Circles AI Privacy Notice

Version 2026-10-31.1 · Current service

Fixed version 2026-10-31.1 · Terms of Service

Operator, roles and contact

Events Circle S.A.R.L., Beirut, Lebanon operates Circles AI. We determine the purposes of account registration, authentication, service security, support and our own service-administration records. A business that uploads client records normally determines the purposes of that CRM use; we host or process its shared records on its instructions. Your employer or other business may give you a separate notice. Actual legal responsibilities depend on the processing, not just these labels.

Phone-only records are not automatically uploaded to our cloud, so we may not possess them or be able to retrieve them. For another business's use of your client information, contact that business. For your own account, the account portal provides security, access and deletion/recovery controls. For privacy enquiries, rights requests and support, contact support@circlesai.net. Identify the account or issue without including passwords, recovery keys, API keys or full payment-card information.

Information collected and why

Account information includes your name, email, authentication credentials in protected form, verification/recovery state, device public keys, session details and policy acceptance records. We use it to establish the account, verify access, protect it, deliver requested security messages and document the versions you accepted. Acceptance records include the account, policy versions, time and authentication context; authorized platform administrators can review receipts. Ordinary policy acceptance does not subscribe you to marketing or authorize a payment.

Cloud business information includes memberships, permissions, company/business details and the records or media uploaded to a shared workspace. It is used to provide that shared service and enforce its access boundaries. CRM content can include contact details, company, client interests, notes, meetings, follow-up schedules, message drafts, files, locations, AI history and tasks. You and your business choose the content and are responsible for the notices and authority needed to use it.

Service and security records include request/account/business identifiers, timestamps, device/session status, access changes, usage quantities, estimated or measured provider cost, error/status information and recorded support actions. They support reliability, abuse prevention, access control, accounting and dispute handling. They are not a promise that every infrastructure layer records no request metadata. Our AI usage ledger does not store raw prompts, photos or recordings as usage entries.

Depending on applicable law and our role, account/service processing is used to perform the service you request; security, abuse prevention and administration support legitimate operational interests; legally required records support compliance with legal obligations. Optional consent-based uses require their separate choice and can be withdrawn for future processing. For business-controlled records, the business must determine its appropriate legal basis. If a particular law requires different safeguards or a processing agreement, these general descriptions do not replace them.

Local storage and Android permissions

Local CRM records and credentials are encrypted in the app's private storage; media is stored in private app files. This is not end-to-end encryption of shared cloud records. App lock, Android device protection and the optional screenshot setting help control local disclosure but cannot guarantee security on a compromised device.

Contacts are accessed when you choose contact import or linking; optional refresh updates linked records. Microphone access is requested for a voice feature you start. Location access is foreground-only for an action such as saving or sharing your current location; saved coordinates are snapshots, not continuous tracking. Files/images are selected through the supported picker or camera action. Notification, alarm, caller-ID and overlay settings support their selected features. You can change Android permissions in device settings; the associated features may then stop working.

Ordinary phone caller cards match supported incoming telephone information to your CRM. If you enable showing private client information while locked, people looking at your screen may see it before you answer. There is no WhatsApp notification-reading service, private-inbox scraping or secret telephone-call recording. Phone/Samsung/WhatsApp behavior is not guaranteed merely because a permission is available.

Optional AI and selected content

When you use AI, selected instructions, relevant client/business context and chosen photos, documents or audio may be sent to OpenAI. Photos can include text, faces or other information visible in the image; document previews and extracted text may be included when you select a document. Verify that you can share the material. Private account credentials are not intended as prompt content; do not place secrets in ordinary CRM fields.

With a personal API key, requests go from your device and provider charges apply to your OpenAI project. Personal provider keys are scoped locally, encrypted and excluded from portable CRM backups. With provided AI, the Circles AI service processes selected input through its server-held provider key, subject to grants and budgets; the key is not given to your phone. Provided usage records identify the requesting account/business, model, quantities, cost or reservation, status and timing. Generated results may be encrypted and temporarily cached for up to 24 hours for recovery without blindly repeating a paid request. Saved results follow normal CRM storage and backup rules.

OpenAI's API documentation states that API data is not used for model training by default unless the customer opts in. Project configuration, abuse/security retention, endpoint-specific storage and legal exceptions still apply. This is not a claim of universal zero retention or of an approved special retention arrangement. Review the provider's current data controls and your project settings. Deleting a CRM note does not itself delete a provider-side object or records the provider must retain.

Live voice, local wake and synthetic voice

Starting a live AI conversation streams unmuted microphone audio, including audible background sound, during the foreground session. Listening and playback can overlap. Mute suppresses outgoing microphone packets; End or leaving the foreground stops live audio. Another phone call or Android audio restriction can interrupt it. Noise/echo suppression depends on the device and does not eliminate all background voices or noise.

Personal-key live calls connect to OpenAI directly. Provided live calls pass through the Circles AI relay. The relay keeps session/usage metadata, not raw PCM or transcript content in its usage ledger. Bounded setup context is encrypted temporarily and removed when the session activates or closes. Transcripts and bounded normalized photo thumbnails are retained with conversation history in encrypted records for the active business. Full selected images remain in scoped private task attachments while needed for execution, then follow task cleanup. Thumbnails do not enter the Library or get automatically sent as context for a later AI request. They follow its local/cloud and backup controls. Tasks already submitted can continue after the conversation ends; use the task's Stop control to cancel them separately.

