email and phone number, and their agreement to the calling rules. We encrypt the tax ID and keep only its last 4 digits readable. We also keep the results of the checks in section 4.
- Card details: the card is saved through Stripe, which holds the card number. It never reaches our servers. We keep the card's brand, last 4 digits, issuing country, whether it is prepaid, and the bank's results for the security code and postcode checks.
- Leads: the lists you import or add (names, companies, phone numbers, email addresses and anything else in your columns), and the statuses, notes and Do Not Call marks your team adds.
- Call records: the number dialed, the caller ID used, which rep placed the call, when it started, was answered and ended, how long it lasted, whether a person or a machine answered, the outcome, what the call cost us, and the carrier's codes when a call fails.
- Recordings, transcripts and AI notes: see section 3.
- Voicemail messages your reps record for voicemail drop.
- Technical data: browser and device details, IP addresses, and logs kept by us and by our hosting and calling providers, including the browser connection a rep talks through.
- What you send us: emails and anything attached to them.
3. Call recordings and AI notes
- Calls are recorded by default, both sides. Telnyx makes the recording, and we copy it to a private storage bucket at our database provider, Supabase, as soon as it is saved. We play and analyse recordings only from our copy.
- Recordings of calls longer than 10 seconds are transcribed and analysed to produce a summary, a call outcome, next steps, a script score and coaching notes. These stay in your business's workspace, where the rep who placed the call can see them.
- The business's owner can ask us to switch recording off for the business, or to keep recording and switch the AI analysis off, by emailing abhi@paperkites.co. Once recording is off for a business, a rep on its team can't switch it back on.
- We do not listen to, review, sell or use your call audio or transcripts for our own purposes unless you ask us to or the law requires it, and we do not use them to train AI models. Transcription and analysis run only to provide features in your workspace.
- Your responsibility: you must follow the call-recording consent laws where you call, such as US states that require everyone on the call to agree and s. 184 of Canada's Criminal Code. If you don't have the consent you need, ask us to switch recording off before you call.
4. How we verify businesses
We check every business before its first call. The checks run automatically when the form is sent:
- Telnyx sends a code to the contact phone, by text or by voice call, and looks up what kind of line it is and which carrier it is with.
- We look up the website's domain in the public domain registry (RDAP) to see how old it is, load the website to see whether it names the business, and check that the work email's domain matches the website and receives mail.
- Stripe saves the card without charging it, and the bank checks the security code and postcode. We check that the card isn't prepaid and that its country matches the business's.
- When we switch it on, Middesk checks a US business against state registrations and its EIN against the legal name in IRS records. Middesk receives the legal name, address, website and tax ID.
When every check passes, the business is approved automatically and its phone numbers are bought. When the registry check finds no such business and the tax ID doesn't match, the business is rejected automatically. Anything else goes to a person at Five at a Time. If an automatic decision goes against you, email abhi@paperkites.co and a person will look at it.
5. How we use information
- To run the Service: place and connect calls, pick a caller ID from your business's numbers, record and transcribe calls, and show your team its leads and call history.
- To verify businesses and prevent fraud (section 4).
- To keep the calling account safe. Every business calls through one carrier account, so we watch call records (numbers dialed, timing, durations and outcomes, never the audio) for each business and across the account. Patterns such as many people hung up on, or many answered calls ending within seconds, hold a business's calling automatically (Terms of Service, section 8).
- To bill you for the plan, seats and wallet reloads.
- To email you about your account, such as verification decisions, billing and changes to these documents.
- To answer carriers, the Industry Traceback Group, regulators and law enforcement when they ask about calls placed from your numbers, and to report calls we believe are illegal.
- To comply with the law.
We do not sell personal information, yours or your contacts', and we do not use it for advertising.
6. Who we share it with
These providers (sub-processors) handle data for us to deliver the Service:
- Telnyx LLC carries every call, including the audio between a rep's browser and the call. It holds the phone numbers assigned to your business, makes the call recordings we copy to our storage, sends verification codes, and looks up phone line types.
- Stripe, Inc. saves cards, checks them with the bank and takes payments.
- Supabase Inc. hosts our database, sign-in and the storage that holds call recordings.
- Vercel Inc. hosts the website and the app and counts page visits.
- Resend sends our emails.
- Middesk, Inc. checks US businesses against state and IRS records, when we switch it on.
- Groq LLC transcribes call recordings. Groq's terms do not allow it to train models on the audio or the transcripts.
- OpenRouter, Inc. transcribes recordings when Groq is busy or down (the audio is processed by DeepInfra, which does not train on it), and passes transcripts to the AI models that write summaries, outcomes, next steps, script scores and coaching notes. Some of those models run on their providers' free tiers, whose terms may let the provider log the text sent to them.
- OpenAI, L.L.C. is the backup for transcription and analysis. Data sent through OpenAI's API is not used to train its models.
- Google LLC handles sign-in if you sign in with Google. We receive your name and email address.
We will update this list when our sub-processors change.
2587689 Alberta Ltd. also runs another software product. Five at a Time's customer and call data sit in their own database, apart from it. Card payments for both go through one Stripe account.
7. How long we keep it
- While your account is open, we keep your leads, call records, recordings and AI notes so your team can use them.
- When an account closes, we delete its leads, call records, recordings and AI notes from our live systems within 30 days. Logs and verification records may be kept for up to 1 year for audit, fraud prevention and legal compliance. Billing records are kept as long as tax law requires.
8. Security
We use TLS for data in transit, AES-256 encryption at rest for tax IDs and other sensitive values, and row-level security to keep each business's data apart. Recordings sit in a private bucket and play through short-lived links, only for the signed-in user who placed the call. No method of transmission or storage is completely secure, and we can't promise that it is.
9. Cookies and browser storage
- Cookies keep you signed in.
- A few app settings are stored in your browser so the app remembers them on that device.
- Vercel Web Analytics counts page visits and a few sign-up steps, such as starting sign-up with Google.
We do not use advertising cookies or ad pixels.
10. Your rights
Depending on where you live, you may have rights to access, correct, export or delete your personal information under laws such as PIPEDA (Canada), Alberta's Personal Information Protection Act, the GDPR and UK GDPR, or the CCPA. To make a request, including deleting your account and its data, email abhi@paperkites.co from the address on your account. We respond to verified requests within the timelines required by applicable law.
If one of our customers called you, that business decides how your details are used, so ask it first. If you contact us instead, we will pass your request to the business and help it respond. If you don't want the business to call you again, tell it: our Acceptable Use Policy requires it to mark your number Do Not Call.
11. Transfers outside your country
Our sub-processors store and process data in the United States and other countries. By using the Service, you acknowledge that data may be transferred outside your jurisdiction, subject to appropriate safeguards.
12. Contact and changes
Questions about this policy: abhi@paperkites.co. We may update it from time to time and will announce material changes by email or in the app. The date at the top shows the current version.