Circles AI Privacy Notice

Version 2026-11-01.1 · Current service

Fixed version 2026-11-01.1 · Terms of Service · Previous privacy notice

Operator, roles and contact

Events Circle S.A.R.L., Beirut, Lebanon operates Circles AI. We determine the purposes of account registration, authentication, service security, support and our own service-administration records. A business that uploads client records normally determines the purposes of that CRM use; we host or process its shared records on its instructions. Your employer or other business may give you a separate notice. Actual legal responsibilities depend on the processing, not just these labels.

Phone-only records are not automatically uploaded to our cloud, so we may not possess them or be able to retrieve them. For another business's use of your client information, contact that business. For your own account, the account portal provides security, access and deletion/recovery controls. For privacy enquiries, rights requests and support, contact support@circlesai.net. Identify the account or issue without including passwords, recovery keys, API keys or full payment-card information.

Information collected and why

Account information includes your name, email, authentication credentials in protected form, verification/recovery state, device public keys, session details and policy acceptance records. We use it to establish the account, verify access, protect it, deliver requested security messages and document the versions you accepted. Acceptance records include the account, policy versions, time and authentication context; authorized platform administrators can review receipts. Ordinary policy acceptance does not subscribe you to marketing or authorize a payment.

Cloud business information includes memberships, permissions, company/business details and the records or media uploaded to a shared workspace. It is used to provide that shared service and enforce its access boundaries. CRM content can include contact details, company, client interests, notes, meetings, follow-up schedules, message drafts, files, locations, AI history and tasks. You and your business choose the content and are responsible for the notices and authority needed to use it.

Service and security records include request/account/business identifiers, timestamps, device/session status, access changes, usage quantities, estimated or measured provider cost, error/status information and recorded support actions. They support reliability, abuse prevention, access control, accounting and dispute handling. They are not a promise that every infrastructure layer records no request metadata. Our AI usage ledger does not store raw prompts, photos or recordings as usage entries.

Depending on applicable law and our role, account/service processing is used to perform the service you request; security, abuse prevention and administration support legitimate operational interests; legally required records support compliance with legal obligations. Optional consent-based uses require their separate choice and can be withdrawn for future processing. For business-controlled records, the business must determine its appropriate legal basis. If a particular law requires different safeguards or a processing agreement, these general descriptions do not replace them.

Optional website measurement

The public landing page offers a separate choice for Google Analytics. Optional measurement starts only after you choose Allow analytics; Reject optional keeps it off. The tag measures a public page visit and selected app-download, signup-start and plan-view clicks. A click is not treated as a completed account registration or purchase. We do not load this tag on account, recovery, administration or CRM pages, or send your CRM content, chat text, form values, email address or account identifier as analytics fields. Page addresses sent by our integration omit query strings and fragments, and the referrer field is cleared. Google receives network and browser information needed to deliver its service; this is not anonymous processing or a promise that Google receives no IP address.

Your choice is stored on your browser for up to 180 days. When allowed, Analytics cookies are configured for up to 180 days without automatic renewal by this integration. Use Privacy choices in the landing-page footer to change your decision. Withdrawing disables future measurement by this integration and removes its accessible Analytics cookies; it does not recall data already sent to Google. Advertising storage, advertising user data, personalization and Google signals remain disabled. Google Ads campaigns, remarketing and purchase-conversion tracking are not active. No advertising consent is inferred from accepting these policies or using the CRM.

Optional Android app measurement

Android builds with a configured Google Analytics for Firebase connection offer a separate App analytics choice in Settings. Collection is off until you explicitly allow it. When enabled, Google may receive general screen visits, app version, technical device information, a pseudonymous app-instance identifier and an approximate region inferred from network information. Our integration uses a fixed set of general screen labels. It does not attach your Circles account identifier, company or client names, CRM records, conversations, voice recordings, contacts, uploaded files, precise location or API keys. This measurement is not anonymous, and network information needed to provide the service may reach Google.

The choice belongs to this installation, applies when accounts are switched on that installation, and is not copied through CRM backups or business sync. You can withdraw it in App analytics. Withdrawal stops future collection by this integration and requests a reset of analytics data on the device; it does not recall information already received by Google. Advertising ID collection, advertising storage, advertising user data and ad personalization remain disabled. App analytics consent is separate from accepting these policies, website cookies, AI access and Android permissions. The CRM works without optional analytics.

Feature suggestions and optional banner measurement

Circles AI can show small notices about its own features and available plan options. Selection uses the current general page, plan category and company-access role, not private client records, conversations or contact lists. Tapping a notice opens its supported feature or plan page; it does not make a purchase, send a message, start a microphone or grant a feature. Essential delivery records associate your account and app device with a campaign, its version, general placement and timing so we can rotate notices, respect dismissal and limit repetition. These functional records expire after 48 hours. Dismissal preferences last for the configured period of up to 30 days, and an inactive rotation cursor expires after 30 days.

