This page describes how rushproof handles personal information collected on your behalf while operating your voice assistant — caller names, phone numbers, appointment details, and call content. It applies alongside our Terms of Service and Privacy Policy.
You remain in control of your callers' personal information at all times. Your business is the organization that collects it; rushproof processes it on your instructions and on your behalf. We do not use it for our own purposes, and control never transfers to us — including while the information sits with our technology providers.
For a British Columbia business serving BC callers, British Columbia's Personal Information Protection Act (PIPA) is the governing private-sector privacy law. It has been deemed substantially similar to the federal PIPEDA and displaces it for commercial activity within the province.
PIPEDA also applies to interprovincial and international transfers of personal information — which is relevant here, because some of our technology providers process data outside Canada (see section 4). Both frameworks are addressed in this agreement. If your business operates outside BC, the equivalent provincial or federal law applies in the same way.
Only what running your service requires: the caller's name, phone number, email address where a booking needs one, the reason for their call, appointment details, and the call transcript.
That information is used for exactly three purposes, and no others:
It is never sold, never shared for anyone else's purposes, and never used to train systems for other clients. If we ever want to use caller information for a purpose beyond the three above, we will ask you first — and the disclosure your callers hear will be updated to match, before the change takes effect.
Your assistant runs on infrastructure operated by third-party providers. We name them rather than describing them generally:
Canadian privacy law permits processing personal information outside Canada. What it requires is that the organization remain accountable for it, that comparable protection be in place, and that the transfer be disclosed rather than hidden. We do not claim Canadian data residency, because it would not be true. We disclose exactly where the information goes instead. We will notify you before adding any new provider that changes where your callers' information is processed.
Before collecting personal information, your assistant discloses, out loud, at the start of the call:
If the caller declines, the assistant does not proceed with collecting their details — it offers a real alternative: a callback from your team, or your direct contact information. A caller is never required to accept transcription in order to be helped.
Your own obligation, stated plainly: as the organization collecting the information, the duty to obtain meaningful consent from your callers is ultimately yours. Our assistant is built to satisfy that duty on your behalf at the point of collection, and we will adjust its disclosure to match your own privacy policy on request. What we cannot do is take that legal responsibility off your hands entirely, and we will not pretend otherwise.
Caller data is retained for 365 days by default, then deleted. Shorter retention, down to 30 days, is available on request and takes effect within 2 business days. Information is destroyed once the purpose it was collected for has been fulfilled and any retention period has passed. Leads and transcripts delivered to you become your records, kept under your own retention practices.
Information in transit and at rest is encrypted using our providers' standard security practices. Access on our side is limited to those who need it to operate your service. API credentials are stored in encrypted credential storage, never in plain text.
If we become aware of a breach affecting your callers' information, we will notify you within 72 hours, with what we know and what we're doing about it. Under BC PIPA, breaches posing a real risk of significant harm carry reporting obligations — we will support you in meeting yours, promptly and without you having to chase us for information.
You can request a copy of what we hold about your callers, ask how it's been used, request correction, or request deletion at any time. We respond within 5 business days — well inside the 30 days BC PIPA allows.
If a caller withdraws consent, tell us and we will stop processing their information and delete it, unless we are legally required to keep it.
BC PIPA requires an accountable individual to be named and publicly reachable. For rushproof, that is:
Fraser Marlow — Privacy Officer, ventr Labs Inc.
fraser@joinventr.com · 604 771 3729
Unresolved concerns can be escalated to the Office of the Information and Privacy Commissioner for British Columbia, or the Office of the Privacy Commissioner of Canada where federal law applies.
Your assistant is built never to collect medical or health information. It takes a name, a number, and a reason for calling in plain terms; it does not ask about conditions, treatments, or history, and it is instructed to redirect anything clinical to your team.
That said, some health-sector bodies expect records to be stored on Canadian infrastructure. We cannot offer Canadian-only storage today, because our voice providers do not offer it. If your practice is subject to that expectation, you should weigh this before proceeding, and we would rather lose the work than have you find out afterward.
fraser@joinventr.com · 604 771 3729. A real person, every time.
This agreement reflects rushproof's actual practices and our current understanding of BC PIPA and PIPEDA. It has been prepared carefully but not yet reviewed by legal counsel; a formal review is planned. Nothing here is offered as legal advice to you.