Updated 10 September 2026
Privacy
This notice explains how Koltra, Inc. handles personal information through its business platform, AI phone agents, website, and demo and support messaging. Platform and account practices are described first, followed by website-specific practices and rights that apply across these services.
Platform accounts and business contacts
When you create or use a platform account, we process your name, email address, organization and workspace membership, role, authentication and session information, and activity needed to operate and secure the account. This can include IP addresses, device or browser details, usage and billing records, and support correspondence. Where payment is required, payment providers process payment details; Koltra uses the transaction and billing information needed to administer the service. We use essential cookies or similar storage for sign-in, session security, preferences and remembering terms acceptance. These essential functions are separate from optional website analytics.
Our role and purposes
Koltra is responsible for account administration, business communications, billing, fraud prevention, security and compliance records it maintains for its own business. We use this information to provide the service, manage our relationship with you, respond to requests and meet legal obligations. For caller and connected-system data handled on a customer’s behalf, the customer determines the purposes and Koltra follows its authorized instructions, as described below.
Koltra Demo and Support SMS
Koltra Demo and Support SMS uses your phone number, messages, delivery information, and SMS consent record to answer your requests and provide related follow-ups you agree to receive. We use Telnyx and telecommunications carriers to deliver messages. We do not sell mobile numbers or share SMS opt-in data or consent for marketing or purposes unrelated to this messaging service. Service providers may process this information only as needed to provide the service. We retain consent and opt-out records to honor your choices and meet applicable requirements. Contact hello@koltra.ai about your data or reply STOP to stop SMS.
Koltra platform and AI voice agents
Customers deploy Koltra agents to answer and handle calls for their businesses. For caller and connected-system data, Koltra acts as the customer’s service provider under the customer agreement and, where protected health information is involved, under an applicable business associate agreement. A deployment partner may administer the service for a clinic or other business. The customer must identify who is responsible for callers’ information and ensure that the necessary agreements and permissions cover that arrangement.
What the platform processes
When a call reaches a Koltra agent, the platform processes the call audio, a transcript, a structured summary, the details the caller provides during the call (such as name, date of birth, contact details and the reason for calling), customer-provided contacts, knowledge and configured memory, and, where the customer has connected a system of record such as an electronic health record, the records retrieved from that system to serve the call. Retrieved records are used to serve the call. What the platform keeps from a call is governed by the customer's configuration and agreement; operational records of lookups and actions may remain for support, security, audit and legal obligations under the customer agreement and applicable law.
Why the platform processes it
To answer and route calls, complete the tasks the customer has configured, deliver summaries and notifications, let authorized staff review calls, and operate, secure and support the service. Koltra does not use customer or caller data for advertising, sell it, or use it to train or fine-tune models. Before a healthcare deployment processes protected health information, its approval must include confirmation that the selected AI providers’ terms and settings prohibit training on that information. Provider processing and retention must be documented for the selected deployment; this notice does not assert that every optional provider configuration has been approved for healthcare.
Platform subprocessors
Depending on the deployment, service providers process data for cloud hosting, database hosting and object storage; real-time media; speech recognition and synthesis; language models; telephony; and transactional email. These services include Amazon Web Services, LiveKit, Deepgram, Telnyx and Resend, along with the database and AI providers selected for that deployment. The applicable provider list and data-handling terms are available to customers on request. Providers that handle protected health information must be covered by the necessary business associate arrangements before that data flows. A provider’s inclusion here does not by itself mean it is approved for every healthcare workflow.
Platform retention and security
Conversation transcripts, summaries and recordings follow the retention settings supported for the deployment; scheduled deletion applies to those records and associated copies. Other stores, including uploaded knowledge, contacts and memory, have separate handling. Deleting a conversation or closing an account does not automatically erase all related data: billing, transaction and audit records may remain. Customers can request broader deletion through hello@koltra.ai; we coordinate the affected stores under the customer agreement, BAA and applicable law. We retain account, billing, audit and support information for the period needed to administer the relationship, investigate security issues, resolve disputes and meet recordkeeping obligations. Retention criteria and any required preservation also apply after an account closes. Customer-facing API and media connections use encryption in transit; stored call recordings use provider-managed encryption at rest. Public telephone-network calls are carried by the telephony carrier. Platform permissions are scoped by role and workspace. Recording access and specified administrative changes are logged. Healthcare deployment controls and provider arrangements must be reviewed before production use. Platform infrastructure is hosted in the United States; provider processing locations depend on the services selected for the deployment.
Callers' rights
If you called a business that uses Koltra and want to access, correct or delete information about that call, contact that business first. It determines how the information is used and can instruct us. We help the responsible customer handle requests and route requests received by Koltra to it, subject to appropriate identity checks. This notice does not replace a healthcare provider’s own privacy notice.
