Privacy notice

This notice describes the BayBack Phase 1 pilot candidate. It is a product-operating draft, not a substitute for counsel review before launch.

What BayBack handles

For pilot requests, BayBack stores the contact name, shop name, work email, and shop phone submitted by the requester. For activated shops, BayBack stores tenant and staff account details, caller phone numbers, timestamps, message content, notes, workflow status, opt-out records, and staff-entered recovered-job values.

Why it is used

Data is used to route missed calls, send the shop-approved transactional acknowledgment, organize human callbacks, honor suppression requests, measure confirmed outcomes, secure accounts, and maintain an operational audit trail. It is not sold. The Phase 1 product is not designed for promotional campaigns.

Service providers

A production deployment may use Twilio for telephony and messaging and an approved hosting/database provider. Each provider processes only the data needed for its service under its own terms. A shop remains responsible for its own customer notices and lawful call-routing and messaging configuration.

Retention and deletion

The launch target is to purge raw caller numbers from closed leads after 30 days unless a documented business or legal need requires a different period, retain suppression identifiers as needed to honor opt-outs, and retain aggregate non-identifying metrics longer. The included code does not yet automate that purge; this is a launch-blocking operations item documented in the risk register.

Security and choices

Access is tenant-scoped and protected with signed, HTTP-only session cookies. Webhooks are signature-validated. Callers can reply STOP to suppress future recovery messages for that shop. Pilot participants may request access, correction, or deletion through the contact method stated in their executed pilot agreement.

California notice

Before commercial launch in California, the operator must publish verified business contact details, finalize CCPA/CPRA role analysis and request handling, and obtain counsel review of the call/SMS workflow. BayBack does not claim that this draft alone creates compliance.