Privacy policy

Last updated November 11, 2026.

What we collect

• Account: email, name, optional company, a salted hash of your password (never the password itself), plan and billing status.
• Checked turns: for each check, the call id, turn index, redacted caller text, redacted draft, what was said, the decision, fired rules, signals and latency. With redactPII on (the default), phone numbers, email addresses, card numbers and Social Security numbers written as digits are replaced before anything is checked or stored. See Security and data for what redaction does not catch.
• Your setup: agents, rules, webhooks, and (for the Vapi proxy) your upstream model key, encrypted.
• Usage: check counts and model token counts per day, to apply plan limits.
• Email: the confirmation and password reset messages we send you.

We do not use advertising trackers or analytics scripts. We set one cookie, a sign-in session cookie for the dashboard.

How we use it

To run the service: check your agent's replies, show your call log and review queue, apply plan limits, bill paid plans and answer support. We do not sell your data, and we do not use your calls to train models.

Who processes it

• TypeSafe runs the classification model and receives the turn text and rule questions, only to answer them. With redactPII on (the default), phone numbers, emails, card and SSN numbers written as digits are replaced first. If you turn redactPII off, TypeSafe receives the unredacted text. Numeric values in context and business facts (prices, hours, names in the pack) are always sent as written. See Security and data.
• Cloudflare hosts the service and its database.
• Stripe processes payments and runs the billing portal. We never see or store card numbers.
• Resend delivers account emails.

How long we keep it

Checked turns are kept for your plan's call log window (7 days on Free, 30 on Starter, 90 on Pro, 180 on Agency) and then deleted automatically. Our storage keeps a 30-day recovery log, so deleted records can remain recoverable by us for up to 30 days. When you close your account we delete your agents, rules, keys, sessions and call log. We keep usage counts (numbers only), billing records and security logs as the law requires.

Your choices

To get a copy of your data, correct it, or close your account, email hello@trylumegrid.com from the account email.

Security

Passwords are hashed with PBKDF2 and a unique salt. API keys are stored only as hashes and shown once. Connections use HTTPS. Details are in Security and data.