Privacy Policy

HeyDiane is operated by The Human Frequency Inc., a Canadian corporation based in Sherwood Park, Alberta. This policy describes what personal information we collect, why we collect it, and how we handle it. It applies to three groups of people: HVAC business owners who buy HeyDiane, the callers (typically homeowners) whose calls Diane answers, and visitors to this website.

1. What we collect

From HVAC business customers

• Name, email, phone number, business name, business address
• Service configuration: service area, pricing tiers, after-hours fees, escalation rules, calendar credentials, hours of operation
• Payment information processed by Stripe (we never see card data)
• Email correspondence with us

From callers who phone a HeyDiane-equipped number

• Audio of the phone call, including a written transcript and a machine-generated summary
• Information the caller provides during the call: name, callback number, service address with postal code, nature of the request
• Call metadata: time, duration, caller ID

From visitors to heydiane.ca

This is separate from the call data above, and most of it is never linked to a name. If you only read the website and never call or sign up, this is the whole of it.

• Pages viewed, referring link, approximate location (city or region, derived from IP address), device and browser type
• Selected public-page actions, such as choosing a pricing plan or submitting a setup request
• Anything you type into a form only once you submit it — not while you are typing. See section 5.

2. Call recording consent

Calls answered by Diane are recorded and transcribed for the purpose of taking the booking request, escalating to the business owner when needed, and quality assurance. Diane discloses recording at the start of every call (“Hi, this is Diane with [business name] — quick heads up, this call may be recorded. What can I do for you?”) per CRTC requirements. A caller who does not consent to recording can hang up at that point; they will not be recorded further.

Voicemails taken on the fallback line, for when Diane can't take the call, are stored with Twilio and automatically purged 90 days after the call. Diane's own call recordings and transcripts — the calls she actually answers — are currently kept indefinitely by Retell, our voice-AI processor; we have not yet turned on automatic deletion on their side. A business owner can request deletion of any specific recording, from either system, at any time by emailing hello@heydiane.ca.

For a plain-English overview of how Alberta's single-party consent rule, CRTC business-call expectations, and PIPEDA apply to an AI receptionist, see our guide on AI receptionist compliance in Alberta. It is general information, not legal advice.

3. How we use the information

• Operate the AI receptionist service (route calls, take booking requests, send confirmations)
• Process payments and send receipts (Stripe) and transactional emails (Resend)
• Capture caller details into the customer's HeyDiane dashboard
• Send the customer weekly (and, on Crew and Fleet, monthly) call summary emails
• Improve Diane's performance — we may review recordings and transcripts to identify failure modes and retrain prompts. No personal information from callers is used to train any general-purpose AI model.
• Communicate with the business customer about their account, updates, and onboarding

4. Third parties we share information with

HeyDiane is built on top of several specialist services. Each processes a specific slice of the data described above, under their own privacy commitments:

• Retell — voice AI provider that runs the actual call with Diane. SOC 2 Type II certified.
• Groq — the large language model provider HeyDiane uses by default for the Diane Chat website widget and for summarizing a business's public website during setup. Whatever a visitor types into the chat widget, plus the business context Diane answers from, is sent to Groq to generate the reply.
• Anthropic — the alternate large language model provider for the same widget, used when HeyDiane is configured to run on Anthropic instead of Groq. Anthropic does not train its models on data sent through its API.
• Twilio — phone number provider and call routing.
• Supabase — the managed Postgres database behind the owner dashboard. It stores your business configuration and the details captured on a call: caller name, callback number, service address, and the scheduled job.
• Stripe — payment processor. PCI-DSS certified. We never store full card numbers.
• Resend — transactional email delivery.
• Vercel — web hosting for the HeyDiane site and API.
• Cloudflare — DNS and DDoS protection.
• Sentry — application error and performance monitoring. Used to detect and fix crashes; diagnostic data may incidentally include limited personal information present at the time of an error.

We do not sell, rent, or trade personal information with anyone. We will disclose information only if compelled by a Canadian court order or under a substantiated legal request.

5. Cookies, analytics, and how we measure the site

We use Vercel Web Analytics to count visits to public pages and actions such as choosing a plan or submitting a setup request. It does not use analytics cookies or follow you across other websites. We remove URL query strings and fragments before sending events. Form contents, account identifiers, private workspaces and authentication links are excluded from this website measurement.

We count completed account creations separately from paid subscriptions and service activation. Cloudflare also processes basic traffic and security information to protect the site. Essential cookies keep you signed in and remember website preferences.

Session replay and advertising pixels are disabled. We do not sell or share website analytics with advertisers. Browser content blockers can prevent website analytics collection. For questions, contact hello@heydiane.ca.

6. Where the data lives

The majority of our data is stored in North American data centres (Canada and the United States) operated by the providers listed above. Some processing (e.g. transcription) may briefly occur in US regions. By using HeyDiane, you consent to the cross-border transfer of information as described.

7. How long we keep it

• Diane's call recordings & transcripts (Retell): kept indefinitely today — automatic deletion is not yet enabled on Retell's side; email us to request deletion of a specific call
• Voicemails on the fallback line (Twilio): 90 days, then purged automatically
• Call summaries & metadata: kept for the life of the customer relationship
• Customer account data: kept for the life of the relationship + 7 years for tax records
• Email communications: kept indefinitely unless deletion is requested

8. Your rights

You can:

• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information (subject to our 7-year tax retention obligation)
• Opt out of marketing emails at any time

Email hello@heydiane.ca with the subject “Privacy request” and we'll respond within 30 days.

9. Security

We use HTTPS everywhere, encrypt data in transit, and rely on the security controls of the providers listed above. No system is perfectly secure; if a breach occurs that affects your information, we will assess the risk, contain the incident, and notify affected customers and the appropriate privacy regulator as required by applicable law and our agreements. Reporting timelines depend on the applicable law; a fixed 72-hour period does not describe every Canadian privacy obligation. See the Alberta OIPC guidance and the federal privacy guidance.

10. Children

HeyDiane is a business service. It is not directed at people under 18, and children cannot create accounts. Diane Visits is used by authorized agency staff and can hold information about children and families, including visit arrangements and case notes. Agencies must establish their authority to provide those records and agree on access, retention, and handling requirements before using real case information. The Visits security page describes how that information is protected and what we have not done yet. Contact hello@heydiane.ca to arrange an agency privacy and contract review.

11. Changes to this policy

When the substance of this policy changes we update the effective date at the top and email all active business customers. The version you accepted at signup remains binding for any historical claim period until we've given notice and a reasonable opportunity to object.

12. How to reach us

The Human Frequency Inc.
314-222 Baseline Road, Unit 83
Sherwood Park, AB T8H 1S8, Canada
hello@heydiane.ca

This document is plainly written so anyone can read it. If something isn't clear, email us — we'll explain.