Privacy policy

This policy explains what personal information Stephens Quantum LLC ("we", "us") collects when you use CallRoom Pro, why, and the choices you have. We've tried to write it in plain English.

1. Information we collect

About account users (room admins, managers, agents, support staff)

• Account details: name, work email address, role, and the room you belong to.
• Sign-in and security records: a scrambled (hashed) version of your password, sign-in times, IP address, browser and device type, and failed sign-in attempts.
• Activity records: actions you take in the product (for example calls logged, records opened or changed, exports made), kept in an audit log so rooms can see who did what.
• Payment cards on deals: CallRoom Pro doesn't process payments. When a room records a customer's card on a deal, we keep only the card brand, last 4 digits, expiry and a reference to the room's own Authorize.net record (plus name on card and billing address where entered), never the full card number or security code. Cards are saved only in the room's own Authorize.net account (CallRoom Pro supports Authorize.net only), and the room is responsible for its own PCI compliance.
• Agreement signing record: when a room signs our Master Subscription Agreement we record the signer's name, title, company and email, the date and time (UTC), IP address and approximate location, browser, operating system, device type, screen size, time zone, language and a device fingerprint hash, how far they scrolled and how long they viewed each section, the time each box was ticked, the signature, fingerprints of the agreement text, and, once a payment method is added, the Stripe customer and session identifiers. We keep it with the signed copy and use it to prove the agreement and to respond to disputes and chargebacks. We do not use text messages, photo identification or one-time codes.
• Billing contacts: for room owners, the billing contact and plan details. Subscription card payments are handled by Stripe; we never see or store your full card number.

About visitors to callroompro.com

• Basic server logs (IP address, pages requested, browser type) kept for security and troubleshooting.
• Approximate location for the signing record is looked up from a database file stored on our own servers, so the IP address is not sent to a location service. IP Geolocation by DB-IP.
• We do not use advertising or cross-site tracking cookies. See our cookie notice.

Customer data rooms put into CallRoom Pro

Rooms may store information about their own leads and customers, such as names, phone numbers, email and mailing addresses, details the room records about the products or property being discussed, call notes, website inquiries and signed agreements. The room owns this data and is responsible for where it came from and for its right to contact these people; we are software only and do not check or control how rooms obtain or use leads. If you are one of a room's customers and want to exercise your privacy rights, please contact that company directly; we will help them respond.

Signing records

When a room sends an agreement for signature, we record on the room's behalf, in a private audit record only that room's team can see: server times, the signer's IP address and the approximate location it points to (city, region, country and internet provider), device and browser details including a one-way device fingerprint, how the document was viewed and edited, the signature, the delivery events of the signing email, and, only if the signer chooses to share it, a precise location from their browser. The signer sees the room's own notice about this on the signing page. The room is the controller of this information and we process it for them.

Email sent to a room's own domain

When a room connects its own domain, email addressed to that domain (for example customerservice@ or hello@, including replies to the contract, inquiry and portal emails we send for the room) is received by our own mail server (not by an email provider or any other company) and filed for the room. We keep it for the room: the sender's name and address, the subject, the message as plain text (we do not keep or display the message's HTML or remote images), the delivery and sender-check results, and any attachments that pass our safety checks (documents and images up to 10 MB each, never programs, scripts, archives or web pages). Messages are filed in the room's website inbox and, when the sender is already one of the room's leads, noted on that lead in the room's CRM. Only that room's team can see them. We do not read them for any other purpose and we never send automatic replies to them. A room can turn receiving off at any time under Website settings, and a domain that already receives its email somewhere else is left alone. The room is the controller of this correspondence and we process it for them.

Website features a room turns on

A room's website admin includes tools that handle personal information on the room's behalf. The room is the controller of all of it and we process it for the room.

