MYSTICALL · PRIVACY
Privacy Policy
Effective and last updated: September 7, 2026
This Privacy Policy explains how Callsy SAS (“Callsy,” “MystiCall,” “we,” “us”) processes personal data when you use the MystiCall app, mysticall.ai, our AI voice features, or contact us.
1. Controller
CALLSY SAS · SIREN / RCS: 989 559 596 R.C.S. Paris · SIRET: 989 559 596 00022 · EU VAT: FR08 989 559 596 · Share capital: €100 · Registered office: 58 rue de Monceau, 75008 Paris, France · Email: hello@mysticall.ai
Callsy is the controller where it determines why and how personal data is processed.
2. Adults only
MystiCall is intended for users aged 18 and over.
We do not knowingly offer MystiCall to children.
3. Data we may process
Depending on your use of the Service:
Account and identity data
- email;
- account identifier;
- name/display name if provided;
- age/date of birth if provided;
- authentication and account-security information.
Personalization data
- zodiac sign;
- numerology information;
- omen/tarot selections;
- saved insights;
- preferences;
- relationship/context information voluntarily entered by you;
- recurring themes and memory elements.
Voice and conversation data
- audio sent to voice features;
- transcription where used;
- text inputs;
- AI responses;
- conversation/session metadata;
- summaries or memory elements used for continuity.
Live voice audio is transmitted to ElevenLabs to provide the conversation. CALLSY stores transcripts, session metadata and continuity content in its application database, but does not store the raw live-call audio there. ElevenLabs may retain provider-side conversation data according to CALLSY’s account configuration, contract and applicable law; it is included in the external deletion process when you delete your account.
Purchase data
For App Store / Google Play purchases:
- product purchased;
- subscription status;
- receipt/transaction identifiers;
- purchase/renewal dates;
- entitlement status.
Payment-card credentials are generally handled by the payment platform rather than Callsy.
Device, diagnostics and security data
- device/OS/app version;
- IP address;
- installation/device identifiers where available;
- crash/diagnostic data;
- security and fraud signals;
- service logs.
Website/support data
- contact messages;
- form submissions;
- website events;
- cookies or similar technology where enabled.
4. Potentially sensitive data
Open-ended conversations can contain information a user voluntarily shares about relationships, mental state, health, sexuality, beliefs, finances or other sensitive matters.
MystiCall does not require users to disclose sensitive information merely to create an account.
Where sensitive data is processed, we limit its use to providing the requested Service, personalization chosen by the user, safety/security, legal compliance or another lawful purpose disclosed to the user.
Where law requires separate consent for a particular sensitive-data use, we will seek it.
5. Purposes and legal bases
We process data to:
- provide the Service — performance of contract;
- authenticate and secure accounts — contract and legitimate interests;
- personalize features requested by you — contract and, where required, consent;
- process purchase entitlements — contract/legal obligations;
- maintain continuity/memory features — contract and, where required, consent;
- respond to support/privacy requests — contract/legal obligations/legitimate interests;
- prevent fraud/abuse — legitimate interests/legal obligations;
- maintain and improve technical performance — legitimate interests;
- comply with law and defend legal rights — legal obligations/legitimate interests;
- send marketing where permitted — consent or another lawful basis as applicable.
6. AI processing
MystiCall uses AI providers to generate text and/or voice outputs.
Information you submit may be sent to contracted AI providers to provide the feature you requested.
MystiCall is designed to clearly disclose that users are interacting with AI.
ElevenLabs processes live voice audio, transcripts, conversation context and generated voice to provide MystiCall’s conversational features.
OpenAI API processes limited conversation text and profile context for post-call summaries and may support selected generated content. It does not receive payment-card details.
CALLSY uses business/API services rather than consumer chat accounts. Provider processing and retention follow the applicable contracts, account settings and legal requirements. MystiCall does not use private conversations for advertising or sell them.
7. Service providers
Production providers include, depending on the feature used:
- Framer — public website, forms and cookie-free aggregate website analytics;
- Apple — iOS distribution, purchases and subscription management;
- Google — Android distribution, purchases and subscription management;
- ElevenLabs — live voice, transcription and conversational AI;
- OpenAI — post-call summaries and selected AI-generated content;
- Supabase — account authentication; Railway and its infrastructure providers — application hosting and database;
- RevenueCat — purchase and subscription entitlement validation;
- Sentry — privacy-filtered crash and technical diagnostics; Expo — push-notification delivery when you enable notifications; and email/support providers used to answer requests.
