pinecall data

pinecall data erase call <call-id> --yes
pinecall data erase contact <number|id> --yes
pinecall data erasures [--json]
pinecall data reads [<call-id|number>] [--json]
pinecall data policy [--retention-days <n> | --keep-all] [--calling-hours <from>-<until> | --any-hours]
                     [--per-number-day <n> | --no-per-number] [--consent-everywhere | --consent-by-law]
                     [--disclosure '…' | --platform-disclosure | --no-disclosure]
                     [--recording-notice | --no-recording-notice] [--json]
pinecall data consent <number> [--give express|written --source '…' [--text '…'] [--evidence '…'] | --opt-out]
pinecall data dnc [list [--after <cursor>] | add <number>… --source '…' | import <file> --source '…']
pinecall data export [--out <file.jsonl>]

$ pinecall data reads
2026-10-09 12:15  log        call_92dce20e53d044dcb925c69c13db72f7  by m_berna_default  (sandbox)
2026-10-09 12:12  memory     +34600000001                            by m_berna_default  (sandbox)
$ pinecall data policy
retention:      every sealed call is kept until it is erased
calling hours:  a number is rung at any hour of its day (a +1 number: 8-21)
per number:     no limit of calls to one number a day (a +1 number: 3)
consent:        a +1 number needs a consent on file
$ pinecall data erasures
nothing erased yet

What the org keeps in the environment the key acts in (--prod for production), and taking it out.

erase call takes one ended call: its log, its facts, the memories it taught and its recording, in one transaction (DELETE /v1/calls/{call}); a call still running is refused. erase contact is a person's "delete my data": every call they were on in the environment and every fact kept of them (DELETE /v1/contacts/{contact}), by the number or the id the call carried. Neither can be undone, so both ask for --yes. The dial ledger keeps the numbers and the time of a call, never what was said: a carrier's traceback asks for it.

$ pinecall data erase contact +14155550142 --yes
2026-09-29 18:02  contact +14155550142  3 call(s), 212 entries, 4 memories, 3 recording(s)  by m_ana

erasures is the trail (GET /v1/org/erasures): what went, when, and who asked — a person, a key, retention for the nightly run, operator for an org erased whole. It outlives the org.

reads is who read the org's calls (GET /v1/org/reads): a person reading a call's log or its recording at the console or with their key, the operator reading one off the platform, and a traceback the operator ran on a number — once an hour per reader, call and kind, newest first; a call id or a number after it narrows the list to that one. A server's key and a visitor's page write nothing. It is the access log a breach notification starts from.

policy is the org's compliance settings, one row at GET·PUT /v1/org/policy, read with no flag and changed a field at a time (the row is read and written back whole, so the other fields stay): --retention-days <n> is how many days a sealed call is kept before the platform's nightly run erases it, --keep-all clears it; --calling-hours 9-20 the hours of the called number's own day a call may ring, --any-hours clears them; --per-number-day <n> how many times one number is rung in 24 hours, --no-per-number clears it. A US or Canadian number keeps the US floor — 8 to 21 and three a day — whatever is set wider; the sandbox and your own verified phone are held to neither. --consent-everywhere asks for a consent on file for a number of any country, --consent-by-law for a +1 number only (the default).

What a spoken call says before its greeting is the policy's too, said in the agent's voice and logged as its first turn.agent. An outbound call opens with the disclosure: the platform's sentence in the agent's language by default ("This is an automated assistant calling on behalf of Clínica Norte.", --platform-disclosure), your own words (--disclosure '…'), or none (--no-disclosure, and then your greeting must say it is an automated assistant). A recorded call, either direction, then says "This call may be recorded."; --no-recording-notice turns that off.

$ pinecall data policy --retention-days 365 --calling-hours 9-20
retention:      a sealed call is erased 365 day(s) after it started
calling hours:  a number is rung from 9:00 to 20:00 of its own day
per number:     no limit of calls to one number a day (a +1 number: 3)
consent:        a +1 number needs a consent on file
outbound opens: the platform's sentence ("This is an automated assistant calling on behalf of …")
recording:      a recorded call says "This call may be recorded."
set by m_ana

consent <number> is what stands for a number in the environment — consented, on the do-not-call list, or nothing on file — and every fact about it, newest first (GET /v1/org/consents/{number}). --give express|written --source '…' records a consent, with the --text the person agreed to and an --evidence (a URL, a document id); --opt-out puts the number on the list. A call to a US or Canadian number in production needs a consent on file (or one sent with the dial), and a number on the list is never dialled, whatever consent the dial carries: only a consent recorded here lifts it.

$ pinecall data consent +14155550142
+14155550142  on the do-not-call list
  2026-09-29 18:40  opt_out   the caller asked the agent  by agent:front-desk  on call_9f2c…
  2026-09-20 10:02  express   the booking form  by m_ana

dnc is the list itself (GET /v1/org/dnc, a page at a time), dnc add <number>… puts numbers on it, and dnc import <file> takes a file of them, one a line — the org's own list, or the scrub of the National Do Not Call Registry the org ran on its own account (POST /v1/org/dnc). Both ask for --source, which the list keeps beside each number.

export streams the org's environment whole as JSON Lines (GET /v1/org/export): a header, every call with its facts and its whole log, every memory, every version of every agent's settings and words, every knowledge document. --out writes a file and says so on stderr; without it, stdout, for a pipe. Recordings are not inlined: pinecall sessions names them.