App Privacy Policy
1. Who we are and what this policy covers
This policy covers the Connect mobile app for iPhone ("the app"), published by Shannon Stone, LLC (KyClick)("we", "us"). The app is the mobile side of Connect, a business phone and messaging service: a business ("your business") subscribes to Connect and gives its own staff accounts. There is no self sign-up — your account is created by your business's administrator.
Your business controls its own workspace: who its users are, which phone numbers and channels it connects, and whether optional features such as call recording, call transcripts and AI are turned on. For the conversations, calls and contacts in it, we act on your business's behalf. Our full Privacy Policy covers the whole service, including the website and the chat and forms businesses put on their own websites; this policy is about the app.
2. What the app collects, how, and why
The app collects only what it needs to work. It contains no analytics, advertising or crash-reporting software, does not track you across other companies' apps or websites, and does not sell or rent your information. Everything below is used to provide the service to you and your business.
| Information | What exactly | How it is collected | Why | Who else handles it | How long it is kept |
|---|---|---|---|---|---|
| Account details | Name, email address, role, extension number, notification preferences, and a password (stored only as a salted hash) or a Google sign-in identity. | Entered by the business's administrator when they invite the user; edited by the user in their profile; from Google if the user chooses to sign in with Google. | Signing in, showing who did what inside the business's workspace, routing calls to the right person, sending account and notification emails. | Hosting (DigitalOcean); email delivery; Google, only for a user who signs in with Google. | While the user account exists. The user can delete their account at any time, in the app or on the web, which erases these details from the account straight away (see Deleting your account); the business's activity log keeps the record that they were invited, including the address the invitation went to. |
| Account identifiers | The internal IDs of the user's account and of the business it belongs to. | Created by the service when the account is created. | Keeping each business's data separate and attributing actions to the right account. | Hosting (DigitalOcean). | While the user account exists. |
| Device and push tokens | The push-notification token Apple issues to the iPhone app, the device's name and platform, and when it signed in. | Sent by the mobile app when the user signs in and when it starts. | Ringing the app for incoming calls, delivering notifications, and listing a user's signed-in devices so they or their administrator can sign one out. | Apple Push Notification service. | Until the app unregisters the device (for example when the user signs out of the app) or Apple reports the token is no longer valid. Deactivating an account stops all notifications to it at once. |
| Live call audio | The user's voice during a call, through the microphone (only with the permission the device asks for). | Captured by the app or browser only while a call is in progress. | Carrying the call to the other party. | Telecommunications carriers, to connect the call. | Not recorded and not stored by the app — it exists only for the length of the call. Where a business records calls on a line, its phone system makes the recording (see Call recordings). |
| Messages | Text (SMS) and picture (MMS) messages, website chat messages, team chat messages, and notes users add to conversations. | Typed or sent by users in the app or on the web, and received from customers through the business's phone numbers and website chat. | Delivering, storing and showing the business its own conversations. | Telecommunications carriers and messaging providers (to send and receive text messages); hosting (DigitalOcean); our AI providers (Anthropic; AWS Bedrock or Google Vertex AI only if Anthropic is unavailable), only when the business has turned on the AI features and a user asks for one, or the business's AI agent answers the conversation; MongoDB, Inc. (Voyage AI), which receives the customer's latest messages, or a question made from the last one, as a search query when a user drafts a reply from knowledge or asks about the last message, or the business's AI agent looks up its knowledge to answer, only where the installation offers search by meaning and the business has accepted the AI terms. | For as long as the business keeps its account, or until the business deletes them. |
| Photos, files and faxes | A user's profile photo, pictures and files attached to messages, and faxes sent and received. | Chosen by the user from their photo library or taken with the camera (only with the permission the device asks for), uploaded on the web, or received from customers. | Delivering and showing them in the business's conversations; showing the user's profile photo to their team. | Telecommunications carriers and messaging providers (for picture messages and faxes); hosting (DigitalOcean). | For as long as the business keeps its account, or until the business deletes them or the operator does on its request. Fax documents are shredded automatically after the retention period set for the business (we set it on the business's request), if one is set; the record that a fax was sent or received is kept. |
| Voicemail | Voicemail messages callers leave for the business, with the caller's number, the time and the length. | Recorded by the business's phone system when a caller leaves a message, then stored so users can play it. | Letting the business's users listen to, and act on, their voicemail. | Hosting (DigitalOcean); the business's phone system provider. | For as long as the business keeps its account, or until the business deletes it or the operator does on its request. |
| Call recordings | Only where a business has call recording turned on: the audio of recorded calls on the lines and queues it chose (usually stereo, the caller and the business's side on separate channels), with the call's start and end times, length, caller's and called numbers, line or queue, and the name the phone system gives the person who answered. Transcribed only where the business has also turned on call transcripts for the line (see Call transcripts and summaries). | Recorded by the business's phone system on the lines and queues the business set it to record, with an announcement that the call may be recorded, then copied into the service — only after we make call recording available at the business's request and one of the business's owners turns it on, accepting responsibility for notice and consent. Not kept: recordings under 5 seconds, calls the phone system reports nobody answered, and calls recorded before recording was turned on for the line. Kept where the phone system cannot tell whether anyone answered (e.g. a shared line ringing several people). | Letting the business's users listen to recorded calls in the signed-in service: owners, administrators and supervisors every call; other users as the business chooses (by default, the calls they took). Owners and administrators can download them. Each play and download is logged. | Hosting (DigitalOcean); the business's phone system provider; our speech-to-text provider (Deepgram or Speechmatics), only where call transcripts are on for the line. | As the business chooses: 30, 60, 90, 180 or 365 days from the call, or until deleted (default 90 days, applied automatically once automatic deletion is switched on for the business; until then, for as long as the business keeps its account). Owners and administrators can delete a recording at any time; the operator deletes them on the business's request. A deleted recording leaves only a record that it existed. The business's phone system keeps its own copy under its own retention settings. |