These providers act under their own platform terms or contractual data-processing arrangements, as applicable. We limit the data shared with each provider to what is reasonably needed for the relevant feature.
8. No sale of private conversations
Callsy does not sell private voice or conversation content as a data-broker product.
MystiCall does not sell private conversations, use them for targeted advertising, or share them for cross-context behavioral advertising. The app does not request App Tracking Transparency permission and does not perform cross-app tracking.
9. International transfers
Providers may process data outside your country, including in the United States.
Where GDPR/UK GDPR requires safeguards, Callsy will use lawful transfer mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.
10. Retention
We retain data only for as long as reasonably necessary for stated purposes and legal requirements.
Retention depends on the type of data and why it is needed:
- live voice audio: transmitted for real-time processing and not stored in CALLSY’s application database; provider-side retention follows the provider configuration, contract and deletion workflow;
- generated speech and provider conversation records: retained only as needed to deliver, secure and support the feature, and included in applicable external deletion workflows;
- transcripts, readings, connections, summaries and memory: generally retained while your account is active so the requested continuity features can work, unless you delete or reset them sooner;
- account and profile information: retained while your account is active and then deleted or anonymized through the account-deletion process, subject to limited lawful exceptions;
- waitlist and marketing-consent data: until consent is withdrawn or, at the latest, three years after collection or the last meaningful contact, unless a shorter period is appropriate;
- support messages: up to three years after the request is closed, unless a longer period is needed for a dispute or legal obligation;
- technical and security records: for the period reasonably necessary to operate, secure, prevent fraud and investigate incidents, subject to provider settings;
- transaction and accounting records: for the period required by tax, accounting, consumer-protection or other applicable law;
- backups: removed or overwritten through the relevant provider’s normal backup cycle and not restored into active use after a completed deletion request.
When data is no longer needed for these purposes, it is deleted or anonymized.
11. User controls and rights
Depending on your location and applicable law, you may have rights to:
- access;
- correction;
- deletion;
- restriction;
- objection;
- portability;
- withdrawal of consent;
- appeal a privacy-request decision;
- opt out of certain sale/sharing/targeted-advertising uses where applicable;
- limit certain sensitive-data uses where applicable.
Contact: hello@mysticall.ai
We may verify identity before processing a request.
12. Account deletion
Users can request deletion at:
mysticall.ai/delete-account
Where required by an app store or law, account deletion will also be initiable from within the app.
Deletion may exclude records we must retain for tax, accounting, fraud prevention, dispute resolution or other legal reasons.
13. U.S. state privacy rights
Residents of certain U.S. states may have additional rights under applicable state privacy laws.
Where a law applies to Callsy, we will honor the required rights, which may include access, correction, deletion, portability, opt-out, sensitive-data limitations/consent and appeals.
We will not discriminate against a user for exercising a protected privacy right.
If Callsy begins using personal data for targeted advertising, sale or legally defined “sharing,” the policy and product controls must be updated before that processing begins.
14. U.S. sensitive and consumer health data
Because open-ended conversations may include information related to physical or mental health, sexuality or reproductive matters, users in Washington may be covered by Washington’s My Health My Data Act.
MystiCall uses this information only to provide the feature requested by the user, maintain user-chosen continuity, protect the service and comply with law. We do not sell consumer health data or use it for targeted advertising.
Eligible U.S. users may request access, deletion or other applicable rights by emailing hello@mysticall.ai. If we deny a request, you may appeal by replying with the subject “Privacy Appeal.”
15. Security
We use administrative, technical and organizational measures designed to protect personal data.
No service can guarantee absolute security.
We restrict access based on operational need and require providers to maintain appropriate safeguards through contractual or platform arrangements where applicable.
16. Breach response
We maintain procedures intended to investigate security incidents and make notices required by applicable law.
17. Cookies and tracking
The website may use strictly necessary technology.
The website uses Framer’s cookie-free aggregate analytics. The app does not use advertising pixels, advertising SDKs, cross-site tracking or cross-app tracking.
Strictly necessary or short-lived technologies may be used for authentication, security, fraud prevention, preferences and service delivery. They are not used for behavioral advertising.
18. Changes
We may update this policy to reflect product, provider or legal changes.
Material changes will be communicated where required.
19. Contact / EEA rights
Privacy requests: hello@mysticall.ai
EEA users may lodge a complaint with a competent supervisory authority; in France, this is the CNIL.