Measuring banner views, clicks, dismissals, feature opens and upgrade-page actions is a separate optional choice, off by default. A banner being delivered is not counted as a view. Measurement requires both the current account/device consent and the installation's local choice. You can turn it off in the app's Feature suggestions settings; withdrawal stops new measurements locally even if you are offline. If saving the server choice fails, the app tells you to reconnect and turn it off again; this confirmation is needed to update the server choice. This choice is separate from Firebase analytics, website cookies and policy acceptance. App reset or reinstall does not automatically restore this permission from a CRM backup.

Authorized platform administrators see consented engagement totals by campaign, version, date, platform and general category. These reports do not identify individual people and do not represent purchases or revenue. Temporary linked event records expire after 48 hours; daily totals without account/device identifiers remain for up to 90 days. Current consent is retained until changed or erased with the account/device. Final account deletion removes linked consent, delivery and preference records while non-identifying aggregate counts can remain until expiry. This feature does not send measurement data to a new advertising network.

Bug reports and feature requests

When you submit a report, you explicitly share its title, category, description, selected reproduction details, replies and any files you choose with Circles AI support. Reports are linked to your signed-in account. They do not automatically include your CRM records, full conversation, contact list or screen recording. You can optionally add limited diagnostics such as app/build version, operating-system version, platform and general device class; this is off by default. It does not include device serial numbers, advertising identifiers, credentials, precise location or raw logs. If you use AI voice drafting, that selected audio and relevant drafting instructions also follow the AI processing described in this notice.

Report text, diagnostic fields, filenames, replies and attached file bodies are encrypted in our service and accessible to authorized support reviewers. They can categorize a report, record internal review notes, update its status and reply in your report history. Attachments use authenticated private downloads. Do not attach passwords, keys, unrelated private conversations or client information you are not authorized to share. An account can retain up to 200 reports, with up to four selected files per report; size and rate limits appear in the reporting tools.

Reports expire at most 180 days after creation. Resolving, declining or closing a report shortens its deadline to at most 90 days from that review; reopening does not extend the existing deadline. Final account deletion removes your support reports and queues their encrypted files for physical cleanup. Removing an attachment makes it unavailable through the report and queues its stored object for cleanup. Limited security/audit records contain action metadata rather than report text. Reports are not published as public reviews or sent as unsolicited messages to your clients.

Local storage and Android permissions

Local CRM records and credentials are encrypted in the app's private storage; media is stored in private app files. This is not end-to-end encryption of shared cloud records. App lock, Android device protection and the optional screenshot setting help control local disclosure but cannot guarantee security on a compromised device.

Contacts are accessed when you choose contact import or linking; optional refresh updates linked records. Microphone access is requested for a voice feature you start. Location access is foreground-only for an action such as saving or sharing your current location; saved coordinates are snapshots, not continuous tracking. Files/images are selected through the supported picker or camera action. Notification, alarm, caller-ID and overlay settings support their selected features. You can change Android permissions in device settings; the associated features may then stop working.

Ordinary phone caller cards match supported incoming telephone information to your CRM. If you enable showing private client information while locked, people looking at your screen may see it before you answer. There is no WhatsApp notification-reading service, private-inbox scraping or secret telephone-call recording. Phone/Samsung/WhatsApp behavior is not guaranteed merely because a permission is available.

Optional AI and selected content

When you use AI, selected instructions, relevant client/business context and chosen photos, documents or audio may be sent to OpenAI. Photos can include text, faces or other information visible in the image; document previews and extracted text may be included when you select a document. Verify that you can share the material. Private account credentials are not intended as prompt content; do not place secrets in ordinary CRM fields.

With a personal API key, requests go from your device and provider charges apply to your OpenAI project. Personal provider keys are scoped locally, encrypted and excluded from portable CRM backups. With provided AI, the Circles AI service processes selected input through its server-held provider key, subject to grants and budgets; the key is not given to your phone. Provided usage records identify the requesting account/business, model, quantities, cost or reservation, status and timing. Generated results may be encrypted and temporarily cached for up to 24 hours for recovery without blindly repeating a paid request. Saved results follow normal CRM storage and backup rules.

OpenAI's API documentation states that API data is not used for model training by default unless the customer opts in. Project configuration, abuse/security retention, endpoint-specific storage and legal exceptions still apply. This is not a claim of universal zero retention or of an approved special retention arrangement. Review the provider's current data controls and your project settings. Deleting a CRM note does not itself delete a provider-side object or records the provider must retain.

