Contents
1. Who we are
Call Flow Studio is operated by Adam Volchko, a sole proprietor based at 10 Kings Lane, Cape May Court House, NJ 08210, United States. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Adam Volchko is the data controller of personal information collected through this website and through use of the Call Flow Studio software.
This policy explains what personal information we collect, why we collect it, how we use it, and the rights you have over it.
2. Quick summary
We collect the minimum information needed to sell, license, and support a self-hosted product: your email if you join the waitlist, your name and billing details when you buy through Paddle, and basic technical telemetry from the Software itself (PBX platform, version, license key). We use privacy-friendly Umami analytics that does not track individuals or use cookies. We never see your dial-plan content, call recordings, or end-user data — that all stays on your PBX. We do not sell your information.
3. What we collect
Information you give us
- Waitlist signup: your email address.
- Demo access (when available): your email address.
- Purchase via Paddle: your name, business name, billing email, billing address, and country, as well as payment method details collected and processed by Paddle. Paddle shares with us the order metadata (order ID, product purchased, amount, currency, country, license key issued) but not your full payment-card information.
- Support requests: your name, email, and the contents of your message, along with any technical details you choose to include.
- Product registration / setup: your PBX platform (e.g. FreePBX, VitalPBX) and platform version, which you may provide during license activation or technical exchanges.
Information collected automatically
- Server access logs: IP address, request URL, HTTP method, response code, user-agent string, referer, and timestamp. Logs are kept for security, abuse prevention, and debugging.
- Waitlist and demo records: the IP address and user-agent of the device used to submit the form, stored alongside your email.
- Analytics: aggregate page-view counts collected via Umami analytics. Umami does not set cookies or collect personal information; it records anonymized, aggregated metrics such as page paths, referrers, and approximate country.
Information from the Software
- License verification & update checks: the Software running on your PBX may transmit your PBX platform name, platform version, and license key to our servers to verify your license and check for updates.
4. What we don’t collect
The Software runs on infrastructure you control. The following stays on your PBX and is never transmitted to us:
- Dial-plan content (extensions, queues, ring groups, IVR menus, time conditions, etc.).
- Caller IDs, called numbers, call detail records (CDR), or any call metadata.
- Call recordings or voicemail content.
- End-user names, phone numbers, or contact directories from your PBX.
- Asterisk Manager Interface (AMI) data, which the Software reads locally to display live status.
We also do not use advertising trackers, third-party advertising cookies, or social-media pixels.
5. How we use your information
- To deliver the Software and license keys you purchase.
- To verify license validity and serve software updates.
- To send you product announcements, release notes, and waitlist updates if you have opted in by joining the waitlist.
- To respond to support requests and customer service inquiries.
- To detect, prevent, and investigate security incidents, fraud, and abuse.
- To comply with legal, accounting, and tax obligations.
- To improve compatibility with new and existing PBX platform versions, in aggregate.
6. Legal basis (GDPR)
If you are in the European Economic Area or United Kingdom, we rely on the following legal bases under the GDPR:
- Performance of a contract — to deliver the Software, issue license keys, and provide support to customers.
- Legitimate interests — to keep our website and Software secure, prevent abuse, and understand aggregate usage. We have weighed these interests against your privacy rights.
- Consent — for waitlist emails. You can withdraw consent at any time by emailing us (see section 16).
- Legal obligation — to retain transaction and tax records as required by applicable law.
9. Retention
- Waitlist email addresses: retained until you ask us to remove them or until we close the waitlist.
- Demo access records: retained for 24 months from the last access.
- Server access logs: retained for 30 days, then deleted.
- Rate-limit records: retained for 24 hours.
- Order & tax records: retained for at least seven (7) years to comply with U.S. tax and accounting requirements.
- Support correspondence: retained for two (2) years from the last interaction.
10. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Request deletion of your information (subject to our legal retention obligations).
- Receive a copy of your information in a portable format.
- Restrict or object to certain processing.
- Withdraw consent for processing that relies on consent.
- Lodge a complaint with your local data-protection authority.
To exercise any of these rights, email hello@callflowstudio.io. We will respond within 30 days. We may need to verify your identity before acting on your request.
11. California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what categories of personal information we collect and the purposes for which we use it (see sections 3 and 5), to request deletion (subject to legal exceptions), to correct inaccurate information, and to be free from discrimination for exercising these rights.
We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve (12) months.
12. Security
We protect your information using HTTPS for all traffic, access controls on our database, and operational separation between our marketing site and our customers’ PBX environments (which we never access). Payment-card data is handled exclusively by Paddle and never reaches our servers.
No system is perfectly secure. If we discover a security incident affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.
13. International data transfers
Our infrastructure is located in the United States. If you are accessing the site or buying the Software from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for transfers from the EEA, UK, or Switzerland.
Paddle operates its own global infrastructure and may process information in additional jurisdictions; refer to Paddle’s privacy policy for details on its transfer mechanisms.
14. Children
Call Flow Studio is a business product. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated by email to active customers or by a prominent notice on this page.
16. Contact
For privacy questions, data-rights requests, or to update or delete your information, email hello@callflowstudio.io.
Postal address:
Adam Volchko
dba Call Flow Studio
10 Kings Lane
Cape May Court House, NJ 08210
United States