Skip to main content

Privacy Policy

Updated on May 1, 2026

1. Introduction

This Privacy Policy explains how Kaustubh Ghodke o/a DigiCatalyst Systems ("I," "me," or "the practice") collects, uses, discloses, and protects the information you provide when you visit digicatalyst.ca, book a call through Cal.com, or correspond with me by email.

Geographic scope: the website and services are directed at individuals and businesses located in Canada (excluding the province of Quebec) and the United States. They are not directed at residents of the European Economic Area, the United Kingdom, the province of Quebec, or any other jurisdiction outside the listed service area. If you're outside that area, please do not use the site or send personal information through it. If you are subject to GDPR, UK GDPR, or Quebec Law 25 and submit personal information to the site anyway, the rights afforded by your applicable local law apply to the extent the practice is subject to that law.

2. Information I Collect

I collect information you voluntarily provide and a small amount of automatically-collected data when you use the site.

  • Information you provide: when you book a 20-min call through Cal.com, Cal.com collects your name, email, optional phone number, and any notes you add to the booking. That information is forwarded to me via email and Cal.com's dashboard. When you email me directly at support@digicatalyst.ca, I receive whatever you put in that email.
  • Voice receptionist call data (paying AI Voice Receptionist customers and their callers): when a caller phones a number routed through the AI Voice Receptionist, the call audio, the AI-generated transcript, the caller's phone number, the call duration, and any structured fields the receptionist captures (name, address, urgency, appointment time) are processed by the system. Recording disclosure is announced at call start where required by law (US two-party-consent states: CA, FL, IL, MD, MA, MT, NV, NH, PA, WA). Customer is the data controller for caller data; the practice is the processor.
  • Payment data: invoices are issued through Stripe (or direct e-Transfer for some Canadian clients). Stripe processes payment-card information directly under Stripe's own privacy policy; the practice does not store full card numbers.
  • Automatically-collected data: standard web analytics via Cloudflare Web Analytics (IP address, browser type, device information, page views), collected without third-party advertising trackers.

3. Third-Party Processors

The site uses the following third-party services. Each is a sub-processor of any data you provide.

  • Cal.com (booking): when you book a call, your name, email, and any booking notes are processed by Cal.com (https://cal.com). Cal.com's privacy policy governs their handling of that data.
  • Cloudflare (hosting + analytics): when site is served from Cloudflare's edge network, technical request data (IP address, request headers) and aggregate page-view analytics are processed per Cloudflare's privacy policy.
  • Email provider (Google Workspace): emails to support@digicatalyst.ca are received and stored in a Google Workspace mailbox under Google's standard data processing terms.
  • Twilio (Missed-Call SMS Recovery + AI Voice Receptionist customers): handles SMS routing for Missed-Call SMS Recovery and voice-call routing, recording, and number provisioning for the AI Voice Receptionist. Customer onboards via Statement of Work (SOW) under the Master Services Agreement (MSA).
  • Anthropic (AI Voice Receptionist customers): the receptionist's natural-language responses are generated using Anthropic's Claude API. Anthropic does not train its models on customer data submitted via its commercial API. Call transcripts and prompt context are sent to Anthropic for the limited purpose of generating each response.
  • Speech-to-text provider (AI Voice Receptionist customers): voice-call audio is transcribed by a speech-to-text provider (currently Deepgram; subject to change with notice to active customers). The provider receives audio in real time and returns text; audio is not retained beyond the transcription window.
  • n8n (workflow automation): workflow automation between Cal.com, Twilio, Anthropic, and the practice's notification systems runs on a self-hosted n8n instance. n8n itself is not a third-party data processor; the underlying compute is hosted on the practice's Cloudflare Workers infrastructure.
  • Stripe (payment processing): invoice payments are processed by Stripe; the practice does not store card numbers.

4. How I Use Your Information

I use the information I collect to:

  • Confirm and conduct booked calls (Cal.com handles the calendar logistics; I receive the resulting calendar invite and email).
  • Reply to direct emails sent to support@digicatalyst.ca.
  • Improve the site and the productized scripts using anonymised, aggregate analytics data.
  • Send marketing communications only if you have given express or implied consent under Canada's Anti-Spam Legislation (CASL). You can opt out of any marketing email by replying with the word "unsubscribe" or clicking the unsubscribe link in the message.

5. How I Share Your Information

I do not sell, rent, or trade your personal information. The only third parties who receive your data are the processors named in Section 3, and only for the operational purpose described.