Live voice, local wake and synthetic voice

Starting a live AI conversation streams unmuted microphone audio, including audible background sound. Listening and playback can overlap. Mute suppresses outgoing microphone packets; End stops the live call. By default, leaving the app stops live audio. You can separately enable background live calls before starting a call. That choice allows the call to continue while another app is open or the CRM interface is locked, with an ongoing Android microphone notification and Stop control. Android display-over-other-apps permission and a separate optional setting enable a small floating Mute/Stop panel. The panel shows call controls, not client records, and does not unlock the phone. Background calls do not start automatically after reboot or silently restart after a disconnect. Another phone call, revoked access, Android audio restrictions, connectivity or device power management can interrupt a call. Noise/echo suppression depends on the device and does not eliminate all background voices or noise.

Allowing a background call is separate from allowing new local CRM tasks during that call. The background-task setting is off by default. If enabled before the call, instructions heard during that particular call may create or edit supported local records under the current account and business permissions, even while the CRM interface is locked. People audible near your phone could give instructions; this feature does not authenticate the speaker. Mute or end the call when others could overhear or speak to it. This permission does not authorize purchases, account changes, new permissions or automatic external sends. A call can save its conversation without that task permission. Current sessions have a 30-minute or 120-response ceiling, may end earlier when allowance or provider limits apply, and show continuation controls. Continuing starts another metered session after your action and does not replay prior tasks.

Personal-key live calls connect to OpenAI directly. Provided live calls pass through the Circles AI relay. The relay keeps session/usage metadata, not raw PCM or transcript content in its usage ledger. Bounded setup context is encrypted temporarily and removed when the session activates or closes. Transcripts and bounded normalized photo thumbnails are retained with conversation history in encrypted records for the active business. In current app versions, newly selected chat images may also be retained as private Library media so you can reopen a readable original. Their media references follow the active business, authorized synchronization, export and backup controls. Older thumbnail-only messages may have no recoverable original. Temporary execution copies are cleaned separately from retained Library originals. Stored images are not automatically resent to AI just because you view them or reopen the conversation. Tasks already submitted can continue after the conversation ends; use the task's Stop control to cancel them separately.

Local wake listening is a distinct opt-in using downloaded local models and an enrolled voice profile. Android shows an ongoing microphone notification and Stop control. Continuous wake audio is processed locally rather than saved or uploaded as a continuous stream. A captured wake command must pass the local speaker comparison before submission for AI transcription. Enrollment recordings are temporary; the encrypted profile represents voice characteristics and is scoped to the relevant account/business, excluded from portable backups and team synchronization, and removable in Voice settings. It remains locally until removed, scoped reset/account removal or uninstall. A separate enrollment notice/choice is required; acknowledging this Privacy Notice alone does not enroll a voice. Voice matching can fail or be fooled, is not authentication, and does not bypass app lock. There is no automatic microphone restart after reboot. Applicable biometric rules may limit where this optional feature can be offered.

Custom synthetic voice creation is separate: the required consent recording and your own adult voice sample are sent to your eligible OpenAI project after an explicit upload confirmation. Local samples are discarded by the setup/cleanup flow; protected provider voice/consent identifiers remain locally. Provider objects can persist until deleted. Removal requests deletion of the known voice and consent separately; interrupted requests may need review in the provider account. Local reset or uninstall alone does not remove provider-side voice records.

Selected AI-output reports and beta feedback

You can report a selected AI reply inside the app, including when you use local-only or personal-key AI. Before sending, you review the selected text, reason and optional note and explicitly agree to share them. The report does not automatically include the full conversation, attachments or client records. Avoid unrelated confidential information. Selected report content is encrypted in our service, accessible to authorized platform reviewers, and retained for up to 90 days for safety review and abuse handling. Signed-in reports are linked to your account and their selected content is removed during final account deletion. Local-only reports need no account; abuse controls use a protected network-derived identifier. Invalid sign-in credentials do not silently become anonymous submissions.

Beta applications record your verified account/Play email, consent version and dates, application decisions, and release-specific test results. Approved enrollment can require sharing the approved tester email with Google Play or its private tester group. Participation does not grant access to other users' CRM data. Feedback should describe the tested release and problems without client information. Application approval, actual Play enrollment, publication and Google review are separate states. Leaving the program stops future authorized beta access but cannot remotely erase an already downloaded app or undo a Google review.

Shared records, administrators and recipients

Cloudflare provides the website/API and cloud storage infrastructure, including Workers, D1 and private R2. OpenAI processes selected AI input and produces results. Egety E-mail handles transactional verification messages and delivery status, including your address and a short-lived verification code. Google, Microsoft, Meta/WhatsApp and other providers receive the specific credentials, recipients and content involved when you choose their supported sign-in, messaging or sharing features. They also operate under their own applicable terms and privacy policies.

