Privacy Policy

The data controller is Bx Labs, a French simplified joint-stock company with a sole shareholder (SASU) with a share capital of €1,000, registered with the Paris Trade and Companies Register (RCS) under number 108 596 651, whose registered office is at 9 rue des Colonnes, 75002 Paris, France.

For any question about your data, write to contact@bxlabs.ai.

We process the following data when you use our service:

• Email address and account identifier (registration, sign-in, communication)
• Recipient phone number and prank call scenario
• Audio recording and automatic transcription of calls, and the scenario, voice and transcript of in-browser tests (see below)
• History of your credits and purchases (the payment itself is processed by Stripe: we never receive your card number)
• Only with your consent: audience measurement and advertising cookies (see § 4)
• Only with your separate consent: usage measurement, click maps and session recording, with text and inputs masked (see § 4)
• Page-view measurement, without cookies (see § 5)
• Sign-up and purchases, sent to our internal tracking tool (see § 6)

Call recording and transcription. Every phone call made with PrankCall AI is recorded (both voices: the AI's and the called person's) and automatically transcribed into text. In-browser tests are not recorded, but their scenario, the chosen voice and their transcript are kept. These recordings, transcripts and scenarios are kept for as long as your account exists and are deleted with it. Bx Labs may access them for moderation (compliance with the terms of use, abuse prevention) and for support, and every access is logged. You can replay and download your own calls from your history.

• Providing the service — account, calls, credits, account-related emails: performance of the contract (Article 6(1)(b) GDPR)
• Invoicing and accounting: legal obligation (Article 6(1)(c))
• Moderation and abuse prevention: legitimate interest (Article 6(1)(f))
• Audience measurement and tracking of sign-ups and sales (§ 5 and § 6): legitimate interest (Article 6(1)(f))
• Audience measurement and advertising cookies (§ 4): your consent (Article 6(1)(a)), which you can withdraw at any time
• Experience improvement — usage measurement, click maps and session recording (§ 4): your consent (Article 6(1)(a)), separate from the previous one, which you can withdraw at any time

No measurement or advertising cookie is set until you accept them in the banner ("Accept", or the "Audience measurement and advertising" box). Only with your consent, we load:

• Google Analytics 4 (audience measurement) and Google Ads (conversion measurement), provided by Google Ireland Limited;
• where applicable, the Meta pixel (Meta Platforms Ireland Limited) and the TikTok pixel (TikTok Technology Limited), to measure our advertising campaigns.

If you decline, none of these scripts is loaded. Your choice is kept for six months in a "cookie-consent" cookie, after which you are asked again. You can change it at any time with the "Manage cookies" link at the bottom of every page: withdrawing consent switches these services off and deletes their cookies.

Experience improvement. Only with your consent, given separately in the banner ("Experience improvement" box), we measure how the site is used in order to improve it, with Umami, an open-source tool that Bx Labs hosts itself with Amazon Web Services in France (Paris region, eu-west-3): no data is transferred outside the European Union or entrusted to any other third party. We collect: page views (address without its parameters or anchor, previous page, page title, language, screen size, device type, browser and operating system, country and city derived from the IP address, which is not kept), clicks and scrolling (click maps), and the recording of your sessions (how the page unfolds, 10 minutes at most per page), in which all text and all inputs are masked; sensitive areas (scenario, called number, transcripts, call history and recordings, email address) are not recorded at all. Umami sets no cookie, but its scripts read and write on your device: they are only loaded after your consent, and never in the mobile app. Legal basis: your consent (Article 6(1)(a) GDPR); consent given to audience measurement and advertising does not cover this purpose, and vice versa. Retention: 90 days for session recordings, 13 months for statistics (page views, clicks, scrolling). Your choice is kept for six months in a "ux-consent" cookie. Withdrawing it via "Manage cookies" stops the measurement immediately (the page reloads).

Without consent, the site only uses storage needed for it to work: your sign-in session (Supabase) and the "cookie-consent" and "ux-consent" cookies that remember your choices. If you arrive through a campaign link, its utm_source, utm_medium and utm_campaign tags are kept in your browser (localStorage) only with your consent, to measure the effectiveness of our campaigns; without consent, they are only read from the page address when you create an account (§ 6). Likewise, where your visit came from (the referring site and the landing page, without their parameters) is kept in your browser (localStorage, 30 days) only with your consent; without consent, it is only held in the open page for the duration of the visit, without writing anything to your browser. Withdrawing consent deletes them.

With the same consent, we also measure the steps and results of signup, login, studio use, browser trials and calls, checkout and recording playback; their durations, real page performance (Core Web Vitals) and technical error categories, without error messages or stack traces. For a signed-in account, a pseudonym derived from its identifier using SHA-256 allows us to measure return visits over time. Umami never receives your name, email address, phone numbers, scenario, audio, transcripts or authentication tokens. These statistics and pseudonyms have the same 13-month retention and collection stops when you withdraw this consent.

