Privacy Policy

Answer Anywhere ("we," "us," or "our") operates the Stylish Softphone softphone application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Service.

We are committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and applicable provincial privacy legislation, as well as applicable U.S. state privacy laws including the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) for California residents.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.

2.1 Account and Registration Information

When you register for the Service, we collect:

• Email address
• Organization/company name
• Password (stored as a one-way cryptographic hash — we cannot recover it)
• Subscription tier and billing preferences

2.2 Billing and Payment Information

We use Stripe, Inc. as our payment processor. When you purchase a subscription, Stripe collects and processes your payment card details. We do not store full credit card numbers on our servers. We receive from Stripe: a tokenized payment method reference, billing name and address, last four digits of card, and payment history (success/failure, amount, date).

Stripe's privacy practices are governed by Stripe's Privacy Policy at stripe.com/privacy.

2.3 Call Metadata (CPNI)

In connection with providing VoIP service, we may collect Customer Proprietary Network Information (CPNI) as defined under FCC rules (47 U.S.C. § 222) and analogous Canadian CRTC regulations, including:

• Call origination and destination numbers
• Date, time, and duration of calls
• SIP registration and connection events

CPNI is used solely to provide, maintain, and improve the Service. We do not sell CPNI. We will not disclose CPNI to third parties except as necessary to provide the Service or as required by law.

2.4 Technical and Usage Data

• IP addresses and approximate geographic location (country/region)
• Browser type, operating system, and device identifiers
• Session activity logs and error reports for service reliability
• SIP debug logs (connection events, registration status) — stored temporarily

2.5 Communications

If you contact our support team, we retain records of those communications to help us respond and improve.

We use personal information to:

• Create and manage your account and subscription
• Provide, operate, and improve the Service
• Process payments and send billing notifications
• Send transactional emails (password resets, account notices, invoices)
• Provide customer support
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service
• Send product updates and marketing communications where you have provided express consent (CASL-compliant)

We do not use your personal information for automated decision-making or profiling that has legal or similarly significant effects without your consent.

Under PIPEDA, we collect, use, and disclose personal information only with your knowledge and consent, subject to limited exceptions. We rely on:

• Contractual necessity: Processing required to deliver the Service you have requested (account creation, call routing, billing)
• Consent: Marketing communications and non-essential analytics, where you have expressly opted in
• Legitimate interests: Service security, fraud prevention, and service improvement, balanced against your privacy rights
• Legal obligation: Where disclosure is required by law, court order, or regulatory authority

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. We do not sell personal information of any users, including minors under 16
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights under the CCPA/CPRA
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service

To exercise these rights, submit a verifiable request to [email protected]. We will respond within 45 days (extendable by an additional 45 days with notice).

Shine the Light: California Civil Code § 1798.83 also permits California residents to request certain information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

We share personal information only in the following circumstances:

• Service Providers: We share information with trusted third-party providers that assist in operating the Service, subject to confidentiality agreements and only to the extent necessary:
  • Stripe, Inc. — Payment processing (servers in the United States)
  • Mailgun Technologies, Inc. — Transactional email delivery (servers in the United States and European Union)
  • Railway Corp. — Cloud hosting infrastructure (servers in the United States)
  • FreeSWITCH / Asterisk PBX — Your organization's PBX/SIP infrastructure (as configured by your administrator)
• Legal Requirements: We may disclose personal information if required by law, regulation, legal process, or governmental request, including compliance with CRTC, FCC, or law enforcement demands
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal information may be transferred as part of that transaction. We will provide notice before personal information is transferred and becomes subject to a different privacy policy
• Protection of Rights: We may disclose information to protect the rights, property, or safety of Stylish Softphone, our users, or others
• With Your Consent: We may share your information with third parties when you have provided express consent

We do not sell personal information. We do not share personal information with advertisers or marketing networks.

Our Service is operated from Canada. Your personal information may be transferred to and processed in the United States and other countries where our service providers are located. These countries may have privacy laws that differ from those in your jurisdiction.

For Canadian users: transfers to the United States are made under contractual protections. By using the Service, you consent to the cross-border transfer of your personal information as described in this Policy.

We take reasonable steps to ensure that service providers in other jurisdictions provide an adequate level of protection for personal information.

We retain personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Policy, or as required by applicable law. Specifically:

• Account data: Retained for the duration of your account plus 90 days after account deletion, to allow for reactivation and dispute resolution
• Billing records: Retained for 7 years as required by Canadian tax and accounting laws
• Call metadata / logs: Retained for 90 days for service troubleshooting, then deleted
• Support communications: Retained for 2 years
• Security logs: Retained for 90 days

After the applicable retention period, we securely delete or anonymize personal information.

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit using TLS/HTTPS
• Passwords stored using bcrypt one-way hashing
• Authentication cookies with httpOnly and Secure flags
• Rate limiting on authentication endpoints
• Regular security reviews

No security measure is 100% effective. In the event of a data breach that creates a real risk of significant harm, we will notify you and applicable authorities as required by PIPEDA and applicable law.

We use the following types of cookies and local storage:

• Authentication cookie (access_token): An httpOnly session cookie that keeps you logged in. Required for the Service to function. Duration: 12 hours (refreshed while you are active).
• Preference storage (localStorage): Client-side storage of UI preferences (dark mode, color theme, BLF layout) and quick dial entries. This data never leaves your browser and is not transmitted to our servers.

We do not use third-party advertising cookies or cross-site tracking cookies.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention obligations)
• Portability: Request your data in a structured, machine-readable format
• Withdraw consent: Withdraw consent to non-essential processing (e.g., marketing communications)
• Lodge a complaint: Canadian residents may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). California residents may contact the California Privacy Protection Agency. Other U.S. residents may have rights under their state's privacy laws.

To exercise your rights, contact us at [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing requests.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete it promptly. If you believe we may have collected information from a child, please contact us at [email protected].

We comply with Canada's Anti-Spam Legislation (CASL). We will only send commercial electronic messages to you if you have provided express or implied consent as required under CASL. You may withdraw consent at any time by clicking "Unsubscribe" in any marketing email or by contacting us at [email protected].

Transactional messages (account-related notices, password resets, billing receipts) are necessary service communications and are sent regardless of your marketing preferences.

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated Policy on our website and, where required by law, by email notification. The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For questions, access requests, or complaints regarding your personal information, please contact our Privacy Officer:

If you are not satisfied with our response, you may escalate your complaint to:

• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca — 1-800-282-1376
• California: California Privacy Protection Agency — cppa.ca.gov
• Federal (US): Federal Trade Commission — ftc.gov/privacy