Privacy Policy

Last Updated & Effective Date: August 29, 2026

Our Core Privacy Commitment

At EscapeGoatAgent, we treat your privacy as essential to the utility of our app. We collect only what is strictly required to place your rescue phone calls, verify your account, and manage your credits. We do not sell your personal data. We do not track your cross-app browsing. We do not maintain permanent audio recordings of your conversational rescue calls.

Table of Contents

  1. Introduction & Scope

  2. Personal Data We Collect

  3. Real-Time Voice & Audio Processing Pipeline

  4. Legal Bases for Processing (GDPR)

  5. How We Use Your Personal Data

  6. Third-Party Processors & Infrastructure

  7. Data Retention & Right to Be Forgotten

  8. In-App Account Deletion Mechanism

  9. Your Rights (GDPR, CCPA/CPRA, Global)

  10. California Consumer Privacy Notice

  11. Data Security & Encryption

  12. Children's Privacy (Strict 18+ Requirement)

  13. International Data Transfers

  14. Contact Our Data Protection Officer

1. Introduction & Scope

EscapeGoatAgent Inc. ("EscapeGoatAgent", "we", "us", or "our") respects your privacy and is dedicated to protecting your personal data. This Privacy Policy applies to personal data collected through the EscapeGoatAgent iOS mobile application (the "App"), our web services at escapegoatagent.com (the "Site"), and our conversational telephony APIs (collectively, the "Service").

This policy outlines how we handle, process, secure, and delete your information in full compliance with the European Union General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the Telephone Consumer Protection Act (TCPA).

2. Personal Data We Collect

We collect the minimum necessary data to deliver realistic, believable rescue calls. Data collection categories include:

CategoryData Elements CollectedPurpose & NecessityAccount & Identity DataEmail address, hashed password/authentication tokens, unique user UUID.User authentication, account recovery, session management, security.Telephony & Contact DataVerified mobile phone number (E.164 format), country code.Directing outbound automated rescue calls via PSTN carrier.Rescue Scenario VariablesCustom contextual inputs: boss name, project name, pet name/breed, child name/age, roommate name, specific situation details (e.g. "server outage", "vet appointment").Dynamic injection into AI persona prompt to generate contextual, believable conversations.Call Metadata & LogsCall SID (carrier identifier), scheduled execution time, timestamp, call duration, completion status (e.g., completed, busy, failed, no-answer).Delivery diagnostics, refunding failed credits, customer support, abuse prevention.Billing & Purchase RecordsApple StoreKit transaction IDs, active subscription tier, credit balance. (Note: Apple handles and secures all raw credit card and banking details.)Entitlement verification, credit deduction, subscription status tracking.

3. Real-Time Voice & Audio Processing Pipeline

When an EscapeGoatAgent rescue call is answered, our conversational AI system conducts a real-time two-way dialogue to maintain high believability. Here is how your voice data is processed:

  • Live Audio Ingestion: Your spoken voice audio is routed through our telephony carrier (Twilio Inc.) to our voice processing sub-processor (ElevenLabs Inc.).

  • Real-Time Speech-to-Text & Response Generation: Audio is converted to text stream fragments, evaluated by the conversational agent model to formulate contextually appropriate responses based on your chosen scenario, and converted into synthetic speech (Text-to-Speech).

  • Zero Long-Term Storage Policy: Spoken audio streams are processed ephemerally in volatile memory (RAM) for the live duration of the call. We do not save, archive, transcribe for public indexing, or sell your call audio recordings. Once the telephony call ends, audio buffers are discarded.

4. Legal Bases for Processing (GDPR)

Under the EU/UK GDPR, we process your personal data under the following lawful bases:

  • Performance of a Contract (Art. 6(1)(b) GDPR): Processing your phone number, scenario variables, and initiating calls is necessary to provide the rescue service you explicitly request.

  • Consent (Art. 6(1)(a) GDPR): When you grant explicit authorization to receive automated AI calls and real-time voice processing.

  • Legitimate Interests (Art. 6(1)(f) GDPR): For security monitoring, fraud prevention, abuse rate-limiting, and failed-call refund reconciliation.

  • Legal Obligation (Art. 6(1)(c) GDPR): Retaining financial transaction records for tax, accounting, and consumer compliance obligations.