| Call transcripts and summaries | Only where a business has call transcripts turned on: the text of recorded calls on the lines it confirmed, and — where it also turns on call summaries — a short AI-written summary of each call. | Made from the business's call recordings by our speech-to-text provider, and summarised by our AI provider — only after we make them available at the business's request, the business turns them on, and it confirms for each line that callers hear that the call may be recorded and transcribed. | Letting the business's users read what was said on a call, and a summary of it, in the conversation. Summaries are readable by everyone who can open the conversation, or only by those who may listen to the call, as the business chooses. | Speech-to-text (Deepgram or Speechmatics); our AI providers, for summaries (Anthropic; AWS Bedrock or Google Vertex AI only if Anthropic is unavailable); hosting (DigitalOcean). | As the business chooses, separately from the recording: deleted with the recording (the default), or kept 90 days, 1 year or 2 years from the call, or until deleted. A request to delete a person's call recordings deletes their transcripts and summaries too. |
| Call history and activity | Who called whom, when and for how long; which conversations a user has read; a user's availability status and when they were last active. | Recorded by the service as users make and take calls and use the app. | Showing call history, unread counts and who is available, and the business's own activity reports. | Hosting (DigitalOcean). | For as long as the business keeps its account. |
| Business contacts | Names, phone numbers, email addresses and other details a business keeps about the people it deals with. The device's own address book is never read. | Entered or imported by the business's users, or created when a new customer gets in touch. | Showing who a customer is in conversations and calls. | Hosting (DigitalOcean). | For as long as the business keeps its account, or until the business deletes them. |
| Diagnostics reports (no crash reporting or analytics) | The apps contain no analytics, crash-reporting or advertising software. A diagnostics report is sent only when you tap Send diagnostics in the mobile app: your app and iOS version, phone model, whether notifications and the microphone are allowed, your connection status, your extension and your company's phone-system address, and a log of recent activity with times (calls received and placed, sign-ins, connection attempts). Phone numbers in it show only their last 4 digits (emergency numbers appear in full). It never includes your password, message text or call audio. | Sent by the mobile app only when the user taps Send diagnostics and confirms. | Diagnosing faults the user reports to support (app functionality). | Hosting (DigitalOcean). | Deleted 30 days after it is sent, and from backups when they expire. |
| Technical and security logs | IP addresses, browser or app type, sign-in times and security events. | Recorded by our servers when the service is used. | Operating and securing the service, investigating abuse and diagnosing faults. | Hosting (DigitalOcean). | A limited period for security, then deleted. |
Optional features your business controls. Call recordings exist only where your business has turned call recording on for a line; transcripts and AI-written call summaries only where it has also turned call transcripts on; AI features (drafting help, summaries, an AI agent that answers customers) only where it has turned them on. Diagnostics reports are sent only when you tap Send diagnostics.
3. Permissions on your iPhone
The app asks for each permission only when a feature needs it, and works without the optional ones:
- Microphone — to carry your voice during calls. Audio is not recorded by the app.
- Notifications — to ring the app for incoming calls and tell you about new messages.
- Camera (optional) — only when you choose to take a photo to send or to use as your profile photo.
- Photos (optional) — only the photos you pick, through Apple's photo picker; the app cannot see the rest of your library.
The app does not ask for, and never reads, your contacts, your location, your calendar or your device's advertising identifier. You can withdraw any permission at any time in iOS Settings → Connect.
5. How long we keep information
The table in section 2 gives the period for each kind of information. In short: your account details are kept while your account exists and erased when you delete it; device and push tokens until the app signs out, the token stops working, or the account is deleted; diagnostics reports for 30 days; conversations, calls, voicemail and recordings are your business's records and are kept as your business chooses, for as long as it uses Connect.
6. Deleting your account
You can delete your account at any time, in the app: Settings → Delete account, or on the web (how). It takes effect straight away: you are signed out of every device, the account can no longer be signed in to, and your name, email address, photo, sign-in methods, devices, push tokens and personal settings are erased from it. Messages, calls and notes you handled for your business stay with your business as its records, shown as from a deleted user; its activity log keeps the record that you were invited (and the address it went to), and its records may still mention you by name. If you are your workspace's only owner, make someone else an owner first. Details: what is deleted and what is kept.
7. Your choices, and withdrawing consent
- Microphone, camera, photos and notifications — turn any of them off in iOS Settings → Connect.
- Diagnostics — nothing is sent unless you tap Send diagnostics.
- Signing in with Google — remove Connect from your Google Account's third-party connections.
- Your profile — change your name and photo in Settings at any time.
- Everything else — delete your account (section 6), or contact us (section 10).
Depending on where you live — including Kentucky and other US states with consumer privacy laws — you may have the right to access, correct, delete or get a copy of your personal information. Ask us at the contact below, or your business for its records. We will not discriminate against you for using these rights.
8. Children
The app is a tool for businesses and their staff. It is not directed to children, and we do not knowingly collect personal information from children under 13.
9. Changes to this policy
When we change this policy we publish a new version here, with a new version number and effective date, and tell you in the app if the change is significant. This is version 1.0.
10. Contact
Shannon Stone, LLC (KyClick) is responsible for this policy. For questions, requests about your information, or help with the app, contact us:
Shannon Stone, LLC (KyClick)836 Euclid Ave Suite 16, Lexington, KY 40502, USAEmail: scstone18@gmail.comSupport: https://kyclick.com