Legal Documents
At Egentify, we prioritize the protection of your business and customer data. This policy outlines our commitment to transparency and data security.
Last updated: April 26, 2026
This Privacy Policy describes how Egentify ("Egentify," "we," or "us") collects, uses, and shares personal information when our customers (the "Customer," typically a Shopify or WooCommerce merchant) use the Egentify Service to provide AI customer service to their end users (the "End Users").
For most data flowing through the Service, the Customer is the data controller (or "business" under California law) and Egentify acts as the data processor (or "service provider"). The Customer is responsible for the lawful basis on which they collect End User data and for honoring End User privacy requests; Egentify processes that data only as instructed under our agreement with the Customer.
For data we collect directly from Customer account holders (e.g., when you create an Egentify account or visit our marketing site), Egentify is the controller, and this Policy applies directly.
We collect the following categories of personal information:
We do not knowingly collect health information regulated by HIPAA, financial information regulated by GLBA, or biometric identifiers (including voiceprints) through the Service. If you process such data through Egentify, you do so at your own risk and outside the scope of this Policy.
We use personal information to:
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
The Service uses third-party AI providers (currently including OpenAI) to process conversation content and generate responses. Inputs sent to these providers are processed under a data-retention opt-out: the providers do not retain prompts and outputs beyond what is necessary to deliver the response, and they do not use Customer Data to train their general-purpose models.
Egentify does not train AI models on Customer Data. We may use de-identified, aggregated metadata about Service performance (such as latency, error rates, and tool-use patterns) to improve the Service. We do not use the content of conversations, voice recordings, or End User personal information to train any model.
When End Users call a phone number connected to the Service, the call is handled by a third-party voice infrastructure provider (currently Retell) on the Customer's behalf. By default, calls are recorded for quality assurance, transcript generation, and AI improvement, and a recording-consent disclosure is announced at the start of each call.
Voice call data we process includes: audio recordings, transcripts, caller phone number, call duration, dialed number, and call metadata. We do not generate voiceprints or other biometric identifiers from call audio. The Customer determines retention periods for call data within the dashboard, subject to our default retention described in Section 9.
Customers using Voice AI are responsible for ensuring End Users have given any consent required for recording in their jurisdiction, including under federal and state two-party-consent laws.
We use the following categories of sub-processors to deliver the Service:
Each sub-processor is bound by appropriate data-protection and confidentiality obligations. A current named list is available on request to privacy@egentify.com. We will provide reasonable notice of material changes.
Egentify is based in the United States and our infrastructure is hosted in U.S. regions. If you access the Service from outside the United States, personal information will be transferred to and processed in the United States, which may have different data-protection standards than your home jurisdiction.
Where required by applicable law, we rely on Standard Contractual Clauses or other approved transfer mechanisms for cross-border transfers of personal information.
We retain personal information only as long as necessary to provide the Service and meet our legal and operational obligations:
Depending on where you live, you may have the right to:
If you are an End User of one of our Customers (a Shopify or WooCommerce shopper, for example), please direct privacy requests to that Customer first; they are the controller of your data. We will support our Customers in honoring valid requests. To exercise rights against Egentify directly, email privacy@egentify.com. We may need to verify your identity before fulfilling requests.
California residents have rights under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), including the right to know, delete, correct, and opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information.
We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do not knowingly process sensitive personal information beyond what is necessary to provide the Service.
The categories of personal information collected, the purposes for which we use it, and the categories of recipients are described in Sections 2, 3, and 6. We retain personal information for the periods described in Section 9.
To exercise California privacy rights, email privacy@egentify.com. You may also designate an authorized agent to make a request on your behalf. We will not discriminate against you for exercising your rights.
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Florida, Tennessee, Montana, Nevada, and others — have rights similar to those described above, including the right to access, correct, delete, and obtain a copy of their personal information, and the right to opt out of targeted advertising and the sale of personal information.
To exercise these rights, contact privacy@egentify.com. We will respond within the timeframe required by the applicable law.
We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These include encryption at rest and in transit, access controls, audit logging, and tenant isolation enforced at the database layer. More detail is available on our Security page.
No security program is perfect, however, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.
The Service is not directed to children under 13 (or under 16 in jurisdictions where that is the applicable age). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@egentify.com and we will delete it.
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we will provide reasonable notice by email or in-product notification.
Questions or requests can be sent to privacy@egentify.com.
For more on how we govern the Service, please see our Terms of Service.