Privacy policy

Kentra LLC ("Kentra", "we") runs an AI phone receptionist and CRM for local businesses. This policy explains what personal data we collect, why, who we share it with, and the choices you have. It covers visitors to our website, the businesses that use Kentra ("clients"), and the people who call, text or chat with a client's business or send it a request through its Kentra website form ("callers").

What we collect

From website visitors. When you request a demo, get our demo line, ask for a free website preview or run the free AI visibility check, we collect what you give us: your name, phone number, email, business name and type, city or ZIP code, your message, and your website URL, along with the text-message consent you gave. To keep spam out of our forms we also use anti-bot signals: a signed page token, the result of Cloudflare's Turnstile browser check, and your IP address. Cloudflare reads your IP address and browser details to run that check.

From callers. When someone calls a client's business, the receptionist records the caller's phone number, a recording and transcript of the call, and what the caller asked for and shared (an appointment, a quote, a question, and details such as a name, email or service address), so it can appear in the client's CRM. When someone texts a client's business or uses the chat on the client's website, Kentra keeps the messages in the client's inbox the same way. When someone sends a request through a client's Kentra website form, Kentra saves their name, number, email and request in the client's CRM, and records it when they agree to get reminders and offers by text from that business.

From clients. Account details, business hours and settings, the contacts and notes they add to their CRM, and usage and billing records. Card details stay with Stripe, our payment processor; Kentra never stores card numbers.

Technical logs. Our servers keep request and error logs, which include IP addresses and timestamps.

How we use it

• To run the service: answer calls and, where a client turns them on, call leads and missed callers back and answer texts and website chat; save leads and appointments; and show recordings, transcripts, messages and summaries in the client's dashboard.
• To send text alerts to the business owner and, where a client has turned them on, caller-facing texts such as follow-ups, missed-call text-backs, appointment confirmations and reminders, review requests, and seasonal reminders and offers to people who agreed to get them.
• To build the free website preview from the URL and details you give us.
• To run the free AI visibility check: we ask AI assistants questions made only from what you do or sell and your city. Your name, business name and contact details are not sent to them.
• To prevent spam and abuse on our forms.
• To bill clients and provide support.
• To improve the service, using aggregated, de-identified usage across clients.

What we don't do

• We do not sell personal data.
• We do not share data with advertising networks or data brokers.

Who we share it with

We use a small number of providers to run Kentra. Each handles data only to provide its service to us. The providers we choose are US companies, and our servers and backups are in the United States.

• Retell AI — voice agent, call recording and transcription, running on OpenAI models (US)
• Twilio — phone numbers, calls and text messages (US)
• Anthropic — AI replies to texts and website chat, and AI text generation for website previews (US)
• DigitalOcean — hosting, database and backups, San Francisco region (US)
• Cloudflare — Turnstile bot check on forms (US)
• Stripe — payments (US)
• Google — web fonts on the site, our business email, and the Google Calendar API when a client connects a calendar (US)
• The field-service platform you connect (Jobber, Housecall Pro) — to sync the leads and bookings you asked for; you choose the provider and its own privacy policy applies (Jobber is based in Canada)

Calls are recorded

Every call the receptionist handles is recorded and transcribed so it can appear in the client's CRM. Clients are responsible for any call-recording notice their state or industry requires; Arizona is a one-party-consent state. The receptionist is an AI assistant and is built to say so when asked. It is not an emergency service: callers with emergencies are told to hang up and dial 911.

Text messages

Owner alerts go to the mobile number the owner gives us for them at signup, with the owner's consent. Automatic caller-facing texts are sent only where the client has turned them on and the caller gave a number and consent or started the conversation. Offers and seasonal reminders go only to people who agreed to receive them. A client's team can also send texts by hand from the dashboard, including a one-time text asking whether someone wants those offers; the client is responsible for having permission to text that person. Every text supports STOP to opt out and HELP for help. Message and data rates may apply. Consent is not a condition of purchase. Opt-outs are honored across the whole platform.

