How CallCraft handles your data.

02 — Where transcripts live

Postgres on Polsia, in-region.

Transcripts, generated deliverables, brand profiles, and pricing ladders are stored in a managed Postgres instance Polsia provisions for CallCraft. Database connections are TLS 1.2+ only; access is gated by the better-auth session on the request and scoped by userId in every query — no row is reachable across accounts.

The Postgres volume itself is encrypted at rest by the underlying cloud provider; the file-system layer is the same one your AWS / GCP / enterprise Postgres data sits on, and TLS in transit is enforced by the platform’s TLS terminator (proxy.ts) in front of every /api route.

03 — Retention & deletion

90-day read-only post-cancel window, then gone.

On cancel, your account becomes read-only for 90 days. You can log in, read every saved deliverable, and export everything (transcripts, recap, SOW, proposal, follow-up email, brand profile) — nothing on your side is deleted during that window. Only the Account row itself is removed at the end of the 90 days, and only if you have not resubscribed.

Outside the post-cancel window, data stays as long as the account is live and is removed on account closure. Cold-deleted in the sense that there is no aggressive deletion in the meantime — no rolling 30-day wipe of working data, and the only "live" thing the closure wipes is the Account record itself.

04 — AI subprocessor

Polsia AI proxy — Anthropic-compatible, opaque to training.

Generation runs through Polsia’s managed AI proxy (the agent-sdk / Anthropic-compatible /v1/messages endpoint surfaced from src/lib/polsia-ai.ts). Polsia routes the call to the underlying model — CallCraft never sees the underlying model name in the request, only "Polsia AI proxy" as the subprocessor name. The prompt is the transcript plus your brand profile; the response is the markdown that becomes your deliverable. No data is logged beyond the request; no model is fine-tuned on it.

CallCraft sends the prompt → receives the markdown, and that is the only interaction. Polsia does not sell or sub-license the transcript to a third party. There is no training pipeline the transcript flows into — the model is fixed.

05 — Training opt-out

Your data is not used to train any model.

This is the call most B2B buyers want explicit: client call transcripts, brand profiles, and pricing ladders in CallCraft are NOT used to train any AI model — not by CallCraft, not by Polsia as the AI-proxy subprocessor, not by the underlying model provider. The model that drafts your deliverable is a fixed production model; the only learning is the per-request inference. Generated outputs do not feed back into model weights.

There is no opt-in / opt-out toggle because there is nothing to opt into: training is not happening on your data. If this ever changes, the change ships in a release-note entry and the relevant FAQ item is rewritten first.

06 — Account closure

What is deleted when you close the account.

On account closure (a button in /app/account, equivalent to a Self-delete) the Account row is removed and the Session row is revoked. Linked rows (transcripts, generated deliverables in all four flavors, brand profile, pricing ladder, billing history) are deleted in the same transaction; related row counts are reported back to the closure route so the user sees what was wiped.

Backups: managed-Postgres backups are retained on the platform’s rolling schedule, so a record may persist in a backup for up to 30 days after the live row is deleted. Backups are not used to restore a closed account.

07 — Encryption

TLS 1.2+ in transit, encrypted at rest.

In transit: every request to CallCraft is TLS 1.2 or higher. The platform proxy terminates TLS in front of every /api route and the app front door, and the AI proxy is also reached over TLS — there is no plaintext request inside the data plane and no plaintext path between the SDK and Polsia /v1/messages.

At rest: Postgres volumes are encrypted at rest by the underlying cloud provider (the provider’s KMS-managed disk encryption). The Postgres TLS mode is set to require, database connections are short-lived, and credentials are rotated from the platform secret store. There is no separate encryption key the customer has to manage.

08 — Subprocessors

The full list, by name.

A "subprocessor" is a third-party service that processes customer data on CallCraft’s behalf. The list below is the complete set as of today — the same names appear in the Terms of Service and Privacy Policy, and the same list is updated here first when a new subprocessor is added.