Privacy Policy

This distinction determines almost everything else in this policy, so it comes first.

Customers. Businesses that subscribe to Vistrial, and the individual users at those businesses (owners, admins, setters, closers). For customer data, we are the data controller: we decide what we collect and why.

Prospects. The people your business is selling to, whose information flows into Vistrial from your CRM. For prospect data, we are a data processor: you are the controller, we act on your instructions, and we do not use that data for our own purposes beyond operating the service for you.

If you are a prospect and want your information removed, contact the business that contacted you. They control that data. We will assist them in acting on your request, but we cannot act on it independently.

Account information. Name, email address, phone number where provided, role, and the organization you belong to.

Business profile. Information you provide during onboarding about how your business sells: offer type, price point, sales cycle, team structure, lead sources, qualification criteria, and examples of messages you send. We use this to configure the service for you and, in anonymized aggregate form, to improve defaults for other customers. See section 7.

Usage data. Pages viewed, actions taken, features used, and timestamps. We use this to operate the service, support you, and understand what is and is not working.

Device and technical data. IP address, browser type, operating system, and device identifiers.

Billing information. Handled by our payment processor. We do not store full payment card numbers.

Communications. Support requests, emails, and call notes when you contact us.

When you connect your CRM, we receive and store:

Contact records. Names, email addresses, phone numbers, and the custom fields you map, for the people in your CRM.

Activity metadata. That a message was sent or received, on which channel, in which direction, at what time, and by which of your users.

Message content we send. Where you use Vistrial to dispatch a message, we store what was sent.

We do not store the content of inbound messages from your prospects. Vistrial records that a reply occurred and when. The conversation itself stays in your CRM. This is an architectural decision, not just a policy one.

Call recordings and transcripts. Where you connect a call recording service, we receive transcripts of calls between your team and your prospects. We do not record calls and we do not store audio. We store the transcript text and the structured information extracted from it.

Extracted information. Summaries, stated objections, budget and timeline signals, decision process, agreed next steps, and verbatim quotes taken from those transcripts.

Historical data. When you first connect your CRM, we import up to twelve months of prior contacts, opportunities, appointments, and activity metadata, to establish a baseline for measuring results. We do not import historical message bodies.

Payments and revenue. Transaction records associated with a contact, used to measure outcomes.

This section deserves particular attention.

Your responsibility. You are responsible for obtaining any consent required for recording, transcribing, and processing calls with your prospects. Requirements vary by jurisdiction and some require the consent of every participant. We are not able to determine what applies to you, and you should not rely on us to.

What we do with transcripts. Transcripts are used to extract structured information for the account they belong to: readiness signals, objections, and quotes used in follow-up drafts your team reviews. Transcripts are sent to our AI provider solely to perform that extraction.

What we do not do. We do not use transcript content to train AI models. We do not use transcripts from one customer to serve another. We do not sell, share, or license transcript content. Our staff cannot read your transcripts as part of routine support; access requires a specific reason, is time-limited, and is logged.

Retention. Transcripts are retained for a configurable period per account, defaulting to 12 months from the date of the call and adjustable between 30 days and 24 months in your settings. Extracted structured information is retained longer, because it remains useful after the raw transcript should be gone and is far less sensitive. You can request earlier deletion of any transcript at any time. See section 10 for the full retention schedule.

Vistrial uses third-party AI services to extract structured information from call transcripts and to draft follow-up messages.

• Content sent to those services is limited to what the task requires
• The AI provider processes it to return a result; content is not used to train their models under our agreement
• AI does not send anything to your prospects. Every message Vistrial drafts requires approval by a person on your team before it is sent. There is no autonomous sending path.
• AI-generated readiness scores and extracted information are aids to your team's judgment, not decisions made about anyone

Customer data: to provide and operate the service, authenticate users, provide support, send service communications, bill you, improve the product, and meet legal obligations.

Prospect data: only to provide the service to you. We score readiness, track touch history, extract call information, draft follow-up for your approval, and produce reporting. We do not use it for our own marketing, we do not sell it, and we do not share it with other customers.

We do not sell personal information to anyone, under any definition of "sell" in any applicable privacy law.

We produce aggregated statistics across customers to generate benchmarks and improve configuration defaults, for example typical response times or close rates for businesses of a similar type and size.

Rules we apply:

• Aggregates are computed only where enough businesses are represented that no individual business can be identified or its figures reconstructed
• No customer's identity, figures, transcripts, message content, or prospect information appears in any aggregate
• No individual user's performance data ever crosses an organizational boundary, in any form or at any level of aggregation
• You can opt out of contributing to aggregates at any time in your settings, and you still receive benchmarks if you do

Service providers, each bound by contract to protect it and use it only to provide services to us:

A current list of subprocessors with their names and locations is available on request at legal@divineacquisition.io.

Your CRM provider. We read from and write to the CRM you connect, at your direction.

Legal. We may disclose information where required by law, valid legal process, or to protect rights and safety. Where we are legally permitted to notify you first, we will.

Business transfer. If we are acquired or merge, data may transfer as part of that transaction. You will be notified and this policy continues to apply until you are given notice of any change.

• Encryption in transit and at rest
• CRM access tokens encrypted at rest, never displayed in the interface, never written to logs
• Data isolated per organization and enforced at the database level, not only in application code
• Access controls by role, with staff access to customer data requiring a specific reason, time limits, and logging
• Automated backups stored separately and encrypted
• Regular dependency scanning and security review

No system is perfectly secure. If a breach affects your data, we will notify you without undue delay and in any case within the timeframes applicable law requires.

Why transcripts default to 12 months. Transcripts are the most sensitive data we hold, so we do not keep them indefinitely. Twelve months is long enough to cover a full sales cycle plus seasonal variation, which is what measuring whether the service works requires. You can set a shorter window, down to 30 days, or a longer one up to 24 months, in your account settings. The structured information extracted from a transcript is kept after the transcript is deleted, because it remains useful and is far less sensitive than the full conversation.

Backups. Deleted data may persist in encrypted backups for up to 30 days after deletion from live systems, after which it is overwritten on the normal backup cycle. Backups are not used to restore data you have asked us to delete.

On account closure, we retain your data for 30 days so you can export it, then delete it. You may request immediate deletion instead, and we will act on that within 30 days.

Depending on where you are, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal information, and to withdraw consent.

Customers can exercise most of these directly in the product: export your organization's data at any time, delete your organization's data, and update your profile. For anything else, contact legal@divineacquisition.io.

Prospects should contact the business that holds their information. We will support that business in responding.

We respond within the timeframe applicable law requires, and within thirty days where no specific timeframe applies. We do not discriminate against anyone for exercising these rights.

We are based in the United States and process data there. If you are outside the United States, your information is transferred there. Where required, we use appropriate transfer mechanisms including standard contractual clauses.

Vistrial is a business tool not intended for anyone under 18. We do not knowingly collect information from children. If we learn we have, we delete it.

We will post changes here and update the date above. For material changes we will notify account owners by email at least thirty days before they take effect, unless a change is required sooner by law.

For data protection inquiries: legal@divineacquisition.io