Privacy Policy

To maintain compliance with the GDPR, the ePrivacy Directive, and Québec's Law 25, we use Google Consent Mode v2 integrated via Google Tag Manager (GTM-WML4TTR3). For visitors in the European Economic Area, the United Kingdom, Switzerland, and Canada, our site denies the storage of tracking and advertising cookies by default until you explicitly consent.

In these regions, tracking tags stay dormant until you take an explicit "Accept" action, at which point updated consent signals are transmitted to our analytics stack. You can change or withdraw your choice at any time using the Cookie preferences link in the site footer.

District AI answers calls on behalf of the businesses that use it. When you call a District AI number, the call is answered by an AI assistant, which transcribes and summarizes it. The audio of the call is not recorded. The phone number you call from may be checked against a carrier lookup that returns the caller name on record and the type of line, so the business can recognize returning customers. We do not buy spam or risk scoring on callers. This information is stored in the business's private workspace and is controlled by that business; we process it on their behalf.

Where a workspace enables lead enrichment (District Global Intelligence), we supplement business-contact records with professional information, such as company, role, and business email, sourced from licensed B2B data providers (currently People Data Labs and Apollo) and carrier caller-ID lookups (Twilio). Enrichment data is used only inside that workspace's CRM and is never sold.

Your workspace's home region is the United States (default, Google Cloud), or Canada (Montreal), Europe (Frankfurt, serving the EU and UK) or Asia-Pacific (Singapore) on Amazon Web Services. Workspace content is stored in an isolated regional database.

Canada: browser call audio is processed in Montreal (ca-central-1). The language model runs in Montreal on every engine except the realtime one (us-east4). New Canadian workspaces start on an all-Canadian engine; other engines run speech recognition and synthesis in the United States. Asia-Pacific: the same, in Singapore.

Telephone calls: the calls a Canadian, European or Asia-Pacific workspace places, or receives on our numbers, are handled in its region; European numbers we issue in Frankfurt and Canadian ones we issue through Telnyx in Montreal. A number on your own carrier account is answered in the United States.

Outside your region: payments (Stripe, United States); support requests (Atlassian, Canada, under the EU adequacy decision for Canadian commercial organisations); optional linked knowledge base questions (Atlassian); number registration documents (Twilio, United States). United States sign-in and routing copies are kept for rollback and Asia-Pacific access checks, and in our encrypted backups.

Live call events carry the caller's name, phone numbers, transcript and AI summary, never audio; each is created where the call is answered.

Transfers rely on Standard Contractual Clauses and adequacy decisions.

The data residency map details each data type.

We protect personal information with the controls described on our Sovereign page. They are TLS 1.2 or higher on every public endpoint, database storage encrypted at rest by the provider hosting each region, and tenant isolation enforced by PostgreSQL row-level security. Stored credentials are encrypted again with Google Cloud KMS, secrets are managed, access to production is least-privilege, and rate limiting sits in front of authentication. No method of transmission or storage is completely secure, and we do not promise that ours is.

If a breach of our security safeguards creates a real risk of significant harm to you, we notify you and the regulators that PIPEDA, Law 25 and the GDPR require, and we keep a register of such incidents. A customer whose workspace is affected is notified under the timelines in our Data Processing Agreement, so that it can meet its own duties to its callers.

We do not send marketing email. We have no newsletter and no promotional mailing list, and nothing on our website, at checkout or in your account asks you to join one.

The email we do send is about your account and the service you use: receipts and invoices, sign-in and security notices, call reports and usage alerts, replies to your support requests, and notices of changes to our policies and terms. These are not marketing, and they continue for as long as you have an account.

If we ever wanted to send marketing email, we would ask for your consent first and update this policy before sending any.

For residents of California and other US states with consumer privacy laws: we do not sell personal information. The consent-gated conversion measurement in section 06 sends a one-way hashed email to Google Ads and LinkedIn, matching a sign-up to its ad. Under California law that may count as sharing for cross-context behavioral advertising, so you can opt out at any time: choose Decline, or the Cookie preferences / Do Not Sell or Share link in the footer. A Global Privacy Control signal from your browser is treated as that opt-out automatically, without asking you to confirm, unless you have chosen Accept here. We honor requests to know, correct, and delete in any state, without discrimination, through section 13's channels.

For any inquiries, please contact our Privacy Officer, Sean Dean, founder and CEO:

legal@distronode.com