Local wake listening is a distinct opt-in using downloaded local models and an enrolled voice profile. Android shows an ongoing microphone notification and Stop control. Continuous wake audio is processed locally rather than saved or uploaded as a continuous stream. A captured wake command must pass the local speaker comparison before submission for AI transcription. Enrollment recordings are temporary; the encrypted profile represents voice characteristics and is scoped to the relevant account/business, excluded from portable backups and team synchronization, and removable in Voice settings. It remains locally until removed, scoped reset/account removal or uninstall. A separate enrollment notice/choice is required; acknowledging this Privacy Notice alone does not enroll a voice. Voice matching can fail or be fooled, is not authentication, and does not bypass app lock. There is no automatic microphone restart after reboot. Applicable biometric rules may limit where this optional feature can be offered.

Custom synthetic voice creation is separate: the required consent recording and your own adult voice sample are sent to your eligible OpenAI project after an explicit upload confirmation. Local samples are discarded by the setup/cleanup flow; protected provider voice/consent identifiers remain locally. Provider objects can persist until deleted. Removal requests deletion of the known voice and consent separately; interrupted requests may need review in the provider account. Local reset or uninstall alone does not remove provider-side voice records.

Shared records, administrators and recipients

Cloudflare provides the website/API and cloud storage infrastructure, including Workers, D1 and private R2. OpenAI processes selected AI input and produces results. Egety E-mail handles transactional verification messages and delivery status, including your address and a short-lived verification code. Google, Microsoft, Meta/WhatsApp and other providers receive the specific credentials, recipients and content involved when you choose their supported sign-in, messaging or sharing features. They also operate under their own applicable terms and privacy policies.

Business administrators can access and manage their shared records, members, permissions and backups. Authorized platform administrators can review cloud records/media, manage access and make recorded support corrections after the applicable security checks. They cannot thereby read phone-only data or recover your personal provider keys. A shared organization may keep its work records after you leave it or delete your account.

Information may be processed outside your country through the operator and these providers. Applicable transfer requirements depend on location and the parties' roles. No particular data-residency region, EEA-only processing, adequacy finding or executed transfer instrument is promised by this notice. We may disclose information when legally required or reasonably necessary to protect rights, investigate abuse or respond to a security incident, subject to applicable law. A change of operator would require appropriate notice and safeguards.

Retention, deletion and backups

Local records remain until you delete them, reset the relevant local scope or uninstall; exported copies remain wherever you saved or shared them. Private job attachments remain while needed to execute or review approved work and are removed through its cleanup controls. Credentials and voice profiles are outside portable CRM backups. Provider-side mail, messages, consent/voice objects and recipients' copies have their own retention rules.

Shared CRM records and backups are controlled by the business until deletion by an authorized administrator, subject to required retention. Deleted cloud objects are inaccessible through normal service access and queued for cleanup; physical cleanup is asynchronous. Information already exported or copied cannot be recalled. Portable encrypted backups require their password. Cloud exports require appropriate administrator access, and unfinished shared changes may prevent a backup-first destructive flow from being represented as a complete restorable snapshot.

An account deletion request starts a 30-day recovery period with a visible final deletion date. Account cloud/AI access pauses; sign-in/recovery, security and cancellation remain available before the displayed 30-day deadline. Scheduling does not immediately erase local phone data. Keep backups is the default. If you opt in, only the reviewed cloud backup snapshots you created and still have authority to delete are eligible at finalization. Other company backups, shared records and external exports remain. If authority changes before finalization, affected snapshots can be retained rather than deleted without authority. Once the displayed deadline passes, cancellation is unavailable even if background cleanup has not yet finished.

Finalization removes or anonymizes account identifiers and credentials and revokes associated access. A private status-only recovery receipt can confirm the exact final deletion to a connected phone so it removes that identity’s saved sign-in, owned caches and credentials. The receipt is stored in the encrypted session, not portable CRM backups. A lost connection or expired login alone never authorizes local erasure; devices that remain offline or lack a valid receipt may need manual local removal. Device-owned default business records and external exports are outside scoped identity removal. Shared business records are not erased merely by the creator's account deletion. Limited security, policy-receipt, transaction/usage and dispute records may remain where needed for an applicable obligation or a legitimate, proportionate purpose; access is restricted. Service-accounting records with removed account contact details and historical identifiers can remain; this is not a guarantee that every retained reference is irreversibly anonymous. Retention depends on the record's purpose, legal requirements and operational cleanup; no unsupported universal deletion deadline is promised. Pending signup verification and delivery secrets expire and are removed by scheduled cleanup; they are not a permanent copy of your password or code.

Your choices and rights

You can review/edit personal CRM records, choose AI/provider connections, revoke device access, change permissions, stop voice, remove local voice profiles and use authorized export or deletion controls. A business controls its own shared records; contact that business about its use of your information. Signing out, uninstalling, local reset and online account deletion have different scopes.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, withdraw consent for future consent-based processing, and complain to a competent data-protection authority. Rights can have lawful limits, including another person's rights or required records. We may need proportionate identity verification. Where GDPR applies, a rights request normally receives a response within one month, with permitted extensions explained. A request to exercise statutory rights is not limited to the ordinary 30-day account-recovery product flow.

The service is intended for adults, not children. Do not submit a child's voice for enrollment or synthetic voice creation. AI suggestions do not replace human review of consequential decisions. We do not present the service as a certified system for employment, credit, medical or other regulated automated decisions.

Updates and current billing boundary

Material policy changes are presented with the current version and may require review before cloud use resumes. Accepting updated policies does not automatically restart interrupted tasks or grant new device permissions. Marketing is a separate optional choice.

Only Free can currently be selected. Paid subscriptions, seats and prepaid AI packs are inactive; no payment-card checkout is active. Personal-key provider charges are separate. Current balances, provided usage and any reserved estimates must be read in their actual account/business scope. A previewed allowance is not a purchased balance. See Billing & refunds for the current facts and separate commercial review documents.