Privacy Policy
Privacy Policy
Effective: 19 October 2026
1. Introduction
Mirat Aubakirov (“Advicey”, “we”, “us”) runs Advicey, a real-time sales assistant, from Kazakhstan. Its desktop apps for macOS and Windows turn your sales calls into text as they happen and suggest what to say. Its web app at app.advicey.io is where you prepare calls, review them and manage your account. This policy covers the desktop apps, the web app and our website advicey.io. It explains what personal data we collect, why, who receives it, how long we keep it and the choices you have.
We decide how your account, usage and diagnostic data are used. For call content, the customer decides: the company you work for, or you for a personal account. We process call content on that customer’s behalf under the Data Processing Terms in section 21 of our Terms of Service.
Questions about this policy: info@advicey.io.
2. Information we collect
2.1 Information you give us
Account: your name, email address and company name, and a password, which we store only as a bcrypt hash. If you sign in with Google, we receive your name and email address from Google instead.
Company and sales content: your company description, products and audience, knowledge base articles, sales methodology files, and pages from your company’s website that you ask us to import.
Call details: contact and company names, notes, comments, call plans and the CRM contact you pick for a call.
Buyer details you add to a deal: a website address, an email or notes you paste, a document, or a link to the person’s LinkedIn profile. We read websites, emails, notes and documents, keep a few short facts about the person and their company (such as their role, background and what their company does) with where each came from, and delete the file and its text once read. When a deal’s contact has a work email or a company website, we read a few pages of that company’s public website for you. We keep a LinkedIn link so you can open it, and look the person up with People Data Labs (section 2.4); we never sign in to LinkedIn or collect data from it.
Messages: what you send us when you contact us.
Billing, once paid plans are on: your plan, seats and hours, and the billing details you give our reseller Dodo Payments when you buy (name, email address, billing address and tax ID, if any). Dodo handles payment; we never receive your card number.
2.2 Information created from your calls (“call content”)
Transcript: what was said on the call, as text, with timestamps and whether you or another participant said it.
Suggestions: the advice Advicey showed you during the call.
Suggestions used: after the call, which suggestions you used, partly used or didn’t use, and whether the buyer’s concern was then resolved or still open, with your own words that show it. You see it in the call’s Advice tab, and so do the owners and admins of your company account.
After the call: a summary and outcome, commitments made, follow-up drafts, buyer questions your knowledge base couldn’t answer (with the buyer’s words), and answers to questions you ask about the call.
Deal memory: facts about a deal, such as needs, numbers, objections, commitments, people and tools, each with the quote and who said it. Later calls on the same deal use them, together with the buyer details you added.
Sales tips that we create from your recent calls.
2.3 Information collected automatically
Sign-in tokens, stored on your device: in your browser’s local storage for the web app, in the macOS Keychain for the Mac app, and in Windows Credential Manager for the Windows app. We store only a fingerprint (hash) of each refresh token.
Usage data: features you use, onboarding steps, pages you open in the web app, your answers to the desktop apps’ “meeting detected” prompt, the meeting app in use (for example Zoom), call starts and app launches. Usage data contains no call content.
AI processing records: when Advicey’s AI features ran for your calls, how long they took, what they cost and how they ended, such as whether a suggestion was shown, and for each call how many of its suggestions were used. These records contain no call content.
Desktop diagnostics: app version and build, operating system version and chip type; audio-quality measurements, such as gaps in microphone or speaker audio; crash and performance reports from macOS for the Mac app, with error messages and your Mac user name removed; and crash reports from the Windows app, naming the type of error and where in Advicey’s code it happened, without error messages or folder names. Diagnostics contain no audio and no call content.
Web app errors: the type of error, the page and the place in our code where it happened, without the error message or what was on the page.
Server logs: your IP address, the time, the address of the page or service requested (which can include what you typed in a search, such as a CRM contact search), the response status, error details, and the recipient of an email that failed to send.
2.4 Information from other services
Google sign-in: your name and email address.
CRMs you connect (HubSpot, Salesforce, Zoho CRM, Pipedrive and GoHighLevel): access tokens and the records you allow. By default, that is:
a contact’s email address, phone number, company, job title and lifecycle stage;
their deals: name, stage, amount and close date;
the latest note;
the company record, if you choose.
Dodo Payments, once paid plans are on: whether a payment succeeded, and your billing name, country and tax ID.
People Data Labs, when you add a link to a person’s LinkedIn profile to a deal: we send it the profile link, and it tells us what it holds about that person’s work. To prepare your calls with them, we keep their name, to check the profile is theirs, and a few facts: their current and earlier roles and companies, their education, the city and country they are in, and their profile headline, with the date we looked them up. We never ask for or keep their contact details (such as email addresses, phone numbers or home address), other social media profiles, or traits such as age or gender. If People Data Labs has no match, we keep nothing from it.
2.5 Audio
The desktop apps listen only during a call you start, or to your microphone while you dictate a brief. During a call, they stream its audio to AssemblyAI, our speech-to-text provider, which turns it into text as the call happens and keeps no audio or transcripts. A brief you dictate is turned into text on your computer. Audio is never sent to us, and release versions of the apps keep no recordings. The apps download their speech recognition models from Hugging Face; the Windows app also downloads its voice detection model from GitHub.
While a call runs and until it is uploaded, the desktop app keeps it on your computer as text, such as its transcript and suggestions, never as audio. If a call can’t be uploaded, the app retries for up to 30 days, then deletes it.
3. How we use your information
We don’t sell personal data, and we don’t use it for advertising.
Provide Advicey: suggestions during calls, plans, summaries, which suggestions you used, deal memory, follow-ups, CRM export and company accounts. This uses your account, company content, call content and CRM data. Legal basis (EU and UK): our contract with you; for the people on your calls, see section 4.
Keep Advicey secure and working: sign-in, preventing abuse, fixing errors, and measuring speed and cost. This uses sign-in tokens, server logs, AI processing records, diagnostics and web app errors. Legal basis: our legitimate interests in a secure, reliable service.
Improve Advicey: which features help and where setup stalls. This uses usage data, AI processing records and diagnostics. Legal basis: our legitimate interests in improving the service.
Improve our AI with real calls: testing changes against past calls. This uses call content. Legal basis: your company’s written instructions; for a personal account, our legitimate interests, and only with your written agreement.
Send account, security and billing emails, using your name, email address and billing data. Legal basis: our contract with you.
Answer legal requests and meet legal duties, using what the request or duty requires. Legal basis: legal obligation.
We never use your data to train AI models, ours or anyone else’s. Our AI providers may not use what we send to train their models, and keep it only for a limited time, at most 30 days, to detect abuse. During a call, we also ask Google to keep that call’s context for up to 20 minutes so suggestions arrive faster.
4. The people you talk to on calls
Advicey turns what the other people on your calls say into text, and processes it together with the names and company details you enter or your CRM provides, and the facts you add about them from their profile, website, emails or documents.
The Advicey user, or the company they work for, decides to use Advicey on a call. They must always tell the other participants, and get their consent where the law requires it. We process this data on their behalf. Advicey does not notify call participants itself.
When a user adds a link to someone’s LinkedIn profile, we send that link to People Data Labs, which tells us what it holds about the person’s work (section 2.4). People Data Labs collects that data itself and is responsible for it as a separate controller, under its own privacy policy at privacy.peopledatalabs.com; you can ask it directly what it holds about you, or to delete it.
We never contact call participants or use their data for our own marketing.
If you took part in a call and want your data deleted, contact the business you spoke with; it decides what happens to the call. If you write to info@advicey.io and tell us which business it was, we will pass your request on within 7 days and follow its instructions.
5. Who receives your information
Service providers. These companies process personal data for us. We add a company to this list before it receives any personal data, and we tell business customers by email at least 30 days before adding or replacing one, as section 21.6 of our Terms of Service describes.
Amazon Web Services: hosting, database and backups, in Frankfurt, Germany. The web app’s files are delivered through AWS’s global network.
AI model providers: OpenAI, Google (Gemini API) and TypeSafe AI. They process call content and the content you add to produce Advicey’s suggestions, summaries and other AI features, in the United States and other countries where they run their services.
AssemblyAI: turns call audio into text during calls, in the European Union. It keeps no audio or transcripts, only metadata for billing and logs.
Resend: account, invitation and billing emails, in the United States.
Google Workspace: our email, including messages you send to info@advicey.io, in the United States and other countries.
Dodo Payments: our reseller and merchant of record for paid plans. It processes your payment and billing details and collects tax as a separate controller, under its own privacy policy, in the United States and other countries where it operates. Card details go directly to Dodo.