Business administrators can access and manage their shared records, members, permissions and backups. Authorized platform administrators can review cloud records/media, manage access and make recorded support corrections after the applicable security checks. They cannot thereby read phone-only data or recover your personal provider keys. A shared organization may keep its work records after you leave it or delete your account.

Information may be processed outside your country through the operator and these providers. Applicable transfer requirements depend on location and the parties' roles. No particular data-residency region, EEA-only processing, adequacy finding or executed transfer instrument is promised by this notice. We may disclose information when legally required or reasonably necessary to protect rights, investigate abuse or respond to a security incident, subject to applicable law. A change of operator would require appropriate notice and safeguards.

Retention, deletion and backups

Local records remain until you delete them, reset the relevant local scope or uninstall; exported copies remain wherever you saved or shared them. Private job attachments remain while needed to execute or review approved work and are removed through its cleanup controls. Credentials and voice profiles are outside portable CRM backups. Provider-side mail, messages, consent/voice objects and recipients' copies have their own retention rules.

Shared CRM records and backups are controlled by the business until deletion by an authorized administrator, subject to required retention. Deleted cloud objects are inaccessible through normal service access and queued for cleanup; physical cleanup is asynchronous. Information already exported or copied cannot be recalled. Portable encrypted backups require their password. Cloud exports require appropriate administrator access, and unfinished shared changes may prevent a backup-first destructive flow from being represented as a complete restorable snapshot.

An account deletion request starts a 30-day recovery period with a visible final deletion date. Account cloud/AI access pauses; sign-in/recovery, security and cancellation remain available before the displayed 30-day deadline. Scheduling does not immediately erase local phone data. Keep backups is the default. If you opt in, only the reviewed cloud backup snapshots you created and still have authority to delete are eligible at finalization. Other company backups, shared records and external exports remain. If authority changes before finalization, affected snapshots can be retained rather than deleted without authority. Once the displayed deadline passes, cancellation is unavailable even if background cleanup has not yet finished.

Finalization removes or anonymizes account identifiers and credentials and revokes associated access. A private status-only recovery receipt can confirm the exact final deletion to a connected phone so it removes that identity’s saved sign-in, owned caches and credentials. The receipt is stored in the encrypted session, not portable CRM backups. A lost connection or expired login alone never authorizes local erasure; devices that remain offline or lack a valid receipt may need manual local removal. Device-owned default business records and external exports are outside scoped identity removal. Shared business records are not erased merely by the creator's account deletion. Limited security, policy-receipt, transaction/usage and dispute records may remain where needed for an applicable obligation or a legitimate, proportionate purpose; access is restricted. Service-accounting records with removed account contact details and historical identifiers can remain; this is not a guarantee that every retained reference is irreversibly anonymous. Retention depends on the record's purpose, legal requirements and operational cleanup; no unsupported universal deletion deadline is promised. Pending signup verification and delivery secrets expire and are removed by scheduled cleanup; they are not a permanent copy of your password or code.

Your choices and rights

You can review/edit personal CRM records, choose AI/provider connections, revoke device access, change permissions, stop voice, remove local voice profiles and use authorized export or deletion controls. A business controls its own shared records; contact that business about its use of your information. Signing out, uninstalling, local reset and online account deletion have different scopes.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, withdraw consent for future consent-based processing, and complain to a competent data-protection authority. Rights can have lawful limits, including another person's rights or required records. We may need proportionate identity verification. Where GDPR applies, a rights request normally receives a response within one month, with permitted extensions explained. A request to exercise statutory rights is not limited to the ordinary 30-day account-recovery product flow.

The service is intended for adults, not children. Do not submit a child's voice for enrollment or synthetic voice creation. AI suggestions do not replace human review of consequential decisions. We do not present the service as a certified system for employment, credit, medical or other regulated automated decisions.

Updates and current billing boundary

Material policy changes are presented with the current version and may require review before cloud use resumes. Accepting updated policies does not automatically restart interrupted tasks or grant new device permissions. Marketing is a separate optional choice.

Only Free can currently be selected. Planned subscriptions offer monthly or annual billing; annual plans receive included AI Circles monthly rather than all at once. Standalone AI credit packs are no longer offered, while existing legitimately granted balances keep their recorded expiry rules. Paid checkout remains inactive until its provider is configured and tested. A future verified subscription retains its original billing provider for management, cancellation and supported plan changes. Google Play or the website payment processor handles its own billing records and any approved upgrade adjustment; displayed previews do not create a payment obligation. Personal-key provider charges are separate. Current balances, provided usage and any reserved estimates must be read in their actual account/business scope. A previewed allowance is not a purchased balance. See Billing & refunds for the current facts and separate commercial review documents.