Privacy policy

This policy explains what information CayTone collects when businesses and their staff use CayTone Control, CayTone Voice and CayTone Fax on the web, desktop, iOS and Android, and how it is used. CayTone provides these services to businesses. Your employer or the organization that gave you an account (the “customer”) decides who has access and controls its organization’s data.

Information we collect

• Account details: your name, work email, job title, role, site and extension, as entered by your administrator, plus a hashed password and optional multi-factor settings.
• Communications records: call detail records (numbers, time, duration, result), voicemail messages and transcripts, faxes and their documents, and text messages sent through your organization’s numbers.
• Audio during calls: CayTone Voice uses the microphone only while you are on a call, to carry the conversation. Calls are recorded only if your organization turns recording on.
• Camera and photos: CayTone Fax uses the camera or photo library only when you choose to scan or attach a page to fax.
• Device and session data: device model and app name (to label your signed-in sessions), IP address, presence status and diagnostic logs needed to keep calls connected and the service secure.

How we use it

We use this information only to provide the service your organization signed up for: routing and connecting calls and faxes, showing your history and voicemail, securing accounts, preventing abuse, supporting customers, billing your organization and meeting legal obligations. We do not sell personal information, we do not use it for advertising, and the apps contain no third-party advertising or tracking SDKs.

Who we share it with

We share information only with service providers that help us run CayTone, under contracts that limit their use to providing that service:

• Telecommunications carriers that connect calls, faxes and messages to the public telephone network.
• Hosting and infrastructure providers in the United States that run our servers, storage and DNS.
• Your organization’s administrators, who can see the records of their own organization.

We may also disclose information when required by law, such as a valid subpoena or court order.

Where it is stored and how it is protected

Data is stored in CayTone regional data centers in the United States (currently Miami and New Jersey). Connections are encrypted with TLS, sign-in tokens are kept in your device’s secure storage (iOS Keychain or Android Keystore), passwords are hashed with Argon2id, and every organization’s data is isolated from every other organization’s.

Retention and deletion

Records are kept for as long as your organization’s account is active, or for the shorter retention period your organization configures. When a user is removed or an organization closes its account, its data is deleted from active systems within 30 days and from backups within 90 days, except where we must keep it longer by law. See how to delete an account.

Your choices and rights

You can update your presence and sign out of any device from the apps. To access, correct or delete your personal information, contact your organization’s administrator, or email privacy@caytone.com and we will work with your organization to respond. You can deny microphone, camera or photo access in your device settings at any time; the related features will stop working until you allow it again.

Children

CayTone is a business service and is not directed to children under 16. We do not knowingly collect information from children.

Changes and contact

We will post changes to this policy on this page and update the date above. Questions: privacy@caytone.com.