5. How We Use Your Personal Data

We use your information exclusively to:

  1. Originate and execute outbound rescue calls requested via scheduled or rush triggers;

  2. Inject your custom scenario variables into the ElevenLabs conversational persona;

  3. Credit your account automatically if a scheduled call fails or is disconnected prematurely;

  4. Provide you with an in-app "Rescue History" and recap so you can review what details were used;

  5. Manage in-app purchase entitlements and subscriptions via Apple StoreKit;

  6. Enforce our Terms of Service, anti-harassment rules, and fair use limits.

6. Third-Party Processors & Infrastructure

We partner with industry-leading, enterprise-grade cloud and telecommunication providers. All sub-processors are bound by strict Data Processing Addendums (DPAs) and confidentiality agreements:

Sub-ProcessorRole / ServiceData TransferredPrivacy & SecurityTwilio Inc. (USA)Telecommunications carrier & PSTN voice call originationUser phone number, call status callbacks, live audio stream bridge.SOC 2 Type II, ISO 27001, HIPAA & GDPR compliant.ElevenLabs Inc. (USA)Conversational AI voice engine & real-time TTS/STT synthesisEphemeral voice stream, custom scenario variables (e.g., names, reasons).Enterprise encryption, no user data used to train public foundation models without consent.Apple Inc. (USA / Global)In-App Purchases & StoreKit subscription billingTransaction IDs, receipt data, anonymized Apple user identifiers.PCI-DSS Level 1 compliant payment processor.Supabase Inc. / Cloud Hosting (USA)Encrypted database, authentication & user profile storageUser email, hashed credentials, credit balance, scenario logs.PostgreSQL with Row Level Security (RLS), AES-256 encryption at rest.

7. Data Retention & Right to Be Forgotten

We adhere to strict data minimization principles:

  • Scenario Variables: Retained inside your private account profile until you edit them or delete your account.

  • Call Logs & History: Call metadata (timestamp, scenario name, call SID, duration) is stored in your private history until deleted by you or upon account deletion.

  • Voice Audio: Ephemeral only. Discarded immediately after call termination.

  • Purchase History: Retained for 7 years to comply with statutory accounting and tax regulations.

8. In-App Account Deletion Mechanism

🗑️ Immediate In-App Deletion: You can completely delete your EscapeGoatAgent account, profile, phone number, custom scenario data, and rescue history directly from inside the App at any time.

To delete your data within the App:

  1. Open the EscapeGoatAgent iOS App;

  2. Navigate to Settings > Account;

  3. Tap Delete Account & Data;

  4. Confirm your selection.

Upon confirmation, our backend executes a permanent cascading delete across all Supabase database tables associated with your user ID. You may also request deletion by emailing privacy@escapegoatagent.com.

9. Your Rights (GDPR & Global Privacy Frameworks)

Depending on your location, you have the following enforceable privacy rights:

  • Right of Access: Request a full copy of the personal data we hold about you.

  • Right to Rectification: Correct inaccurate or incomplete personal information in your settings.

  • Right to Erasure ("Right to be Forgotten"): Permanently wipe your user account and call history.

  • Right to Restriction of Processing: Restrict how we process your information under certain conditions.

  • Right to Data Portability: Receive your account and rescue history in a structured, machine-readable JSON format.

  • Right to Withdraw Consent: Revoke authorization for outbound calls or delete your registered phone number at any time.

  • Right to Lodge a Complaint: File a complaint with your local Data Protection Authority (DPA).

10. California Consumer Privacy Notice (CCPA / CPRA)

This section applies specifically to residents of California pursuant to the California Consumer Privacy Act of 2018 as amended by the CPRA:

  • No Sale or Sharing of Personal Information: We do NOT sell your personal information, nor do we share your personal data for cross-context behavioral advertising.

  • Categories of Data Collected in the Preceding 12 Months: Identifiers (email, phone number), commercial information (subscription status, credits purchased), internet/network activity (app logs), and audio/electronic data (ephemeral conversational voice processing).

  • Non-Discrimination: We will never discriminate against you, deny you services, charge you different prices, or provide a different quality of service because you exercised your CCPA/CPRA rights.

  • Submitting CCPA Requests: California residents can exercise their access and deletion rights via in-app settings or by emailing privacy@escapegoatagent.com with the subject line "California Privacy Request".

11. Data Security & Encryption

We implement state-of-the-art administrative, technical, and physical safeguards:

  • Encryption in Transit: All data transmitted between the iOS app, backend API endpoints, Twilio, and ElevenLabs uses TLS 1.3 encryption.

  • Encryption at Rest: All database storage, profile data, and metadata are encrypted at rest using AES-256 encryption.

  • Row Level Security (RLS): Our database enforces strict Postgres Row Level Security policies, ensuring that users can only query and mutate their own rescue records.

  • Zero Plaintext Credentials: Authentication tokens and keys are securely hashed using modern cryptographic algorithms.

12. Children's Privacy (Strict 18+ Requirement)

EscapeGoatAgent is strictly intended for individuals who are 18 years of age or older. We do not knowingly solicit or collect personal information from children under the age of 18 (or under 16 in the EEA/UK). If we discover that a user under 18 has created an account or registered a phone number, we will immediately terminate the account and purge their data from our systems.

13. International Data Transfers

Your information may be transferred to and maintained on servers located in the United States. Where we transfer personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries that have not received an adequacy decision, we rely upon European Commission-approved Standard Contractual Clauses (SCCs) and robust technical safeguards.

Help

Questions? Reach out anytime.

Email

Call

support@escapegoatagent.com

© 2025. All rights reserved.