Privacy Policy

Oncall (“Oncall,” “we,” “us,” or “our”) is a calendar based lead routing tool for Follow Up Boss. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your information when you use our website at oncallhq.app or our application services.

We collect the following categories of information:

From you directly

• Account information: name, email address, brokerage name, and any other details you provide when creating an account or contacting support.
• Availability submissions: the days you mark as unavailable for on call duty, plus optional notes you write on your availability form.
• Schedule overrides: manual changes you make to the auto-generated calendar (e.g., reassigning a shift).
• Display preferences: nicknames or display name overrides you set for team members.

From Follow Up Boss

When your brokerage admin connects Oncall to your Follow Up Boss account, we receive the following user data from Follow Up Boss for each member of your team: name, email address, phone number (if available), profile picture URL, role (Agent, Broker, etc.), and active/inactive status. We also read and update the membership of FUB Groups so we can route leads based on your shift calendar.

Lead data (from Follow Up Boss)

To route leads and show your team’s lead activity, Oncall also reads information about the leads (consumers) in your Follow Up Boss account, such as a lead’s name, source, assigned agent, creation date, and recent contact activity (calls, texts, and notes). This is used only to route new leads to the on call agent and to display the analytics in your dashboard. We do not store lead data in our database. It is fetched from Follow Up Boss as needed and held briefly in a temporary cache (a few minutes) to keep the dashboard responsive, then discarded. Your brokerage remains the owner and controller of this data; Oncall acts as a processor on your behalf.

From Google (if you opt in)

If you connect your Google Calendar to Oncall, we receive an OAuth access token and refresh token that allow us to create, update, and delete events on your calendar. We use this access ONLY to sync the shifts we’ve scheduled for you. We do not read, modify, or delete any other events on your calendar.

Oncall’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the calendar-sync feature you enabled, and do not allow humans to read it except with your consent, for security, or as required by law.

Automatically

Standard server logs (IP address, browser type, request paths, timestamps) for security and operational purposes. We do not use third party analytics, tracking pixels, or advertising cookies.

• To operate and maintain the Oncall service.
• To generate and update your team’s shift schedule, including pushing changes to your team members’ Google calendars (if connected) and to Follow Up Boss group membership.
• To send transactional emails (availability reminders, shift assignment notifications, swap requests).
• To communicate with you about service updates, billing, or support requests.
• To investigate and prevent abuse, fraud, or violations of our Terms.

We do not sell your personal information, use it for advertising, or share it with marketers.

We share information only with the following service providers:

• Supabase, our database provider. Stores all application data (account info, schedules, blackout days, tokens). Located in the United States.
• Vercel, our web hosting provider. Receives standard server request logs.
• Resend, our transactional email provider. Receives the recipient email address and email content for messages we send on your behalf.
• Google, which receives shift event details when you opt into Google Calendar sync.
• Follow Up Boss, which receives FUB Group membership updates so leads route correctly.
• Stripe, our payment processor. Receives your billing and subscription details to process payments. Oncall never sees or stores full card numbers.
• Sentry, our error monitoring provider. May receive technical error reports (which can include limited request context) so we can diagnose and fix problems.

We will never share your information with any other third party except: (a) with your explicit consent, (b) to comply with a legal obligation, court order, or government request, or (c) to protect our rights, property, or safety, or that of others.

We retain your account information for as long as your account is active. If you cancel your subscription or delete your account, we will delete your application data within 90 days, except where retention is required by law (e.g., billing records).

You may request deletion of your data at any time by contacting us at the address below.

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information (subject to legal retention requirements).
• Disconnect Google Calendar at any time via the agent form, which immediately revokes our access tokens.
• Export your data in a portable format.

If you are located in the European Economic Area, the United Kingdom, or California, additional rights may apply under GDPR or CCPA. Contact us to exercise any of these rights.

We use industry standard security measures to protect your data: encrypted transit (HTTPS everywhere), encrypted storage at our database provider, and least privilege access controls. No system is perfectly secure; if a breach occurs, we will notify affected users without undue delay.

Oncall uses essential session cookies for authentication only. We do not use third party tracking, analytics, or advertising cookies.

Oncall is a business tool. It is not intended for children under 16, and we do not knowingly collect information from anyone under 16. If you believe we have collected such information, please contact us and we will delete it.

Oncall is operated from the United States. By using the service, you understand that your information will be processed in the United States, where data protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders at least 30 days before they take effect.

For privacy questions or to exercise your rights, contact:

Oncall
Attn: Privacy
Email: privacy@oncallhq.app