  • Legal requirements: I may disclose information when required by Canadian law, by court order, or when necessary to protect against fraud or harm.
  • Business transfers: if the practice is acquired or merged, your information may be one of the assets transferred. Any acquirer would be bound by the same privacy commitments.

6. Data Security and Retention

I use industry-standard security measures, including encryption in transit (HTTPS) and access controls on email and calendar systems, to protect your information. I retain personal information only as long as needed for the purpose it was collected, or as required by law.

  • Cal.com bookings: retained per Cal.com's policy (typically until you delete your booking or the calendar event ages out). The practice retains a copy of each booking confirmation email indefinitely unless deleted.
  • Email correspondence: retained in the Google Workspace mailbox indefinitely unless deleted.
  • Web analytics: aggregated and anonymised; raw IP-level data retained no longer than 30 days.
  • Voice-call recordings and transcripts (AI Voice Receptionist): call audio is retained for 30 days for quality and dispute resolution; transcripts are retained for 12 months unless the customer requests earlier deletion.

Breach notification: if I become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm (PIPEDA standard) or otherwise meets a regulatory notification threshold under any applicable US state law, I will notify the Office of the Privacy Commissioner of Canada (where required), the relevant state authority, and you directly, without unreasonable delay and within timelines required by law.

7. International Data Transfers

Some of the third-party processors (Cal.com, Cloudflare, Google) operate servers in the United States. By submitting information to the site, you consent to that data being transferred to and processed in the United States, where data protection laws may differ from your jurisdiction. I require contractual data-protection terms from each US-based processor (Cal.com, Cloudflare, Google, Stripe, Anthropic, Deepgram, Twilio) consistent with PIPEDA's accountability principle for cross-border transfers.

8. Your Privacy Rights (Canada and United States)

Depending on where you live, you may have specific rights regarding your personal information.

8.1 Canadian Residents (Under PIPEDA)

  • Access: request a copy of the personal information I hold about you.
  • Correction: request correction of any inaccurate or incomplete data.
  • Withdraw consent: withdraw consent for the use of your information (subject to legal or contractual constraints).
  • Deletion: request deletion of your personal data from my systems and from third-party processors where I have control to do so.

8.2 United States Residents

  • Right to know: request disclosure of categories and specific personal information collected, sources, business purpose, and recipients.
  • Right to delete: request deletion of your personal information, subject to legal exceptions.
  • Right to correct: request correction of inaccurate personal information (CPRA, VCDPA, CPA, CTDPA, UCPA, OCPA, FDBR, MD, etc.).
  • Right to opt out of sale or sharing: opt out of any sale or sharing for cross-context behavioural advertising. The practice does not sell personal information and does not share it for cross-context behavioural advertising.
  • Right to limit use of sensitive personal information (CPRA-defined): the practice does not collect or use sensitive personal information for purposes beyond what is necessary to provide the service you booked or purchased.
  • Right to non-discrimination: receive equal service regardless of whether you exercise your privacy rights.
  • Global Privacy Control (GPC): the site honors browser-level GPC opt-out signals as a valid request to opt out of sale/sharing where applicable.

8.3 How to Exercise Your Rights

Email me at support@digicatalyst.ca with the subject line "Privacy request." I'll verify your identity (typically by confirming the email is the one tied to your booking or message) and respond within 30 days for Canadian requests, 45 days for US requests.

9. Cookies and Tracking Technologies

The site uses minimal cookies. Strictly necessary cookies: session persistence on the Cal.com booking widget. Analytics cookies: Cloudflare Web Analytics uses no client-side cookies. No third-party advertising trackers are present on this site. You can disable cookies in your browser; the Cal.com widget will not function without them. The site honors browser-level Global Privacy Control (GPC) signals as an opt-out where applicable.

10. Changes to This Privacy Policy

I may update this policy periodically. Any material change will be reflected by an updated "Last updated" date at the top of this page. If the change affects how I handle data you've already given me, I'll email you directly using the address on file.

11. Children's Privacy

The services are intended for business owners and professionals, not children. I do not knowingly collect personal information from anyone under 18. If I learn that I've inadvertently collected information from a minor, I'll delete it.

12. Contact

For privacy questions, requests, or concerns, contact me at:

Kaustubh Ghodke o/a DigiCatalyst Systems

Email: support@digicatalyst.ca

BN: 779120153 RT0001

Privacy Officer: Kaustubh Ghodke (designated under PIPEDA Schedule 1, Principle 1 — Accountability).

Toronto, Ontario, Canada