1. Information we collect
Business information
- Business name, industry, and location
- Business hours and service offerings
- Phone numbers and contact information
- CRM integration credentials (encrypted)
Call data
- Call recordings and transcripts
- Caller phone numbers and contact details
- Summaries and insights written by AI
- Tags, sentiment scores, and extracted data
Usage information
- Dashboard activity and feature usage
- Device information and browser type
- IP addresses and geolocation data
- Performance metrics and error logs
2. How we use your information
We use your information to:
- Provide AI receptionist services and call handling
- Generate transcripts, summaries, and insights
- Integrate with your CRM and business tools
- Send appointment confirmations and notifications
- Improve service quality using aggregated, deidentified usage data; we never use your patients’ data to train shared AI models
- Detect fraud and ensure platform security
- Comply with legal obligations
3. Data sharing and third parties
We work with trusted service providers to deliver our platform. Your data may be shared with:
Infrastructure providers
- Telephony providers: Phone number provisioning and SMS with HIPAA eligible safeguards
- Voice processing providers: AI call handling and transcription, covered by a business associate agreement before they carry patient calls
- Database providers: Encrypted application data hosting and access controls
- Workflow infrastructure providers: Internal automation and background job processing
AI and analytics
- AI processing providers: Analysis and summarization under minimum necessary data controls
- Business integration providers: CRM integrations with encrypted credential storage
Payment processing
- Payment processor: Payment processing certified to PCI DSS Level 1
We never sell your data to third parties. All providers are contractually obligated to protect your data.
4. Data security
We use security measures that are standard in our industry:
- Encryption: Data is encrypted in transit and at rest
- Access control: Row level security (RLS) in our database, and access by role for your team
- Authentication: Email verification, session management, and access controls by role
- Audit logging: Access to patient content is logged with who accessed it and when
- Monitoring: Platform health and error monitoring with alerting on failures
- Backups: Encrypted backups managed by our database platform
5. Data retention
- Call recordings and transcripts: We do not keep bulk copies of them by default. When a teammate opens a call, its content is fetched on demand, and every view is logged. Any copy kept on your account is removed after your retention period (90 days by default).
- Call records: The time, the caller’s number, and the outcome of each call stay in your dashboard while your account is active
- Contact data: Retained until you delete or request removal
- Account data: Deleted within 30 days of account closure
6. Your privacy rights
You have the right to:
- Access your data: Request a copy of all data we have about you
- Delete your data: Request permanent deletion of your account and data
- Correct your data: Update inaccurate or incomplete information
- Data portability: Export your data in a format a machine can read
To exercise your rights: Email privacy@spiderlabs.ai and we will respond within the timelines required by applicable law.
7. Cookies and tracking
We use one cookie, to keep you signed in, and we keep a few preferences in your browser. See our Cookie policy for details.
- Essential cookie: Keeps you signed in to your account (it cannot be turned off while you use the dashboard)
- Preferences: Kept in your browser, not in cookies (for example, whether sound is on, and your dashboard theme)
- Analytics cookies: None currently set; the Cookie policy will list them before any are added
- Scheduling: When you open Contact us, our scheduling provider (Calendly) may set its own cookies
8. Compliance by industry
Healthcare (HIPAA)
For healthcare clients such as dental practices and medical spas, we follow practices aligned with HIPAA and sign a Business Associate Agreement (BAA) with you before any patient data flows:
- We require business associate coverage from every subprocessor that handles patient data before it carries your patients’ traffic; the current status of each agreement is available on request
- Patient data is encrypted in transit and at rest
- Access logs maintained for all PHI (protected health information)
- We do not claim certifications we do not hold
Payment data (PCI DSS)
- The AI receptionist does not collect payment card data on calls
- Subscription billing for your SpiderLabs account is handled by a payment processor certified to PCI DSS Level 1; we never store credit card numbers
9. Children’s privacy
SpiderLabs is a service for businesses. We do not knowingly collect information from children under 13. If a call is received from a minor, it is incidental to providing services to our business clients.
10. International data transfers
Your data is stored in the United States, on infrastructure eligible for HIPAA. If you need a data processing agreement or have data residency requirements, email privacy@spiderlabs.ai and we will tell you what we can support.
11. Changes to this policy
We may update this Privacy policy periodically. Material changes will be announced by:
- Email notification to your account email
- A notice in your dashboard
- The “Last updated” date at the top of this page
Continued use of SpiderLabs after changes constitutes acceptance of the updated policy.
How to reach us
For privacy questions, data requests, or concerns:
- Privacy contact: privacy@spiderlabs.ai
- Security reports: security@spiderlabs.ai
