Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

Account and Family Information:

• Family member name, email address, and phone number
• Relationship to incarcerated individual
• Payment information (processed and stored by Stripe, Inc. — we do not store full card numbers)
• Alert preferences and notification settings

Inmate Information (provided by family or the caller):

• Inmate name and ID number
• Facility name and location
• Authentication PIN (stored as a one-way cryptographic hash — we cannot recover it)

Contact Form and Support Submissions:

• Name, email, phone number, and message content submitted through our contact form
• Support tickets and correspondence

1.2 Information Collected Automatically

Call Data:

• Call date, time, and duration
• Phone number the call originated from
• Minutes used and remaining balance
• Call recordings (audio files)

Conversation Data:

• Voice recordings converted to text (transcripts)
• Topics and subjects discussed
• Music and content requests
• Content safety flags and moderation events

Technical and Usage Data:

• IP addresses and device information when accessing our website
• Browser type and operating system
• Pages visited and time spent on site
• Authentication attempts and session data
• Error logs and diagnostic information

2. How We Use Your Information

2.1 To Provide and Operate the Service

• Authenticate callers and prevent unauthorized access
• Process voice conversations through AI (OpenAI)
• Track minute usage and manage subscription billing
• Deliver family messages and voice messages
• Send service notifications, receipts, and alerts
• Process referral credits and rewards

2.2 To Ensure Safety and Legal Compliance

• Monitor conversations for prohibited content using automated systems
• Detect and prevent fraud, abuse, and unauthorized use
• Comply with applicable laws and regulations
• Respond to lawful law enforcement requests
• Enforce our Terms of Service

2.3 To Improve the Service

• Analyze aggregate usage patterns to improve features
• Improve AI response quality and accuracy
• Develop new features and content
• Troubleshoot technical issues

2.4 To Communicate With You

• Send transactional emails (receipts, alerts, service updates)
• Respond to support requests and contact form submissions
• Send promotional communications (you may opt out at any time)

3. How We Share Your Information

3.1 With Service Providers

We share information with third-party service providers who help us operate the Service:

• Twilio, Inc.: Phone system, call routing, and SMS delivery
• OpenAI, L.L.C.: AI conversation processing, voice-to-text, and text-to-voice
• Stripe, Inc.: Payment processing and subscription management
• SendGrid (Twilio): Transactional email delivery
• Cloud hosting providers: Data storage and infrastructure

These providers are contractually obligated to protect your information and may only use it to provide services to us, not for their own purposes.

3.2 With Correctional Facilities

• Facilities that have contracted with CellMateAI may have access to call records, transcripts, and usage statistics
• We may be required to provide information to facility administrators under the terms of facility contracts
• Facility policies may govern additional sharing requirements

3.3 With Law Enforcement and Legal Authorities

We may disclose information when:

• Required by law, subpoena, court order, or other legal process
• Necessary to prevent imminent harm to any person
• Related to ongoing criminal investigations when legally compelled
• Required to protect our legal rights or the rights of others

3.4 Business Transfers

If CellMateAI is acquired, merged, or undergoes a change of control, your information may be transferred to the successor entity. We will notify you of any such transfer via email or prominent notice on our website.

3.5 With Your Consent

We may share information for other purposes with your explicit, informed consent.

4. Call Recording and Monitoring

4.1 All Calls Are Recorded

4.2 How Recordings Are Used

• Quality Assurance: Improving AI response quality and accuracy
• Safety Monitoring: Detecting prohibited content and policy violations
• Legal Compliance: Responding to lawful legal requests
• Dispute Resolution: Resolving billing or service disputes
• Facility Compliance: Meeting contractual obligations with partner facilities

4.3 Automated Content Moderation

• AI systems analyze conversations in real time for safety violations
• Flagged content is logged and may be reviewed by human staff
• Serious violations may be reported to facility administrators or law enforcement as required by law

5. Data Retention

We may retain data longer if required by law, legal proceedings, or active investigations.

6. Data Security

6.1 How We Protect Your Data

• Encryption in Transit: All data transmitted over the internet is encrypted using TLS 1.2 or higher
• Encryption at Rest: Stored data is encrypted using AES-256 encryption
• Access Controls: Employee access to personal data is limited to those with a legitimate business need
• Authentication: Secure PIN-based access with rate limiting and lockout protection
• Security Monitoring: Continuous monitoring for unauthorized access and anomalous activity
• Regular Audits: Periodic security assessments and vulnerability testing

6.2 Limitations

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your information. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

7. Your Rights and Choices

7.1 Access and Correction

• You may request a copy of the personal information we hold about you
• You may request correction of inaccurate or incomplete information
• Contact us at [email protected]

7.2 Account Deletion

• You may request deletion of your account and associated personal data at any time
• Some information may be retained as required by law or for legitimate business purposes (e.g., payment records)
• Deletion is permanent and cannot be undone

7.3 Marketing Communications

• You may opt out of marketing emails at any time by clicking "Unsubscribe" in any marketing email
• You cannot opt out of transactional service communications (receipts, alerts, security notices)

7.4 California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: What personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of personal information (we do not sell personal information)
• Right to Correct: Request correction of inaccurate personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your California rights, contact us at [email protected]. We will respond within 45 days as required by law.

8. Children's Privacy

CellMateAI is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information immediately. If you believe we have collected information from a child under 13, please contact us at [email protected].

9. International Users

CellMateAI is based in the United States and primarily serves users in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have different privacy laws than your country. By using the Service, you consent to this transfer.

10. Third-Party Services

We use the following third-party services that have their own privacy policies:

11. Changes to This Privacy Policy

• We may update this Privacy Policy at any time to reflect changes in our practices or applicable law
• Changes will be posted on this page with an updated "Last Updated" date
• Material changes will be communicated via email when a valid email address is on file
• Continued use of the Service after changes constitutes your acceptance of the updated policy

12. Contact Us

For questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, please contact us: