Skip to content
EN
Start on the web

CallbyMi Privacy Policy

Updated October 30, 2026

1. Overview

Foo AI Corp. ("we") processes the personal information of people who use the CallbyMi app and website (callbymi.com) as this policy describes.

CallbyMi is a service in which an AI assistant calls you inside the app at times you schedule, about your plans, birthdays, medication reminders, subscription renewals and more.

In short:

  • We do not record calls. We do not store call audio or the full conversation; we store only a call summary.
  • When a call starts, the AI assistant says in its first sentence that it is an AI.
  • Memories from a call are used in later calls only after you approve them.
  • We do not use your calls to train AI models.
  • We do not sell personal information or use it for advertising.

2. Purposes

We process personal information only to:

  • create and manage your account and sign-in, and confirm that you are at least 14
  • call you in the app at the times you schedule, tell you about your plans during the call, and carry out your requests (call back later, move an event, add a task and similar)
  • provide call summaries and memories, and draft plans and calls with the AI assistant
  • show events from the Google Calendar and device calendars you connect
  • provide the paid subscription, count usage limits and keep transaction records for withdrawals and refunds
  • find errors, keep the service secure, prevent abuse, produce service-improvement statistics and answer support requests
  • send news about the service only if you separately agree to marketing messages

3. What we process

We process the following. A guest account can use the calendar, drafts and the text assistant only, and cannot receive calls.

  • Account: user ID, sign-in method (Apple, Google, email), email address, the name your sign-in provider sends, the password of an email sign-in (stored only in hashed form)
  • Age check: year of birth (used only to confirm you are at least 14 and not stored; only the result is stored)
  • Settings: language, time zone, quiet hours, daily call limit, AI voice
  • Schedules and call plans: event titles, notes, times and repeats, birthdays (names), medication reminders (display label and time), subscriptions (billing date, amount, cancellation deadline), when to call and what to talk about
  • Connected calendars: a read-only Google Calendar access token (stored encrypted) and copies of the events read, copies of device calendar events that have a call plan
  • Calls: call attempt records (times, answer and end reason, talk time, device), call summaries (what was delivered and your answers), approved memories, records of requested changes
  • Processed only in real time during a call: call audio and the text of what is said (discarded after the summary is made)
  • AI assistant: what you type or say to it and the drafts the AI makes
  • Device: device type, app version, push tokens (iOS VoIP, Android FCM), results of the call-readiness check, device ID (iOS identifierForVendor, Android ID — we keep only a value transformed with a server secret so it cannot be recovered, and use it only to prevent repeat free trial calls and repeated account creation on the same phone)
  • Subscription: subscription status, store purchase details (product, transaction ID, period). We do not receive card numbers or other payment details
  • Usage: talk time and usage-limit records
  • Usage records: internal events about which features you used and when (for service-improvement statistics)
  • Consents: what you agreed to, the document version, time and withdrawal time
  • Generated automatically: error and crash reports, server and website access logs (IP address, browser details, time)
  • Support: the address and content of support emails
  • Call reports: the call you reported, the reason and anything you wrote

4. How call audio and conversations are processed

Call audio travels in real time between the app and the call server and is processed during the call by the speech recognition, AI conversation and speech synthesis processors. We do not record calls or store audio files.

The text of what is said during a call is used only for the AI's replies and the call summary, and is discarded right after the summary is made. We store the summary, the items delivered, your answers (for example "taken") and the results of your requests.

The AI assistant may propose a few lasting preferences or facts from a call. It does not propose sensitive information, and only memories you approve are used in later calls. You can withdraw the approval of a memory or delete it at any time.

How long each processor keeps audio and text is stated in section 10. Where we could not confirm a processor's retention, this policy does not state one.

5. Sensitive information (medication reminders)

Medicine names and whether you took a medicine may be health information. We ask for separate consent before your first medication reminder; if you decline, you can still use the other features.

Calls for sensitive purposes such as medication show a generic label such as "CallbyMi · Reminder call" in notifications, the incoming call screen and the lock screen. This also applies to any call about a medication reminder, whatever the call's purpose.

6. Retention

We delete personal information without delay once its purpose is met. Retention by item:

  • Account details: until you delete the account
  • Schedules, call plans and their results: until you delete them or the account
  • Copies of Google Calendar events and the connection token: until you disconnect or delete the account (disconnecting revokes the token and deletes the copies)
  • Server copies of device calendar events: while a call plan is attached; deleted within 1 days after the plan is gone
  • Call audio: not stored (processed in real time during the call)
  • Full call transcript: not stored (discarded as soon as the summary is made)
  • Call summaries: until you delete them or the account
  • Memories: until you delete them or the account (a memory whose approval you withdraw is not used in calls)
  • Call attempt records (times, end reason, talk time): 90 days
  • Call usage records: 5 years (supply records under the Korean E-Commerce Act); after an account deletion they are unlinked from you and kept apart
  • Service usage records (feature events): 400 days
  • Call reports (the reason and anything you wrote): 30 days; deleted at once when you delete your account
  • Device details and push tokens: until you remove the device or delete the account
  • Identifier of the phone that received the free trial call (device ID and push token, transformed so they cannot be recovered): 365 days after the trial call (to prevent repeat trial calls on the same phone). If you delete the account, the link to it is removed and the record is kept until then
  • Consent records: until you delete the account
  • Subscription status: until you delete the account (the app store and RevenueCat also keep their own payment records)
  • Subscription transaction records (product, transaction ID, price; no call content): 5 years from the transaction (payment records under the Korean E-Commerce Act); after an account deletion they are unlinked from you and kept apart
  • Guest accounts: until upgraded to a full account or deleted; deleted after 365 days without use
  • Support email: 3 years after the matter is closed (complaint and dispute records under the Korean E-Commerce Act)
  • Server access logs and abuse-prevention counters (IP addresses only as a keyed hash): at most 7 days
  • Database backups: at most 7 days
  • Error and crash reports: at most 90 days
  • Account emails sent: at most 30 days
  • Website access logs: at most 1 days
  • Call alert messages: until the ring deadline (at most 5 minutes)

7. Deletion and account deletion

When you delete your account in the app settings, we immediately erase the content of your call summaries, memories, schedules and request records, cancel scheduled calls, and delete the account and all remaining data within 30 days. The app shows "completely deleted" only after the deletion job has finished. Uninstalling the app does not delete the account.

Electronic files are deleted so that they cannot be restored, and copies in backups disappear when the backup period ends. Records a law requires us to keep are kept apart from other data and only for that period.

8. Disclosure to third parties

We do not provide personal information to third parties, except where a law specifically requires it or an investigative authority requests it under the procedure a law sets.

Apple sign-in, Google sign-in and Google Calendar, which you connect yourself, are handled by those companies under their own policies (Apple www.apple.com/legal/privacy, Google policies.google.com/privacy). We only read your Google Calendar and never change it.

9. Processors

Of the companies below, only one speech recognition company is used per call, depending on the call language. We manage contracts and settings so that processors do not use call data to train their own AI models.

We use the following companies to provide the service. Our contracts with them (data processing addenda) forbid processing for other purposes and require security measures, limits on sub-processing and liability for damage.

  • Supabase Pte. Ltd.: runs the service database, sign-in and server functions (the US East (Northern Virginia) region)
  • LiveKit Incorporated: connects in-app voice calls and runs the AI voice agent
  • Anthropic, PBC: generates the AI conversation during calls, call summaries and the text AI assistant
  • OpenAI OpCo, LLC: voice conversation engine comparison for English calls (only some calls)
  • Eleven Labs Inc.: turns the AI replies into speech (speech synthesis)
  • AssemblyAI, Inc.: real-time speech recognition for English, Korean, Spanish calls
  • Soniox Inc.: real-time speech recognition for Japanese, Chinese (Simplified) calls
  • Google LLC: delivers call alerts and notifications to Android devices (Firebase Cloud Messaging)
  • Apple Inc.: delivers call alerts and notifications to iPhones (Apple Push Notification service)
  • Functional Software, Inc. (Sentry): analyses errors and crashes of the app, the website and the server
  • Plus Five Five, Inc. (Resend): sends account emails such as the sign-up confirmation
  • RevenueCat, Inc.: manages in-app subscription status
  • Vercel Inc.: hosts the website

10. International transfers

If you do not want the transfers below, you can choose not to sign up or delete your account. Because the transfer is necessary to provide the service, the service cannot be used without it.

To perform our contract with you, we have the following processors process and store personal information outside Korea. Service data is stored in the US East (Northern Virginia) region.

  • Supabase Pte. Ltd. (contact: privacy@supabase.com) — country: United States · data: account details, schedules and call plans, call summaries, memories, call records, usage, device details, consent records · purpose: runs the service database, sign-in and server functions (the US East (Northern Virginia) region) · retention: until the processing contract ends or the periods in this policy end (backups at most 7 days) · when and how: each time you use the service, over an encrypted connection (TLS)
  • LiveKit Incorporated (contact: privacy@livekit.io) — country: United States · data: call audio (real time), call room details, the schedule, plan and approved memories the call needs · purpose: connects in-app voice calls and runs the AI voice agent · retention: processed in real time during the call; call recording is not used · when and how: each time you use the service, over an encrypted connection (TLS)
  • Anthropic, PBC (contact: privacy@anthropic.com) — country: United States · data: text of what is said during the call, the schedule, plan and approved memories the call needs, text you type to the AI assistant · purpose: generates the AI conversation during calls, call summaries and the text AI assistant · retention: deleted within 30 days of receipt (content flagged for a usage-policy review may be kept longer); not used to train models · when and how: each time you use the service, over an encrypted connection (TLS)
  • OpenAI OpCo, LLC (contact: contract-notices@openai.com) — country: United States · data: audio of the calls in the comparison (real time) and the schedule, plan and approved memories the call needs · purpose: voice conversation engine comparison for English calls (only some calls) · retention: abuse-monitoring logs up to 30 days; not used to train models · when and how: each time you use the service, over an encrypted connection (TLS)
  • Eleven Labs Inc. (contact: dpo@elevenlabs.io) — country: United States · data: text of the sentences the AI will say · purpose: turns the AI replies into speech (speech synthesis) · retention: after synthesis, under the processor's policy · when and how: each time you use the service, over an encrypted connection (TLS)
  • AssemblyAI, Inc. (contact: legal@assemblyai.com) — country: United States · data: call audio (real time) · purpose: real-time speech recognition for English, Korean, Spanish calls · retention: after recognition, under the processor's policy · when and how: each time you use the service, over an encrypted connection (TLS)
  • Soniox Inc. (contact: support@soniox.com) — country: United States · data: call audio (real time) · purpose: real-time speech recognition for Japanese, Chinese (Simplified) calls · retention: processed in real time and not stored; not used to train models · when and how: each time you use the service, over an encrypted connection (TLS)
  • Google LLC (contact: firebase.google.com/support/privacy/dpo) — country: United States · data: push token, notification content (call identifier, display name — a generic label for sensitive purposes such as medication) · purpose: delivers call alerts and notifications to Android devices (Firebase Cloud Messaging) · retention: a call alert only until its ring deadline (at most 5 minutes) · when and how: each time you use the service, over an encrypted connection (TLS)
  • Apple Inc. (contact: www.apple.com/legal/privacy/contact) — country: United States · data: VoIP push token, notification content (call identifier, display name — a generic label for sensitive purposes such as medication) · purpose: delivers call alerts and notifications to iPhones (Apple Push Notification service) · retention: a call alert only until its ring deadline (at most 5 minutes) · when and how: each time you use the service, over an encrypted connection (TLS)
  • Functional Software, Inc. (Sentry) (contact: compliance@sentry.io) — country: United States · data: error details, app version, device model and OS version · purpose: analyses errors and crashes of the app, the website and the server · retention: at most 90 days · when and how: each time you use the service, over an encrypted connection (TLS)
  • Plus Five Five, Inc. (Resend) (contact: privacy@resend.com) — country: United States · data: email address, email content · purpose: sends account emails such as the sign-up confirmation · retention: at most 30 days · when and how: each time you use the service, over an encrypted connection (TLS)
  • RevenueCat, Inc. (contact: compliance@revenuecat.com) — country: United States · data: user ID, store purchase details (product, transaction ID, period, price, currency) · purpose: manages in-app subscription status · retention: until the processing contract ends or the periods in this policy end · when and how: each time you use the service, over an encrypted connection (TLS)
  • Vercel Inc. (contact: privacy@vercel.com) — country: United States · data: website access logs (IP address, browser details, requested path) · purpose: hosts the website · retention: at most 1 days · when and how: each time you use the service, over an encrypted connection (TLS)

11. Your rights

You may at any time ask to access, correct or delete your personal information, to stop its processing, or withdraw a consent.

You can manage call summaries, memories, schedules, consents and account deletion yourself in the app settings; for anything else, write to contact@callbymi.com. We answer within 10 days of receiving the request. You may also act through a representative.

You can withdraw consent to marketing messages at any time in the app settings. We make no automated decisions with legal or similarly significant effects.

12. Children

CallbyMi is only for people aged 14 or older. We check this with your year of birth at sign-up and do not collect personal information of children under 14. If we learn that we have, we delete it at once.

13. Cookies and similar technologies

The website uses no analytics or advertising cookies. The app does not use the advertising identifier and contains no advertising or tracking tools. We analyse use of the service only with usage records on our own server.

14. Security

We have adopted an internal management plan and take these measures:

  • Every transfer uses an encrypted connection (TLS).
  • The database is encrypted at rest, and row-level access control lets each user read only their own data.
  • Google Calendar access tokens are encrypted again with a separate key.
  • Server secrets are kept only in server secret stores, never in the app or the website.
  • Few people handle personal information, and access is logged and reviewed.

15. Regional information

CallbyMi is not offered in the European Economic Area (the 27 EU countries, Iceland, Norway and Liechtenstein), the United Kingdom and mainland China.

Wherever you live, you can exercise the rights in this policy in the same way, and where the law of your place of residence gives you more rights, we follow it. Information of users living in Japan is entrusted to the processors above; through our contracts with them we maintain protective measures at the level the Japanese Act on the Protection of Personal Information requires, and we provide information about those measures on request.

16. Privacy officer and contact

  • Privacy officer: JEEHO SONG (CEO)
  • Contact: contact@callbymi.com, +82-2-581-3001
  • Access requests are received and handled by the privacy officer

17. Remedies

For a report or advice about an infringement of personal information, you can contact:

18. Changes

This policy is published on 2026-10-30 and takes effect the same day (version privacy.v1). When we change it we publish the new text on the website, and we tell you separately in the app or by email about changes that are adverse to you or important.