Services you connect. When you connect a CRM, we send it the notes and fields you choose, and we read the records described in section 2.4. Data sent to your CRM is then governed by your agreement with that CRM.
These services are not our providers, but they receive some data when you use Advicey:
Your CRM (HubSpot, Salesforce, Zoho CRM, Pipedrive or GoHighLevel), when you connect it: the notes and fields you choose to send. We read the records you allow.
People Data Labs, when you add a LinkedIn profile link to a deal: the link, so it can tell us about that person’s work (section 2.4), in the United States. It is a separate controller, under its own privacy policy.
Google sign-in, on the web app’s sign-in and sign-up pages: your IP address, and your name and email address if you sign in with Google.
Google Fonts, on every web app page: your IP address.
Hugging Face and GitHub, when the desktop apps download their speech models: your IP address.
Microsoft, when you install or update the Windows app through the Microsoft Store: your Microsoft account and device details, under Microsoft’s privacy statement.
Company accounts. Owners and admins of a company account can read every call made in the company, including transcripts, summaries and which suggestions the member used, as well as its deals, deal memory, the buyer details added to them and open commitments, labelled with the member’s name. When a member leaves, the company keeps their calls.
Advicey staff. Our staff can see account data and the records in section 2.3 to support you and run the service. They see call content only when your company, or you for a personal account, has agreed in writing, or, when you ask us to look into a call, only while we do: we turn on access to your account’s calls and turn it off when we finish. Each view of call content in our admin tools is logged.
Legal and business reasons. We may disclose information to comply with the law or legal process, to enforce our Terms of Service, or to protect the rights and safety of Advicey, our users or others. If Advicey is involved in a merger, acquisition or sale of assets, your information may transfer as part of it, and we will tell you first.
6. Storage and security
We store your data on Amazon Web Services in Frankfurt, Germany (eu-central-1). The database is encrypted at rest and backed up automatically.
Data sent over the internet is encrypted with TLS 1.2 or later.
Passwords are hashed with bcrypt; refresh tokens are stored only as hashes.
CRM access tokens are kept in the encrypted database. Disconnecting a CRM deletes them and revokes them at the CRM.
Our servers are reached through AWS Systems Manager, without open remote login ports.
Our server logs leave out call content, except that an error message from a CRM can repeat part of a note we tried to send it.
No method of storage or transmission is completely secure, but we take reasonable technical and organisational measures to protect your data.
7. How long we keep it
Account data: while your account is open; deleted within 90 days of closure.
Sign-in sessions: 30 days on the web app and 180 days on the desktop apps, unless renewed by use.
Calls (transcripts, suggestions and which were used, summaries, deal memory): until you delete them, your company asks us to, or the account closes. Deleting a call deletes its deal facts.
Buyer details you added to a deal: until you remove them, the deal is deleted, your company asks us to, or the account closes. Files and pasted text are deleted as soon as they are read. Facts from a People Data Labs lookup are kept the same way, and we keep no other copy of them: for 90 days after a lookup, another deal in the same account that adds the same LinkedIn link gets those facts instead of a new lookup.
Sales tips: until the account closes, or sooner if you ask. They stay after the calls they came from are deleted.
Knowledge base and methodology: until you replace or delete them, or the account closes.
Usage data and AI processing records: 13 months.
Crash, hang, diagnostic and web app error reports: 90 days.
Records of staff viewing call content: 2 years.
Emails you send us: until we no longer need them to help you.
Server logs: replaced at each software update and capped in size.
Database backups: 7 days; copies made before a database update, 30 days.
Calls waiting to upload on your computer: up to 30 days.
Desktop app logs, on your computer: 14 days.
Audio: never stored.
When an account closes, we delete its personal data within 90 days, except what the law requires us to keep, such as invoices. Usage data, AI processing records and diagnostics kept after that no longer identify you, and records of staff viewing call content are kept for 2 years. Data you sent to a connected CRM stays in that CRM.
8. Your rights and choices
Access and correction: see and edit your data in the web app, or ask us.
Deletion: delete calls in the web app. Removing a buyer detail you added deletes it. Hiding a deal fact removes it from future calls; to delete deal facts, deals or your whole account, write to us.
A copy of your data: ask us and we will send it to you.
