Privacy Policy
Last updated October 13, 2026
wolf (“we”) provides phone lines answered by an AI agent for businesses. This policy explains what we collect and why, in plain language.
What we collect
- Account data: your email, name, and optional password (stored hashed).
- Line data: your line's number, the role and voice you chose, the people it may transfer to and their mobile numbers, and your own mobile number if you provide it. If you set an owner PIN, only a keyed hash of it is stored; nobody, including us, can read it back.
- What the agent knows: the inventory or price lists you upload, the web pages you add and the text we read from them, the policies you type, and the rules you give the agent in the dialogue. This is your business data, used only to answer your line's calls.
- Call data: call metadata (numbers, times, duration), transcripts, the summary and the lead or message produced during a call, including the caller's name and number when the caller gives them. We do not store audio recordings.
- Messages and email: texts sent to your line and the subject and a short excerpt of emails sent to your line's address.
- Usage: minutes used and activity on the desk.
- Payment: Stripe takes your card. We never see or store the card number. We keep Stripe's reference for your account and a fingerprint of the card, so that one card gets one free trial.
- Website visits: which page was opened, the site you came from, and a random number in a cookie that tells one browser from another. It is not tied to your name, and there are no advertising trackers.
How we keep it private from us
What happens on your line is yours. Call summaries, transcripts, texts, email, your uploads, your standing instructions, your rules and your leads are encrypted before they are stored, with a key that is separate for every line and held apart from the database. Our staff tools show usage: minutes, counts, plan, and status. They do not show conversations. We troubleshoot with logs that carry no content, and the only people who see what your line said are you and the people you give access to.
How we use it
To run your line: answering and placing calls, looking up answers in what you gave the agent, producing summaries and leads, delivering the emails you asked for, metering minutes, preventing abuse, and supporting you. We do not sell personal data and we do not use your call content, your uploads or your callers' details to train models.
How it is protected
- Everything travels encrypted (TLS) between you, us, and the companies below.
- What happens on your line is encrypted before it is stored (AES-256-GCM), with a separate key for every line. Those keys are themselves locked with a master key that is kept in a secret store, not in the database.
- Passwords and owner PINs are stored only as salted or keyed hashes. We cannot read them back.
- Staff tools show usage, not conversations. Our logs carry no call content.
- Only you, signed in, can change the people the agent transfers to, your mobile number, the inboxes your summaries go to, your plan, your password, and your PIN.
- We keep no audio. When a line is closed, its call content is deleted within 30 days.
Who processes it
Other companies handle parts of the service for us. Each gets only what it needs for its part, and processes it only to provide the service.
- Twilio carries the calls and texts.
- xAI and OpenAI run the speech model on a call, depending on the voice your line uses, write the call summary, read the pages you add, and answer in the dialogue. Each sees the words of a call and the parts of your knowledge the agent looked up for it.
- Cloudflare runs our application and holds the database. Fly.io runs the servers that connect a call to the speech model.
- Resend delivers the email your line sends, such as call summaries.
- Stripe takes payments.
- Fastmail hosts the mailbox that email you write to us arrives in.
When you add a web page, we fetch it from the site that hosts it, as a browser would.
Where it is stored
We store your data in the United States. Our database is in Cloudflare's Western North America region, in the United States. The call servers are in Los Angeles and keep no call content once a call ends. Twilio and Resend keep their records in the United States.
The speech model is the exception. During a call, xAI or OpenAI processes the audio and the words as they are spoken. On the connections we use, neither company promises to keep that processing in one country, and each may keep a record of requests for a limited time under its own terms. We store no audio ourselves.
Moving data between countries
wolf is built for the United States and Canada. Lines have numbers in those two countries, and they call and text numbers in those two countries only. If you use wolf from Canada, or from anywhere else outside the United States, your data is sent to the United States and stored there. The law on personal data there may differ from the law where you live.
We do not direct the service at people in the European Economic Area, the United Kingdom or Switzerland. We have not put a transfer arrangement in place for those regions, such as standard contractual clauses or the Data Privacy Framework.
Requests from governments and other third parties
We give your data to a government, a court, or anyone else outside the companies above only when the law makes us. That means a valid and binding legal demand, such as a subpoena, a court order or a search warrant, from an authority that has power over us.
- No standing access. No government has direct or standing access to our systems, our database or our encryption keys, and we have built no back door. We do not hand data over voluntarily, and we do not sell it.
- We check every demand. Before we answer, we check that the demand is lawful, that it comes from an authority entitled to make it, and that it asks for no more than it may.
- We push back. If a demand is unlawful, unclear or wider than it needs to be, we refuse it or ask for it to be narrowed, and we contest it where the law lets us.
- We give the least we can. We hand over only the data the demand names. Account details and usage come first. Line content is encrypted, and we decrypt it only when a demand specifically and lawfully requires that content. There are no audio recordings to give.
- We tell you. We tell the customer before we hand anything over, unless the law or a court order forbids it. If it does, we tell you once we are allowed to.
- We keep a record. For every demand we record who made it, under what authority, what we gave, our legal reasoning, and who handled it.
- Emergencies. If we believe in good faith that someone is in danger of death or serious injury, we may give the least information needed to prevent it.
Legal demands go to hello@wolfsi.app with “Legal request” in the subject.
Payments
wolf sells a subscription. It is not a bank, a money transmitter or a payment service, and it is not registered with or supervised by a financial or anti-money-laundering regulator. Stripe takes the card payments. We never hold your money or move money for you, and your line never makes a payment or reads out a card number.
Your callers
The agent speaks as your business, says who is calling and why on outbound calls, and confirms it is an AI when asked. A transcript is generated for every call and a lead or message may record the caller's name and number. These are collected for you, as the business: you decide how you use them, and you are responsible for complying with recording, disclosure and marketing laws where you and your callers are located. The agent never shares one caller's details with another.
Your choices
You can remove uploads, pages, rules and leads, change who the agent transfers to, and close your line from Settings or by emailing hello@wolfsi.app. Closing a line releases the number and deletes call content, uploads and leads within 30 days.
Contact
Questions: hello@wolfsi.app.