Herald Privacy Policy

Last updated: July 12, 2026

This Privacy Policy describes how Virtual Guardians, LLC ("Virtual Guardians," "we," "us") collects, uses, and protects information in connection with Herald — our screen-pop and CRM-integration service for Cisco Webex Calling (including the Herald web application at herald.virtual-guardians.com, the Herald embedded sidebar app inside the Webex App, and the Herald administrative consoles) (together, the "Service").

Herald is a business-to-business service. We provide it to companies (our "Customers"), whose call-center agents and administrators ("Users") use it in the course of their work. Herald connects a Customer's Webex Calling to the Customer's own CRM system (the "connected CRM" — currently HubSpot, with other CRMs planned).

1. Our two roles

We handle information in two distinct capacities:

• As a processor / service provider. Call data and CRM data flow through Herald on behalf of, and under the instructions of, the Customer organization that subscribed to the Service. The Customer — not Virtual Guardians — decides what phone system events and CRM records Herald may access. Our Data Processing Addendum governs this processing.
• As a controller. We are responsible for the account, billing, and support information we need to run our own business (for example, administrator contact details and subscription records).

2. Customer responsibilities and the limits of ours

Customers are responsible for determining what information is stored within their CRM and other connected systems, which integrations are enabled, what permissions are granted to Herald, and for ensuring they have all required legal authority, notices, and consents necessary to use the Service (including any consents required for call monitoring, recording, or transcription).

Herald displays and transfers information provided by the systems the Customer connects. Virtual Guardians does not verify the completeness, accuracy, or timeliness of information returned by those systems. In particular:

• Caller matching depends on telephone network information and the Customer's CRM records. Matches may not always be accurate, and Users remain responsible for verifying displayed information before relying on it.
• AI-generated content (call transcripts and summaries) displayed or transferred by Herald is generated by Cisco Webex or other connected services under the Customer's own configuration. Herald does not independently generate, modify, validate, or verify AI-generated content.
• Third-party availability. