This notice explains how Koltra, Inc. handles personal information through its business platform, the AI agents that handle calls, text messages and email for its customers, its website, and demo and support messaging. Platform and account practices are described first, followed by website-specific practices and rights that apply across these services.
If you use a Koltra account or contact Koltra
Platform accounts and business contacts
When you create or use a platform account, we process your name, email address, organization and workspace membership, role, authentication and session information, and activity needed to operate and secure the account. This can include IP addresses, device or browser details, usage and billing records, and support correspondence. Where payment is required, payment providers process payment details; Koltra uses the transaction and billing information needed to administer the service. We use essential cookies or similar storage for sign-in, session security, preferences and remembering terms acceptance. These essential functions are separate from optional website analytics.
Our role and purposes
Koltra is responsible for account administration, business communications, billing, fraud prevention, security and compliance records it maintains for its own business. We use this information to provide the service, manage our relationship with you, respond to requests and meet legal obligations. For data about people who contact a customer, and connected-system data handled on a customer’s behalf, the customer determines the purposes and Koltra follows its authorized instructions, as described below.
Koltra Demo and Support SMS
Koltra Demo and Support SMS uses your phone number, messages, delivery information, and SMS consent record to answer your requests and provide related follow-ups you agree to receive. We use Telnyx and telecommunications carriers to deliver messages. We do not sell mobile numbers or share SMS opt-in data or consent for marketing or purposes unrelated to this messaging service. Service providers may process this information only as needed to provide the service. We retain consent and opt-out records to honor your choices and meet applicable requirements. Contact hello@koltra.ai about your data or reply STOP to stop SMS.
If you contact a business that uses Koltra
Koltra platform and AI agents
Koltra’s products are live with pilot customers; this section describes how data is handled in those deployments. Customers deploy Koltra agents to answer and handle phone calls, text messages and email for their businesses. For data about the people who contact a customer, and for connected-system data, Koltra acts as the customer’s service provider under the customer agreement and, where protected health information is involved, under an applicable business associate agreement. A deployment partner may administer the service for a clinic or other business. The customer must identify who is responsible for the information of the people who contact it and ensure that the necessary agreements and permissions cover that arrangement.
What the platform processes
When a call reaches a Koltra agent, the platform processes the call audio, a transcript, a structured summary, the details the caller provides during the call (such as name, date of birth, contact details and the reason for calling), customer-provided contacts, knowledge and configured memory, and, where the customer has connected a system of record such as an electronic health record, the records retrieved from that system to serve the call. When a text message or email reaches a Koltra agent, or an agent sends one for a customer, the platform processes the phone number or email address, the message content, the time and delivery status reported by the carrier or email provider, and the opt-out or consent status recorded for that number or address. Retrieved records are used to serve the conversation. What the platform keeps from a call, text or email is governed by the customer’s configuration and agreement; operational records of lookups and actions may remain for support, security, audit and legal obligations under the customer agreement and applicable law.
Why the platform processes it
To answer and route calls, text messages and email; complete the tasks the customer has configured; send the confirmations and reminders the customer has set up; deliver summaries and notifications; let authorized staff review conversations; and operate, secure and support the service. Koltra does not use customer or caller data for advertising, sell it, or use it to train or fine-tune models. Before a healthcare deployment processes protected health information, its approval must include confirmation that the selected AI providers’ terms and settings prohibit training on that information. Provider processing and retention must be documented for the selected deployment; this notice does not assert that every optional provider configuration has been approved for healthcare.
Text messages and email sent for a customer
Texts and emails that a Koltra agent sends for a business are that business’s communications, sent under its name and instructions. Beyond replying to your own messages, agents send only confirmations and reminders; they do not send marketing. The business is responsible for having any consent the law requires before texts are sent to you and for its own notices. To stop texts from a business that uses Koltra, reply STOP to any of its texts; reply HELP for help. We record the opt-out and stop sending texts from that business to your number, and we make the record available to the business. To stop email, follow the instructions in the message or contact the business. We do not sell phone numbers or email addresses, and we do not share text-message opt-in data or consent with third parties for their marketing. Standard text messages and most email are not encrypted end to end, so a business should send health details by text or email only where its policies allow it or you have asked to be contacted that way.
Platform subprocessors
Depending on the deployment, service providers process data for cloud hosting, database hosting and object storage; real-time media; speech recognition and synthesis; language models; telephony and text messaging; and email delivery. These services include Amazon Web Services (including Amazon Simple Email Service for email), LiveKit, Deepgram and Telnyx, along with the database and AI providers selected for that deployment. The applicable provider list and data-handling terms are available to customers on request. Providers that handle protected health information must be covered by the necessary business associate arrangements before that data flows. A provider’s inclusion here does not by itself mean it is approved for every healthcare workflow.
Platform retention and security
Call transcripts, summaries and recordings, and text and email threads, follow the retention settings supported for the deployment; scheduled deletion applies to those records and associated copies. Other stores, including uploaded knowledge, contacts and memory, have separate handling. Deleting a conversation or closing an account does not automatically erase all related data: billing, transaction and audit records may remain. Customers can request broader deletion through hello@koltra.ai; we coordinate the affected stores under the customer agreement, BAA and applicable law. We retain account, billing, audit and support information for the period needed to administer the relationship, investigate security issues, resolve disputes and meet recordkeeping obligations. Retention criteria and any required preservation also apply after an account closes. Customer-facing API and media connections use encryption in transit; stored call recordings use provider-managed encryption at rest. Public telephone-network calls are carried by the telephony carrier; text messages are carried by mobile carriers, and email by the sender’s and recipient’s email providers. Platform permissions are scoped by role and workspace. Recording access and specified administrative changes are logged. Healthcare deployment controls and provider arrangements must be reviewed before production use. Platform infrastructure is hosted in the United States; provider processing locations depend on the services selected for the deployment.
