Privacy policy
What Borinken Labs collects, why, who else handles it and how long we keep it. Most of this page is about people who call a business that uses Recepción — people who never visited this site and never signed anything. They come first.
Who is responsible
Borinken Labs LLC, doing business as Borinken Labs, registered in Puerto Rico. Questions go to hola@borinkenlabs.com.
This is the privacy notice Puerto Rico’s Ley 39-2012 asks of anyone who keeps the phone numbers or voice recordings of people in Puerto Rico. Anyone can ask us for it, and we give it.
If you called a business that uses Recepción
When you call, an assistant answers. Before anything is recorded it says whose assistant it is, that the call is recorded and transcribed, that the business may text you at your number, and asks whether you agree. Nothing is recorded until you say yes. The exact words are on our consent page.
If you say no, say nothing, or the assistant does not understand you, it records nothing. The business is told only that your number called, and when.
If you say yes, we keep: your phone number; the recording of the call; a written transcript of it; and a short summary of what you asked for, written by a language model from the transcript. The assistant asks you for your name, your address and what you need, so those are usually in there too — along with another number or a way to reach you, if you gave one. It asks; it does not look you up anywhere.
What it is for: so that the business you called can call you back and do the job. Nothing else. We do not sell it, we do not use it for advertising, and we do not use it to train any model.
Whose it is: the business you called. We hold it on their behalf.
How long: the recording is kept for the number of days the business chose — at most ninety — and then deleted. The transcript and the summary are kept for one year, then deleted. A call where you said no keeps only your number and the time, for one year. When a business stops using Recepción, its callers’ data is deleted thirty days later. After anything is deleted, a copy can survive a while longer in our encrypted backups, until that backup is replaced by a newer one.
Where the recording actually is, and the second copy. The audio never sits on our own server: it stays with Twilio, the company that carries the calls, and our server holds a reference to it. So there are two copies, and they are deleted by two different acts. If you decline the recording, Twilio’s copy is deleted the moment it exists — that runs today. Otherwise deleting their copy at the end of the period above is a separate step, and on the date at the top of this page it was not yet built. We would rather write that here than let you assume it.
If the business texts you back about your call, that is a reply to your call, by text message. Reply STOP and the messages stop; the phone network acts on that word before it ever reaches us. You can also just tell the business you do not want messages — they record it, and nothing goes to your number again.
Your rights: ask the business, or ask us, to let you hear your recording, to give you a copy, to correct it, or to delete it. Write to hola@borinkenlabs.com with the number you called from and the business you called. We answer within one business day and act within ten business days. You can also complain to DACO, Puerto Rico’s consumer affairs department.
If you are a business that works with us
We keep what you gave us to work together: your name, your business’s name, your phone, email and address, what you told us about the business, and — for Recepción — your hours, your greeting settings, who to reach when a call is urgent, and the customer book the assistant fills for you.
Billing: Stripe handles your card. We see the brand and the last four digits, never the number.
If you buy Promociones we also keep what the carriers make us collect before you can send a promotional text: your exact legal business name, your EIN, your website, and the name, title, email and phone of the person who authorised it. The next section says where that goes.
It is used to provide the service, to invoice you and to answer you. It is kept while you are a customer and for six years afterwards, because tax law makes us keep invoices.
If you visit this website
No analytics, no advertising, no tracking cookies. One cookie is set when the contact form is shown; it stops the form being posted from another site and identifies no one.
Cloudflare sits in front of the site and sees your IP address in passing, as does our server, which keeps ordinary access logs.
The contact form — your name, business, number and message — goes into our database so we can reply and keep track of the conversation. If you do not become a customer, it is deleted after twelve months.
Who else handles the data
Twilio carries the calls and the messages, turns speech into text and text into speech, and stores the recordings on its own systems. It is in the United States.
OpenAI writes the summary of a call from its transcript, under terms that do not allow it to train on the data. It is in the United States.
Akamai (Linode) runs our servers, in Miami, Florida, where the transcripts, the summaries and the customer books are stored. The recordings are not there; they are at Twilio.
Cloudflare stands in front of our websites and carries their traffic.
Stripe takes the payments and holds the cards.
The carriers’ registry, but only for Promociones. Before a business can send promotional texts in the United States, the phone carriers require it to be registered. We hand Twilio and the industry registry the carriers run that business’s legal name, its EIN, its website and the name, title, email and phone of the person who authorised it. There is no way to send those messages without it, and it applies to nobody else.
Meta handles WhatsApp, and today that means one thing only: if you write to Borinken Labs on WhatsApp, Meta carries that conversation. Recepción does not send or receive anything on WhatsApp, Instagram or Messenger. When it does, this page will say so before it starts.
Each of them is under a contract that limits what it may do with the data to the work it does for us. We share the data with nobody else, unless the law obliges us to. If we add one, we update this page and the date at the top.
How it is protected
Recordings and transcripts are encrypted while they travel between you, the business and us, and backups are encrypted before they leave the server. The server itself is locked down and only we can reach it. Each business sees only its own calls, and every time somebody listens to a recording we record who it was.
If a breach exposes personal information, we tell the businesses affected, the people affected when the law requires it, and DACO within ten days, as Ley 111-2005 requires.
Changes to this policy
The date at the top is the date of the last change. Businesses that work with us are emailed thirty days before a change takes effect. A change that widens what we collect or who handles it never applies to data already collected without asking first.
Questions
hola@borinkenlabs.com. We answer within one business day.