• Staff invitations and password links. When a room adds a staff user we email that person an invitation (or password reset) link, branded for the room's website. We keep their name, email address and role.
• Automatic emails to a room's owners and leads. A room can write email templates and an automation flow that sends them on a schedule, and agents can trigger an "info email" from the CRM. We store the templates, a copy of each email sent (recipient, subject, content, time and delivery result) and the progress of each customer through the flow. Messages go out through our email provider from the room's own website address.
• Info email webhook. A room can create a secret token that lets another system ask us to send its info email. Anyone holding the token can do that, so the room must keep it private; the room can replace it at any time. We keep a log of each info email request, including the lead details it carried (name, phone numbers, email, address and resort).
• Personal offer pages. An offer email can contain a private link, with a long random code, to a page showing that customer's offer. Anyone with the link can open the page. When the page is opened by a person we record the time, which offer was shown and the browser type.
• Uploaded photos and files. Photos a room uploads (resorts, listings, the media library) are stored on our own servers. A photo used on a public page, or any photo link the room shares, can be seen by anyone who has the link. Files attached to a customer's record are available only to that room's staff.
• Blog posts and events. Posts and events a room marks as published are public by design; drafts are visible only to the room's staff.
• Company facts page and search visibility. A room can enter facts about its own company (legal name, registration details, license wording, year started, names and titles of team members it chooses to list, links to its profiles elsewhere, and its own description of how it works and what it charges) and choose to publish them on a public page of its website. Nothing is published until the room confirms the facts are true, and each save records who made it, when and from which IP address, visible only to the room's admins. Published facts, and the room's public contact details, are also placed in the page's search-engine and AI-tool markup (structured data, sitemap, a plain-text summary file, and a plain-text copy of each page) so that search engines and AI tools can read them. The room can choose which AI crawlers it asks to stay away. Those requests are advisory; some crawlers ignore them. Anyone can copy public pages.
• Notification bell. Staff see in-app alerts, for example when an owner or visitor sends a message; the alert shows the sender's name and the start of the subject or message.

2. How we use information

• To provide, secure and maintain the service, including keeping each room's data separate.
• To authenticate users, prevent abuse (for example by rate-limiting sign-in attempts) and investigate security incidents.
• To send service messages such as invitations, password resets and billing notices.
• To bill room owners and enforce our terms, including the payment grace period and account locking described there.
• To improve the product using aggregated, de-identified usage information.

We do not sell personal information, and we do not use rooms' customer data to market to those customers or for any purpose other than providing the service to the room.

2A. Who at CallRoom Pro can see room data

A CallRoom Pro platform administrator can enter a room to give support or investigate a problem; each visit is time-limited and recorded in our own audit log. People who send us a Concierge or support request let our staff and engineers read the request, its files and the parts of the room they need to do the work. We do not review rooms' content for approval, and we do not send text messages.

2B. AI rebuttal generator

The CRM has an optional AI rebuttal generator for sales agents. When a person uses it, the text they type (the objection an owner raised), the objection type they choose and, if they pick a lead, that lead's resort, state and up to three recent non-private notes are sent to our AI provider, xAI, to write suggested rebuttals. We remove card numbers, security codes, email addresses, phone numbers and ID numbers from the typed text before it leaves our server, and we do not send the lead's name, phone number, email or address. Nothing else from the room is sent, and each request stands alone with no memory of earlier ones.

We keep the typed objection and the generated suggestions in that room's data so the person can see their history, and a person can save suggestions to their own library, edit or delete them. We also keep a usage record (who, which room, when, how much was used) so we can apply daily limits and prevent abuse, and a short log of requests the tool refused (a cleaned excerpt of up to 160 characters), which only our platform administrators can read. According to xAI's published terms, xAI does not train its models on API inputs or outputs without a customer's explicit permission, and it keeps API requests for up to 30 days for abuse and safety review before deleting them. Do not type anything into the generator that you would not want processed this way.

3. Legal bases (where applicable)

Where laws such as the GDPR or UK GDPR apply, we rely on performance of our contract with the room, our legitimate interests in running a secure and reliable service, compliance with legal obligations, and consent where we ask for it.

4. Sharing

We share information only with service providers who help us run CallRoom Pro (our "subprocessors", listed in the DPA), when required by law, to protect rights and safety, or as part of a merger or acquisition with notice to you. Inside a room, what each person can see is controlled by their role; for example, closed deals are visible only to room admins and customer support staff. Email a room sends through its own website (templates, automation flows, info emails, offers and staff invitations) goes through the same provider from the room's own address. The emails we send ourselves (your signed agreement copy with its PDF attached, invitations, password resets, billing and plan notices, support replies) are delivered through Resend from no-reply@callroompro.com to the address you gave us. If someone in a room uses the AI rebuttal generator, the objection text they type goes to xAI as described in section 2B.

5. Retention

6. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to complain to a regulator. Account users can ask their room admin or contact us. Room admins have tools to export all room data and to erase an individual customer's personal data, and every such action is logged.

7. Security

We use measures including database-level separation between rooms, role-based access, deal lockdown, masked contact details, encrypted connections, hashed passwords, session timeouts and encrypted backups. No system is perfectly secure; if we learn of a breach affecting your information we will notify affected rooms and individuals as required by law. More on our security page.

8. Children

CallRoom Pro is a business tool and is not directed to children under 16.

9. International transfers

We host in the United States. If data is transferred from other countries, we use appropriate safeguards where required.

10. Changes

We'll post changes here and, for significant changes, notify room admins in advance.

11. Contact

Stephens Quantum LLC, State of Florida, USA. Privacy contact: privacy@callroompro.com. Our mailing address is available on request at that email address.