Data & privacy

What your org keeps, what a call says before the agent's greeting, who may be called, and how a person's data comes out or goes. You set all of it on the console's Privacy screen, in the workspace, or with pinecall data.

What is in it?#

The policy is one per org, the same in the sandbox and in production. Everything else is each one's own: calls, consents, the do-not-call list, the export and the trail of reads. Pass --prod to act on production's.

The tab and the policy, export and trail need a key that opens team: the manager and admin roles (Orgs, people and roles).

The policy#

One row per org, changed a field at a time; the other fields stay as they were. A change to retention applies from the next nightly run.

$ pinecall data policy --retention-days 365 --calling-hours 9-20
retention:      a sealed call is erased 365 day(s) after it started
calling hours:  a number is rung from 9:00 to 20:00 of its own day
per number:     no limit of calls to one number a day (a +1 number: 3)
consent:        a +1 number needs a consent on file
outbound opens: the platform's sentence ("This is an automated assistant calling on behalf of …")
recording:      a recorded call says "This call may be recorded."
set by m_ana

A +1 number always keeps 8:00 to 21:00 and a consent on file, whatever you set. The sandbox, and your own phone, are held to none of the policy's rules on dialling: not the calling hours, the per-number limit, consent or the do-not-call list. The gateway's own rules still apply there; how each rule refuses a dial is in Calling out.

What a call says first#

The disclosure and the recording notice are said in the agent's voice before its greeting, and logged as the call's first turn, so a call can prove what the person heard.

An outbound call opens with the platform's sentence in the agent's language, "This is an automated assistant calling on behalf of …", your own words, or nothing. With nothing, your greeting must say it is an automated assistant. Any recorded call, inbound or outbound, then says "This call may be recorded." A call nobody records says no notice.

Two judges hold calls to this at hang-up. disclosed fails a call where the agent claimed to be a person, or did not say it is automated before the caller's second turn or when asked. honoured-stop fails a call where the caller asked not to be called again and no opt-out was written on that call. See Built-in judges.

Consent and the do-not-call list#

pinecall data consent +14155550142 --give express --source 'the booking form' --prod
pinecall data consent +14155550142 --opt-out --prod
pinecall data dnc import scrub.txt --source 'national registry scrub' --prod

consent <number> shows what stands for a number (consented, on the list, or nothing on file) and every fact about it, newest first. --give express|written records a consent with its --source, and optionally the --text agreed to and an --evidence. dnc add and dnc import put numbers on the list, one per line in a file.

In production a number on the list is never dialled, whatever consent a dial carries. Only a consent recorded here lifts it. The sandbox keeps a list of its own and dials without reading it.

Your agent puts a caller on the list the moment they ask:

/** The caller asked not to be called again. Use it the moment they say so, whatever the words. */
@tool()
async stopCalling(): Promise<string> {
  this.call.optOut();
  return "They are off the list of people we call. Tell them so, apologise, and end the call.";
}

Export, erasure and the trail#

Nothing erased comes back. The dial ledger keeps the numbers and the time of each call, never what was said, because a carrier's traceback asks for it.

The console has the same: Export, Erase a contact, Erasures and the access log on this tab, and Erase this call and Do not call this number on a finished call's page.

Next steps#