Privacy Policy

Callistox (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, download the CAL desktop application, or use our AI-powered services, software, and related platforms (collectively, the “Service”).

This policy is designed to comply with global data protection regulations, including the General Data Protection Regulation (GDPR) in the EEA, the UK GDPR, United States privacy laws (including CCPA/CPRA, COPPA, and CalOPPA), and the Personal Data Protection Laws of the Gulf Cooperation Council (GCC) countries, including the Kingdom of Saudi Arabia (KSA PDPL) and the United Arab Emirates (UAE PDPL).

1Information We Collect

We collect information that identifies, relates to, or could reasonably be linked to you (“Personal Information”) in the following categories:

• Account & Profile Information: Name, email address, encrypted password, and subscription tier.
• Payment & Billing Information: Handled securely by our third-party payment processors (e.g., Paddle, Stripe). We do not store full credit card numbers on our servers.
• Device Permissions & Usage Data: To function as a system-level AI assistant, CAL requires specific local permissions:
  • Microphone Access: For voice commands. Audio is temporarily processed for speech-to-text conversion and is never permanently stored on our servers.
  • Screen Awareness (Screen Capture): When enabled, CAL captures temporary visual context to answer specific queries. This data is processed in real-time, immediately discarded, and never stored on our servers.
  • Local File Access: When you ask CAL to analyze a file, the processing occurs locally or via anonymized API calls.
  • Local AI Memory (Lore): Facts you ask CAL to remember are stored strictly locally on your device’s hard drive. We do not upload this to a cloud database.
• Technical Data: IP address, operating system, application version, crash logs, and diagnostic data to ensure Service stability.

2Third-Party Integrations & Connected Apps

CAL allows you to connect external services (e.g., Gmail, WhatsApp, Smart Home IoT devices) to automate tasks.

• Authentication: We use secure protocols (like OAuth) to connect these services. Your login credentials for third-party services are encrypted and stored locally on your device.
• Third-Party Policies: When CAL interacts with these platforms on your behalf, the data processed through them is subject to the respective privacy policies of those third parties (e.g., Google, Meta). We are not responsible for the privacy practices of connected third-party services.

3How We Process AI Data (Our Privacy Promise)

As a privacy-first AI platform, we adhere to strict “Privacy by Design” architecture:

• De-identification: When a prompt requires processing by cloud-based Large Language Models (LLMs), your request is routed through our servers where account identifiers (like your name or email) are stripped. The AI provider processes the query anonymously and forgets it immediately.
• No Training on User Data: We strictly prohibit the use of your personal prompts, screen data, or private files to train our foundational or third-party AI models.
• Incognito Mode: If you activate Incognito Mode, the Service suspends local memory logging, and your temporary session data is wiped immediately upon closing.

4How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain the CAL Service.
• Process transactions and send related billing information.
• Provide customer support and technical troubleshooting.
• Comply with legal obligations, prevent fraud, and enforce our Terms of Service.

5Cookies and Tracking Technologies

Our website uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyze website traffic, and manage sessions.

• Essential Cookies: Required for basic site functionality and user authentication.
• Analytics Cookies: Help us understand how visitors interact with the website (e.g., Google Analytics).
• Manage Preferences: You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

6How We Share Your Information

We do not sell or rent your Personal Information. We may share data only under these circumstances:

• Service Providers: We share necessary data with trusted vendors (cloud hosting, payment gateways, anonymized AI model APIs) bound by strict confidentiality agreements.
• Legal Compliance & Safety: We may disclose information if legally required by valid requests from public authorities, or to protect the rights, property, and safety of Callistox, our users, or the public.

7Regional Privacy Rights & Disclosures

A. European Economic Area (EEA) & United Kingdom (GDPR / UK GDPR)

Callistox acts as the Data Controller. Our legal bases for processing include contract performance, consent, and legitimate interests.

Your Rights: You have the right to access, rectify, or erase your Personal Data (Right to be Forgotten). You may also restrict or object to processing, and request data portability. Contact us at support@callistox.net to exercise these rights.

B. United States (CCPA / CPRA & State Laws)

• No Sale of Data: We have not sold and will not sell your Personal Information.
• Do Not Track (DNT): We honor Do Not Track signals and Global Privacy Control (GPC) settings sent by your browser.
• Your Rights: California and other applicable state residents have the right to know what personal information is collected, request deletion, and the right to non-discrimination for exercising privacy rights.

C. Gulf Cooperation Council (GCC – UAE, KSA, etc.)

Processing is conducted in compliance with local data protection laws (e.g., UAE Federal Decree-Law No. 45 of 2021, KSA PDPL).

• Data Rights: You possess the right to be informed, access your data, request destruction (erasure), and withdraw consent at any time.

8International Data Transfers

Your data may be transferred to, and processed in, countries outside your jurisdiction. When transferring personal data originating from the EEA, UK, or GCC to other countries, we ensure robust protection by implementing approved safeguards, such as Standard Contractual Clauses (SCCs).

9Data Security & Breach Notification

We implement military-grade encryption (in transit and at rest), strict access controls, and regular security audits to protect your data. In the unlikely event of a data breach that compromises your Personal Information, we will notify you and the relevant regulatory authorities within the legally mandated timeframes (e.g., within 72 hours under GDPR).

10Children’s Privacy (CAL Kids)

We offer the “CAL Kids” module specifically designed for minors (under 13, 14, or 18 depending on jurisdiction). We comply strictly with the Children’s Online Privacy Protection Act (COPPA) and similar global laws.

• Parental Consent & Dashboard: We require verifiable parental consent. Parents use a secure dashboard to monitor safety alerts and control screen-time settings.
• No Profiling: Data collected via CAL Kids is used solely for immediate safety filtering and providing an educational experience. We do not build marketing profiles on children. Parents can request full deletion of their child’s data at any time.

11Changes to This Privacy Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you via email or a prominent notice within the CAL application prior to the changes taking effect.

12Contact Us

If you have any questions, concerns, or requests to exercise your privacy rights, please contact our Data Protection Officer at:

Looking for how Personal Cloud is designed? See Privacy & Personal Cloud.