Google Calendar

A client can connect one Google Calendar to Kentra from the dashboard using Google sign-in. When they do, Kentra reads that calendar's events and free/busy times so the receptionist offers callers only open times and the client's existing events show as blocked time, and it creates, updates or deletes the calendar events that match appointments booked, moved or cancelled through Kentra. We store the times, titles and IDs of events from the connected calendar, and the access tokens Google issues, which are kept encrypted. Calendar data is used only to schedule for that client's own business. It is never shared with anyone else, sold, used for advertising, or used to train AI models. Disconnecting from the dashboard revokes Kentra's access and deletes the stored tokens and imported events; a client can also remove Kentra's access at any time from their Google account permissions. Kentra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Customer-connected field-service integrations

A client can connect Kentra to one field-service platform from the dashboard: Jobber (early access) or Housecall Pro (pilot) today, and ServiceTitan once ServiceTitan approves Kentra's partner application. Only the client can turn a connection on, and a client connects Google Calendar plus at most one field-service platform.

What Kentra sends. For the leads and appointments the receptionist handles, Kentra creates records in the connected platform: the caller's name, phone number and email, the service address, the details of the lead or request, and the booked appointment times and notes.

What Kentra reads. The connected account's name, the customers Kentra created there, and the schedule (busy times), so the receptionist does not double-book.

Credentials. The OAuth tokens (Jobber) or API keys (Housecall Pro) the platform issues are stored encrypted at rest, with a key held only on our servers, and are used only to run the integration the client turned on.

Permissions and purpose. Kentra asks for only the permissions it needs to create customers, requests and jobs and to read the schedule. The connection is used to sync the client's leads and bookings, never for marketing.

Retention. Credentials are kept while the connection is on. The sync history (which Kentra records match which records in the platform) is kept with the client's CRM data and follows the periods under "How long we keep it".

Disconnecting. Disconnecting from the dashboard deletes the stored credentials and the link records immediately. Records already created in the other platform stay there, because the client owns that account. A client can also revoke Kentra's access from inside the platform at any time.

Who controls the external account. The client does. Data inside the connected platform is governed by that provider's own privacy policy, and access to a provider's API (for example Housecall Pro's MAX plan) is between the client and that provider.

Health information

Kentra is not currently offered to HIPAA covered entities or their business associates. We do not sign Business Associate Agreements, and the service must not be used to collect or store protected health information.

How we protect it

• TLS encryption on our website and dashboard and on our connections to our providers.
• Each client's data is isolated by database-level row security.
• Least-privilege access for our team.
• Signed webhooks from our telephony and payment providers.
• Daily database backups, kept for about two weeks on our server and for 60 days in private DigitalOcean storage.

How long we keep it

• While you are a client: CRM data, recordings and transcripts are kept for as long as the subscription is active.
• After cancellation: you can request an export within 30 days. Within 90 days of cancellation we delete the client's data from our systems and have our voice provider delete the client's call recordings and transcripts, except billing records we are required to keep by law and our list of numbers that opted out of texts.
• Website leads that never become clients: deleted after 24 months without contact with us.
• Backups: deleted data leaves our backups as they expire, about 60 days later.
• Text opt-outs: we keep the numbers that replied STOP, so they are never texted again, even after the rest of their data is deleted.

Your rights and choices

Anyone — visitor, client or caller — can ask for access to, a copy of, correction of, or deletion of their personal data by emailing hello@kentrahq.com. We answer within 30 days. Text STOP to any Kentra message to opt out of texts immediately.

When the law requires it

We disclose personal data when a valid legal request requires it, or when it is necessary to protect the safety of a person or the security of the service. We tell the affected client when the law allows.

Changes to this policy

We may update this policy. We post the new version here with a new effective date, and we email clients at least 14 days before a material change takes effect.

Children

The service is not directed to anyone under 18.

Contact

Questions go to hello@kentrahq.com. Our terms of service cover plans, billing and how the service works.