Privacy Policy

To maintain compliance with the GDPR, the ePrivacy Directive, and Québec's Law 25, we use Google Consent Mode v2 integrated via Google Tag Manager (GTM-WML4TTR3). For visitors in the European Economic Area, the United Kingdom, Switzerland, and Canada, our site denies the storage of tracking and advertising cookies by default until you explicitly consent.

In these regions, tracking tags stay dormant until you take an explicit "Accept" action, at which point updated consent signals are transmitted to our analytics stack. You can change or withdraw your choice at any time using the Cookie preferences link in the site footer.

District AI answers calls on behalf of the businesses that use it. When you call a District AI number, the call is answered by an AI assistant and may be recorded, transcribed, and summarized. The phone number you call from may be checked against a carrier lookup that returns the caller name on record and the type of line, so the business can recognize returning customers. We do not buy spam or risk scoring on callers. This information is stored in the business's private workspace and is controlled by that business; we process it on their behalf.

Where a workspace enables lead enrichment (District Global Intelligence), we supplement business-contact records with professional information, such as company, role, and business email, sourced from licensed B2B data providers (currently People Data Labs and Apollo) and carrier caller-ID lookups (Twilio). Enrichment data is used only inside that workspace's CRM and is never sold.

You choose your workspace's home data region when you sign up: the United States (default, on Google Cloud), Canada (Montreal), Europe (Frankfurt, serving customers across the EU and the UK), or Asia-Pacific (Singapore). Those latter three run on Amazon Web Services, which took them over from their previous hosting providers in August 2026 without any of them changing city. Workspace content, including contacts, call recordings, transcripts, and CRM records, is stored in an isolated database in that region. Since August 2026, the live audio of a call a Canadian workspace makes or receives in the browser is processed in Montreal as well, on Amazon Web Services (ca-central-1).

For a Canadian workspace, the language model runs in Montreal on every engine but the realtime one. Google does not serve that engine's single listen-and-speak model from Montreal, so a Canadian workspace that chooses it is processed in the United States (us-east4), and the engine picker labels it that way. Since September 2026, a new Canadian workspace starts on an all-Canadian engine that runs speech recognition and speech synthesis in Montreal too. It became available in August 2026 and was off by default until September 2026; nothing was changed on a workspace that had already chosen one, and a Canadian workspace on one of the other engines still has speech recognition and speech synthesis run in the United States.

None of the engine changes alter where a telephone call is carried. Since September 2026, a telephone call for a Canadian workspace is handled in Montreal in both directions, provided we issued the number through Telnyx. A call the workspace places is originated there and handed to Telnyx at its Montreal site, and a call arriving on a Canadian number we issue through Telnyx is delivered to us from Telnyx's own Canadian gateway and answered there.

A call arriving on a number issued through Twilio, whether Canadian or a United States one, is still hosted on our United States media node, because Twilio publishes no Canadian point of presence; a call that arrives on a European number is answered in Europe. What a carrier does with a call before it reaches us, or after we hand it over, is the carrier's to describe and not ours.

Some coordination data (account sign-in records, workspace directory and membership, and phone-number routing entries) and payment records processed by Stripe are handled in the United States. Where personal data crosses borders, we use Standard Contractual Clauses (SCCs) and applicable adequacy decisions to ensure your data remains protected.

Five things deliberately do not stay wholly inside your region, and we would rather name them than let you find them. First, support: a support request goes to our support desk, which runs on one Atlassian site hosted in Canada and serving all four regions, so your name, email address and the text of the request are held in Canada. If your workspace is in Canada that is your own region. If it is in Europe, the United States or Asia-Pacific, it is not, and for a European workspace that is a transfer to a country the European Commission recognises as providing adequate protection for personal data held by commercial organisations.

Second, if a workspace switches its knowledge base from the documents it uploads to the linked support knowledge base, the text of each question asked is sent to Atlassian to compose the answer. That second one is off unless a workspace turns it on.

Third, live call telemetry: when a call is carried over the phone network, in either direction, while it is in progress and when it ends, we send an event describing that call to an internal message bus, so the dashboard can show the call as it happens. For a United States or Asia-Pacific workspace that bus is in the United States. For a European workspace it is in Europe: since August 2026 the event is carried and stored in Frankfurt and consumed by our dashboard service in Europe. For a Canadian workspace it is in Canada: since September 2026 the event is carried and stored in Montreal and consumed by our dashboard service in Canada.