Website privacy
The following sections, from “What we collect” through “How long we keep it”, apply to the informational koltra.ai website. They do not describe platform account storage or customer call records.
What we collect
If you use the contact form, we receive what you type into it: your name, email address, message, and any optional detail you add about your company or workflow. When you arrive through a measured site contact button, we also receive a short allow-listed label identifying the page that brought you to the form. If you email us directly, we receive whatever your message contains. If you allow analytics, Google Analytics and Ahrefs Web Analytics receive limited page, referrer, interaction, approximate-location, language, browser, and device information. Ahrefs discards raw IP addresses and uses a salted identifier that resets daily to count visitors without tracking them across days, devices, sites, or apps.
Analytics and consent
Until you select Allow analytics, neither the Google Analytics nor Ahrefs Web Analytics script is loaded and no analytics request is sent. If you allow it, Google's enhanced measurement records page views, scrolls, outbound links, file downloads, page changes, and supported site-search, video, and form interactions when they occur. This site currently has no site search or embedded video. A successful contact submission also records one generate_lead event. Ahrefs measures page views, outbound-link clicks, and form-submission events. We do not configure either tool to send form values, names, email addresses, messages, or other submitted information.
Advertising and identity features
We do not run advertising tags. Google signals, user-provided data collection, User-ID, and ads personalization are off, and the site always sends ad storage, ad user data, and ad personalization as denied. We do not create advertising audiences from this site.
Cookies and local storage
We save your analytics choice in your browser's local storage. If you allow analytics, Google Analytics may set first-party _ga cookies. Ahrefs Web Analytics is cookie-free by default and does not use a persistent cross-day identifier. Declining does not load either analytics provider; changing a previous approval to decline disables analytics, reloads the page, and removes Google Analytics cookies. Our hosting provider may set a cookie if it needs to run a security challenge against suspicious traffic; that is a security function, not an analytics one.
Logs
Our hosting provider keeps standard request logs, which include IP addresses, for security and reliability purposes. We do not use those logs to build a profile of you, and we do not combine them with anything you send us.
Who handles it
Contact form submissions pass through Cloudflare, which hosts this site, and Resend, which delivers the resulting email. They arrive in our Google Workspace inbox. If you allow analytics, Google and Ahrefs process the limited site-use data described above. If you load the scheduling panel or open its direct link, Cal.com provides that booking flow. These providers process data under their own terms. We do not sell your information.
Scheduling
The live scheduling panel is supplied by Cal.com. It loads only after you select View available times or follow the direct scheduling link. Cal.com then receives connection and device information and whatever booking details you choose to provide, and it may set cookies needed for the booking flow.
Why we hold it
We hold correspondence because you contacted us and we want to reply or follow up about what you wrote. With your permission, we use aggregate analytics to understand which pages and referral sources help visitors. If you would rather we did not retain your correspondence, tell us and we will delete it where we are not required to keep it.
How long we keep it
Correspondence stays in our email for as long as it is useful to the conversation or as long as we are required to keep business records. We do not maintain a separate database of inquiries. Google Analytics event and user data retention is set to 14 months; its user-data retention period resets when a user returns. Ahrefs regenerates its visitor-counting salt daily, so its identifier cannot be used to track a person across days.
Your rights
For account, website or business-contact information, contact hello@koltra.ai. Depending on applicable law, you may request access, correction, deletion or a copy of your information, object to or restrict certain processing, or withdraw consent where processing relies on it. Withdrawal does not affect earlier lawful processing. We may need to verify your identity and retain information required by law or necessary to protect rights. We respond within applicable legal time limits; where provided by law, you may appeal a decision or complain to your local privacy regulator. Customer-controlled caller information follows the process in “Callers’ rights”.
Other disclosures and legal obligations
We may disclose information where required by law or where reasonably necessary to protect people, investigate abuse, or establish or defend legal rights. A business restructuring or transfer may involve information subject to continuing privacy obligations. Customer data, including protected health information, remains subject to the customer agreement, applicable BAA and law; this paragraph does not authorize uses those rules prohibit.
International visitors
Koltra, Inc. is a United States company. Our service providers operate internationally, so information may be processed in the United States and other countries where they operate.
Children
The website and platform accounts are intended for adult business users. We do not knowingly invite children to create accounts or submit website inquiries. Customer call workflows may involve minors’ information, including healthcare records, where the customer has the required authority and safeguards. Contact us if you believe a child has submitted information outside an authorized customer workflow.
Changes
When our practices change, we update this notice and its date. Where required, we provide additional notice or obtain consent before a material change takes effect. Updating this page does not override a customer agreement, BAA or applicable privacy rights.
Questions or privacy requests: hello@koltra.ai.