Security and data handling
RepCabin, a product of WhichAI LLC. Matches the legal pages effective 2026-10-14. Written for the person who reviews vendors.
What we keep
- Call audio is not saved. It streams to the voice provider during the call and is discarded.
- A transcript, a score and a review of each practice call are kept in your workspace.
- We do not create voiceprints and we never see full card numbers. Stripe holds them.
How long we keep it
| Transcripts, scores and reviews | For the life of the subscription by default. The owner can set transcript retention to 90, 180 or 365 days, and older calls are then deleted automatically. |
|---|---|
| A rep's own records | A rep can delete their own practice records and their own account. |
| The workspace | Deleted 60 days after the subscription ends, or 30 days after a confirmed closure request. |
| Per-call scratch data | Deleted at 30 days. |
| Sign-in records | Deleted at 7 days. |
| Email logs | Deleted at 90 days. |
| Consent records | Kept 3 years. |
| Billing records | Kept 7 years. |
| Database recovery | Cloudflare database recovery can hold deleted rows for up to 30 days. |
Who processes data
| Google Gemini API | Voice and scoring text, on a paid project. Google's published terms say it does not use paid API prompts or responses to improve its products. Google keeps abuse-monitoring logs for a limited period, up to 55 days under its policy. |
|---|---|
| Cloudflare | Hosting, database and live call servers. |
| Stripe | Payments. |
| Zoho | Support email. |
| Telegram | Alerts to the founder. No customer content is sent. |
We do not train any model on customer content.
Access and sign-in
- People sign in with Google or with a one-time link sent to their company email. There are no passwords.
- Every query is scoped to the workspace of the signed-in member.
- Your company decides who has a seat. When your company removes someone, their access ends at once.
- The owner can transfer ownership to a manager.
- Traffic uses TLS. Data at rest is encrypted by Cloudflare.
What we do not claim
- We hold no third-party audit report or attestation, and we have not started one.
- No independent penetration test has been completed.
- There is no single sign-on, no multi-factor sign-in inside RepCabin, no customer-managed keys and no choice of data region.
- We make no uptime commitment.
Incidents and questions
If we confirm a security incident that affects your data, we email the workspace owner within 72 hours of becoming aware. We answer security questionnaires within 5 business days. Write to ibrahim@repcabin.com.
The full documents: Security, Privacy, Data Processing Addendum, Subprocessors, Terms.