Rights of people who contact our customers
If you called, texted or emailed a business that uses Koltra and want to access, correct or delete information about that conversation, contact that business first. It determines how the information is used and can instruct us. We help the responsible customer handle requests and route requests received by Koltra to it, subject to appropriate identity checks. This notice does not replace a healthcare provider’s own privacy notice.
If you visit koltra.ai
Website privacy
The following sections, from “What we collect” through “How long we keep it”, apply to the informational koltra.ai website. They do not describe platform account storage or the calls, texts and email handled for customers.
What we collect
If you use the contact form, we receive what you type into it: your name, email address, message, the topic you choose, and your company if you add it. If you email us directly, we receive whatever your message contains. If you talk or type with Koltra’s guide, we receive that conversation (see “Talk to Koltra”). If you allow analytics, Google Analytics receives limited page, referrer, interaction, approximate-location, language, browser, and device information.
Talk to Koltra
If you press Talk to Koltra, you talk or type with Koltra’s guide, an AI assistant that answers questions about Koltra and can show you pages of this site. While the conversation is open, what you say (through your microphone, if you allow it) and what you type are sent through LiveKit, a real-time media provider, to the Koltra platform. There, speech recognition turns your words into text, a language model writes the guide’s replies, and speech synthesis speaks them. We keep the conversation’s transcript (your words and the guide’s), its time and the pages the guide showed you as a record in the Koltra platform. We do not record the audio. Please do not share sensitive personal information in a conversation; to reach a person, use the contact form.
Analytics and consent
Until you allow analytics in the consent banner, the Google Analytics script is not loaded and no analytics request is sent. If you allow it, Google’s enhanced measurement records page views, scrolls, outbound links, file downloads, page changes, and supported site-search, video, and form interactions when they occur. This site currently has no site search or embedded YouTube video; the homepage film is served from this site and is not measured. Our custom events record successful contact submissions and clicks on the booking link. They identify the action, not your form entries or booking details. We do not configure Google Analytics to send form values, names, email addresses, messages, or other submitted information.
Advertising and identity features
We do not run advertising tags. Google signals, user-provided data collection, User-ID, and ads personalization are off, and the site always sends ad storage, ad user data, and ad personalization as denied. We do not create advertising audiences from this site.
Logs
Our hosting provider keeps standard request logs, which include IP addresses, for security and reliability purposes. We do not use those logs to build a profile of you, and we do not combine them with anything you send us.
Who handles it
Contact form submissions pass through Cloudflare, which hosts this site, and Resend, which delivers the resulting email. They arrive in our Google Workspace inbox. Conversations with Koltra’s guide pass through LiveKit to the Koltra platform, where its cloud hosting, speech recognition and synthesis, and language-model providers process them (see “Platform subprocessors”). If you allow analytics, Google processes the limited site-use data described above. If you follow the booking link, Cal.com provides that booking flow. These providers process data under their own terms. We do not sell your information.
Scheduling
Booking is supplied by Cal.com. This site links to Cal.com’s booking page instead of embedding it, so nothing from Cal.com loads until you follow the booking link. Cal.com then receives connection and device information and whatever booking details you choose to provide, and it may set cookies needed for the booking flow.
Why we hold it
We hold correspondence because you contacted us and we want to reply or follow up about what you wrote. We keep conversations with Koltra’s guide to answer you, to follow up when you ask us to, and to improve the guide. With your permission, we use aggregate analytics to understand which pages and referral sources help visitors. If you would rather we did not retain your correspondence, tell us and we will delete it where we are not required to keep it.
How long we keep it
Correspondence stays in our email for as long as it is useful to the conversation or as long as we are required to keep business records. Apart from the records of conversations with Koltra’s guide, we do not maintain a separate database of inquiries. Those records stay in the Koltra platform until we delete them; ask hello@koltra.ai to delete yours. Google Analytics event and user data retention is set to 14 months; its user-data retention period resets when a user returns.
Rights and provisions across these contexts
Your rights
For account, website or business-contact information, contact hello@koltra.ai. Depending on applicable law, you may request access, correction, deletion or a copy of your information, object to or restrict certain processing, or withdraw consent where processing relies on it. Withdrawal does not affect earlier lawful processing. We may need to verify your identity and retain information required by law or necessary to protect rights. We respond within applicable legal time limits; where provided by law, you may appeal a decision or complain to your local privacy regulator. Information a customer controls about the people who contact it follows the process in “Rights of people who contact our customers”.
Other disclosures and legal obligations
We may disclose information where required by law or where reasonably necessary to protect people, investigate abuse, or establish or defend legal rights. A business restructuring or transfer may involve information subject to continuing privacy obligations. Customer data, including protected health information, remains subject to the customer agreement, applicable BAA and law; this paragraph does not authorize uses those rules prohibit.
International visitors
Koltra, Inc. is a United States company. Our service providers operate internationally, so information may be processed in the United States and other countries where they operate.
Children
The website and platform accounts are intended for adult business users. We do not knowingly invite children to create accounts or submit website inquiries. Customer workflows, including calls, texts and email, may involve minors’ information, including healthcare records, where the customer has the required authority and safeguards. Contact us if you believe a child has submitted information outside an authorized customer workflow.
Changes
When our practices change, we update this notice and its date. Where required, we provide additional notice or obtain consent before a material change takes effect. Updating this page does not override a customer agreement, BAA or applicable privacy rights.
Questions or privacy requests: hello@koltra.ai.
Terms of use