What is still United States for a European workspace is the moment the event is created for a call that ARRIVES over the phone network on a number issued through Twilio, because such a call reaches us on United States infrastructure and the systems that generate its events run there. Since August 2026 a call arriving on a European number is answered by our systems in Frankfurt, so its events are created there. For a call we place outbound on a European workspace's behalf, that moment moved as well: since August 2026 those calls are originated from our equipment in Frankfurt, so their events are created there too.

A Canadian workspace has the same split, drawn on the carrier rather than the country. Since September 2026 a call we place, and a call arriving on a Canadian number we issue through Telnyx, both run on our Montreal machine, so their events are created in Montreal. A call arriving on a number issued through Twilio, Canadian or United States, is answered in the United States and its event is created there before it is carried to Montreal and stored.

That event carries the caller's name and the phone numbers, and the transcript, the AI summary and the link to the recording; the call audio itself is not sent. A meeting or video call held in the browser produces no such event.

Fourth, your inbox: when a message reaches you or goes out, we push a routing event to that same message bus so the inbox updates without waiting, carrying the other party's phone number or email address and nothing of what was written. It follows the same split, and for a European workspace it is carried and stored in Europe; it is created in Europe as well whenever our European origin served your request, and in the United States when the geographic router sent you to ours there. A Canadian workspace works the same way from September 2026: carried and stored in Montreal, and created in Montreal whenever our Canadian origin served your request.

Fifth, number registration documents: when you submit a registration for a telephone number in a country whose regulator requires one, the documents you provided are sent to the carrier for that number, Twilio, whose registration service runs in the United States. Handing them to the regulator's process is the entire purpose of collecting them. The copy we store ourselves stays in a storage bucket in your workspace's own region, and the retention section below says when both are deleted. The data residency map sets out each of these per data type.

Separately from those five, and not workspace content, there is the operational state that keeps the service running: rate limits, short-lived caches, webhook idempotency claims and the lock that picks which origin runs a scheduled job. It lives in a shared database in the United States that every region touches on every request, Europe and Canada included. A second database in Frankfurt holds the rate-limit counters for our European origin, and since September 2026 a third in Montreal holds them for our Canadian origin. None of them holds call audio, a transcript, a message or a contact record, and where a key name would otherwise contain an email address, phone number or IP address it carries a one-way hash instead.

The full list of third parties that process data on our behalf, with each one's purpose, data category, and region, is published on our sub-processors page, and the per-data-type breakdown is on the data residency map.

We protect personal information with the controls described on our Sovereign page. They are TLS 1.2 or higher on every public endpoint, database storage encrypted at rest by the provider hosting each region, and tenant isolation enforced by PostgreSQL row-level security. Stored credentials are encrypted again with Google Cloud KMS, secrets are managed, access to production is least-privilege, and rate limiting sits in front of authentication. No method of transmission or storage is completely secure, and we do not promise that ours is.

If a breach of our security safeguards creates a real risk of significant harm to you, we notify you and the regulators that PIPEDA, Law 25 and the GDPR require, and we keep a register of such incidents. A customer whose workspace is affected is notified under the timelines in our Data Processing Agreement, so that it can meet its own duties to its callers.

We send product updates and offers only where the law allows. At checkout, the box that asks whether you want them is unchecked and optional; ticking it is your express consent under Canada's anti-spam law (CASL), and it is recorded with your account. Where CASL or your own law permits it, we may also email a business contact about services relevant to their role without express consent. Every marketing email carries an unsubscribe link, and an unsubscribe takes effect at once. Service messages about your own account, such as invoices, security notices and changes to our terms, are not marketing and continue for as long as you have an account.

For residents of California and other US states with consumer privacy laws: we do not sell personal information. The consent-gated conversion measurement in section 06 sends a one-way hashed email to Google Ads and LinkedIn, matching a sign-up to its ad. Under California law that may count as sharing for cross-context behavioral advertising, so you can opt out at any time: choose Decline, or the Cookie preferences / Do Not Sell or Share link in the footer. A Global Privacy Control signal from your browser is treated as that opt-out automatically, without asking you to confirm, unless you have chosen Accept here. We honor requests to know, correct, and delete in any state, without discrimination, through section 13's channels.

For any inquiries, please contact our Privacy Officer, Sean Dean, founder and CEO:

legal@distronode.com