Trust & data protection
Draft, written by the GPT Business team. Last updated 2026-11-07.
GPT Business answers your calls and texts, books jobs and sends invoices for you. That means we handle your customers’ details, so here is what we do with them, in plain words.
The short version
- Each business’s data is kept separate from every other business.
- We use a short list of outside companies to run the service (below). We list each one, what it does and what it sees.
- We text or call your customers only with consent.
- We keep each kind of record for a set time (below), and you can ask for a copy or for deletion.
Security status, honestly
SOC 2: not yet; controls in progress. We do not hold SOC 2, ISO 27001 or any other security certification today, and we will not say we do until an independent auditor has issued one. Several of the companies below hold their own SOC 2 reports (we checked their public trust pages on November 8, 2026: Supabase, Stripe, OpenAI, Telnyx, Cloudflare and Anthropic each state one); that covers their systems, not ours. See how we protect data and what we do if something goes wrong.
Who handles your data (sub-processors)
These companies process data for us so the service works. We give customers at least 30 days’ notice before adding one that handles customer data.
| Company | What it does for us | Data it handles |
|---|---|---|
| OpenAI | The AI that listens on calls, writes and replies, and runs your AI Manager. | Conversation text, call audio, transcripts and the contact details in them (such as a name or phone number). API data is not used to train its models by default. |
| Anthropic | AI models, including some text-message replies and support answers. | Message text and the business context needed to answer. It does not use inputs or outputs from its commercial products to train its models by default. |
| Telnyx | Phone numbers, calls and text messages. | Phone numbers, call audio and, where recording is on, recordings, text content and delivery status. |
| Stripe | Card payments and billing. | Payer name, email, billing details and payment status. Card numbers go to Stripe; we do not store full card numbers. |
| Supabase | Our database, sign-in and file storage. | Your workspace records: contacts, messages, call records, notes, files, schedules and billing references. |
| Cloudflare | Network, website hosting, bot protection and, where turned on, sending our emails. | Email addresses, subject and body of emails we send you or your customers, and standard request details such as IP address. |
| TypeSafe | AI checks that sort messages, for example by urgency. | Message text used for those checks. |
| Resend | Email delivery (our backup route for the emails we send). | Email addresses, subject and body of emails we send you or your customers. |
Where lead enrichment or prospecting is turned on, business names and domains are looked up with Treg and Explorium. If you connect your own calendar, accounting or similar account, data goes to that account only because you asked us to.
How long we keep data
| Kind of record | How long |
|---|---|
| Call recordings | 90 days (a legal hold can extend this). You can delete sooner from your workspace. |
| Transcripts | 1 year |
| Messages (texts and emails) | 3 years after the last activity in the conversation |
| Support requests | 2 years |
| Audit log | 2 years |
| Consent and opt-out records | At least 5 years from last use or revocation. An opt-out is kept so we can keep honoring it. |
| Call detail records (numbers, date, time, length, outcome) | 5 years |
| Billing and tax records | 7 years |
| Closed workspace | You can export your data for 30 days after you cancel, as our Terms say. Nothing is erased automatically today; before we erase your customers’ personal records we write to you with the date. Records the law makes us keep stay. |
These are the periods we have set. Automatic deletion is being switched on business by business, so some records can stay longer than shown until it is. Backups and vendor logs roll off on their own cycles. Details are in our Privacy Notice.
How to make a data request
To get a copy of your data, or to have it deleted, email support@gptbusiness.io and say “send me my data” or “delete my data”. You can also text those words to our number.
- First we check it is you: we send a 6-digit code to the same email address or phone number you wrote from. Send it back within 24 hours. We never ask for a password or card number.
- We answer within 45 days. If we need longer, we write before the 45 days end and say why.
- A copy comes as one file with a link that works for 7 days. There is no charge.
- If you are a customer of a business that uses GPT Business, that business owns your records, so your deletion request goes to it for approval. We tell you the result.
- Deletion removes your name, contact details, messages, call records, notes and files. We keep only what the law requires, such as opt-out, billing and call detail records.
Data-processing agreement
If your business needs a data-processing agreement, here is our draft in plain text: data-processing agreement (draft, .txt). It is a draft and is not signed. To sign one, email support@gptbusiness.io.
Security contact
Report a security concern to security@gptbusiness.io. For anything else, contact support@gptbusiness.io.