We count the page views of this site. This measurement is done on the server, for every visitor: it uses no cookie, no local storage and no script in the page. Nothing is written to or read from your device for it, so no consent is required on that ground (article 82 of the French Data Protection Act). It is separate from Google Analytics (§ 4).

What is read but never sent or stored: your IP address and user agent are read only to compute the fingerprint described below, and are discarded with the request. Never sent: the full URL and its parameters (with the sole exception of the campaign tags utm_source, utm_medium, utm_campaign, utm_content and utm_term, when the address carries them), the path of the page that brought you here (only its domain is kept), or any location more precise than the country.

What is sent, for each page view:

• the day (UTC) and the time of sending;
• a daily fingerprint, described below;
• the page path, reduced to the list of published pages;
• the kind of source (search engine, social network, AI assistant, other site, internal link, none) and, where relevant, its domain only;
• where present, the campaign tags (utm_*) of the page address;
• the country, as a two-letter code;
• the device class (desktop, mobile, tablet, bot).

The daily fingerprint is a hash (SHA-256) of your IP address, your user agent, a salt that changes every day and the domain of this site. It is used only to count distinct visitors in a day, and cannot follow you from one day to the next or from one site to another. A day's fingerprint is kept until the end of the second following day (D+2), then deleted by a daily purge at 03:15 UTC — that is, 76 hours at most after it was recorded. Only aggregates remain afterwards (visits, distinct visitors per day, pages, sources, countries, devices), none of which relates to a person.

Recipient: Bx Labs, which receives and aggregates these views in Bx Labs OS, its internal tool, hosted by Convex in the European Union (Ireland). Legal basis: legitimate interest (Article 6(1)(f) GDPR), measuring the audience of our own site — no profiling, no advertising, no matching with any third party. You can object without writing to us: if your browser sends the Global Privacy Control (Sec-GPC) or Do Not Track (DNT) signal, the visit is not measured at all.

When you confirm your sign-up, we send to Bx Labs OS, Bx Labs' internal tool (hosted by Convex in the European Union, in Ireland): your email address, your name if known (otherwise the part of your address before the @), your account identifier, the sign-up date and where your arrival came from: the referring site (without its parameters), the landing page and, if you arrived through a campaign link, its tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term); with your consent to cookies (§ 4), also those of your first visit. We also send your country, derived from your IP address at sign-up (never the address itself), unless your browser signals an opt-out of tracking (Global Privacy Control or Do Not Track). When you buy credits, we send the pack purchased, the number of credits, the amount paid and its currency. At the end of each call, we send its outcome (connected or not, and why), its duration, the country called and its dialling code, and the number of credits, as well as the number called and the text of the prank, for support, moderation and abuse prevention (the same number called from several accounts). When you log in, and at most twice a day when you come back already logged in, we send the date of the login, how you logged in (password, Google, link received by email…) and the type of access (website or mobile app); never your IP address or your browser.

This data is used to follow our sign-ups, our sales and the effectiveness of our campaigns. No payment data (card, IBAN) is sent: payment stays with Stripe. Legal basis: legitimate interest (Article 6(1)(f) GDPR). It is kept as long as your account exists, and your deletion request (§ 9) applies to it as well.

We never sell your data. It is only shared with the providers the service needs, who process it on our behalf:

• Supabase — database and authentication, hosted in the European Union (Paris, France)
• Microsoft Azure — call server and Azure OpenAI voice model, in the European Union (France Central region for the server)
• Twilio — routing of phone calls and recordings
• Stripe — payment for credits (Stripe Payments Europe, Ireland)
• Brevo — account-related emails (France)
• Vercel — website hosting (Vercel Inc., United States)
• Google — Google Analytics and Google Ads (Google Ireland Limited), only with your consent (§ 4)
• Meta — Meta pixel (Meta Platforms Ireland Limited), only with your consent (§ 4)
• TikTok — TikTok pixel (TikTok Technology Limited), only with your consent (§ 4)
• Amazon Web Services — hosting of Umami, Bx Labs' usage measurement tool, in France (Paris region), only with your consent (§ 4)
• Convex — hosting of Bx Labs OS, our internal tool (European Union, Ireland; § 5 and § 6)

When a provider processes data outside the European Union (notably in the United States), the transfer is covered by the European Commission's standard contractual clauses or by the EU–U.S. Data Privacy Framework.

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right to access your personal data
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interest
• Right to withdraw your consent at any time
• Right to give instructions on what happens to your data after your death

To exercise them, write to contact@bxlabs.ai. If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, France, or at www.cnil.fr/fr/plaintes.

You can request the complete deletion of your data at any time by writing to contact@bxlabs.ai. We will process your request within 30 days. Deleting your account also erases the recordings, transcripts and scenarios of your calls. Accounting records related to your purchases are kept for the period required by law.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, modification, disclosure, or destruction.

For any question about this privacy policy, write to Bx Labs: contact@bxlabs.ai.