Diagnostics and usage data: ask us and we will explain how to turn off desktop diagnostics, which stops crash reports, audio-quality measurements and your operating system version and chip details. To object to usage data, write to us and we will stop recording it for your account.
Meeting detection: turn it off in the desktop app’s Settings.
Removing the desktop app: Remove Advicey in the app’s Settings › Storage & Downloads signs you out and deletes what the app keeps on your computer, including calls that haven’t uploaded. On Windows, uninstalling Advicey in Windows Settings › Apps also deletes its folder, but not its sign-in in Windows Credential Manager: sign out or use Remove Advicey first.
CRM and permissions: disconnect a CRM at any time, and change the desktop app’s permissions in macOS System Settings or Windows Settings.
EU and UK: you can also object to or restrict our processing, ask to take your data elsewhere, withdraw consent you gave, and complain to your data protection authority.
California: you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We don’t sell or share personal information for cross-context advertising, and we won’t treat you differently for using your rights. You can use an authorised agent; we will verify requests before acting on them. People in other US states may have similar rights, and we honour them the same way.
Write to info@advicey.io to use any of these rights. We answer within 30 days. If your data belongs to a company account, we will refer your request to that company.
9. International data transfers
We store data in Frankfurt, Germany. Advicey is run from Kazakhstan, and we may access data from there. Some of our providers process it in the United States and other countries. For those transfers we rely on the EU Standard Contractual Clauses, with the UK Addendum, or on the EU-US Data Privacy Framework where the provider is certified.
10. Children
Advicey is not meant for anyone under 18, and we don’t knowingly collect their data. If we learn we have, we delete it. Tell us at info@advicey.io if you believe we have.
11. Cookies and browser storage
The web app keeps your sign-in tokens, the way you last signed in and the sidebar setting in your browser’s local storage.
While you sign up, the form you are filling in (email address, name, company) is kept in your browser’s session storage until you finish or close the tab. It is not sent to us until you submit it.
The web app stores copies of its own files in your browser so it loads faster.
We set one cookie, only while you connect a CRM, to keep the connection secure. It lasts at most 10 minutes and is deleted when the connection finishes.
We use no tracking or advertising cookies. We record usage data ourselves, without cookies.
Your browser also contacts other companies: Google Fonts for the web app’s fonts, Google’s sign-in script on the sign-in and sign-up pages, and Dodo Payments’ checkout pages when you pay. Each receives your IP address and may set its own cookies under its own privacy policy.
12. Desktop app permissions and meeting detection
On a Mac:
Microphone: to turn your side of the call into text.
System audio recording: to turn the other participants’ side into text. The app takes only the audio and never records your screen.
Accessibility: for meeting detection.
On Windows:
Microphone: Windows’ microphone privacy setting must allow Advicey. It turns your side of the call into text.
The sound your PC plays: to turn the other participants’ side into text. Windows asks no permission for this. The app takes only the sound, never what is on your screen.
Meeting detection is on by default. While no call is running, the desktop app checks once a second whether Zoom, Microsoft Teams, Discord or a supported browser is using audio (on a Mac: Safari, Chrome, Edge, Arc, Brave or Firefox; on Windows: Chrome, Edge, Arc, Brave, Firefox, Opera or Vivaldi). It also reads those apps’ window titles, button labels such as “Leave call”, and, for Google Meet, the meeting address: on a Mac with Accessibility permission, and on Windows through Windows’ accessibility interface, which needs no permission. To find those apps, the Windows app also reads the names of the programs running and the titles of open windows, and keeps nothing about other apps. This happens on your computer. When it finds a meeting, it asks whether to start Advicey, and starts only if you agree. Each time it asks, the app tells us which meeting app it found (for example Zoom or Google Meet) and whether you started Advicey, dismissed the prompt or let it time out. Nothing else it reads is sent to us. You can turn meeting detection off in the app’s Settings.
The desktop apps also open when you sign in to your computer, and their windows are hidden from screen sharing by default. You can change these in Settings, and revoke permissions in macOS System Settings or Windows Settings; parts of the app then stop working. The Windows app is installed and updated through the Microsoft Store.
13. Changes to this policy
We will post changes here with a new date. For a material change, we will tell you by email or in the app at least 30 days before it takes effect. A new use of data you already gave us applies to that data only if you agree.
14. Contact
Advicey is run by Mirat Aubakirov, Mangilik El 48, Astana, Kazakhstan. Email: info@advicey.io.
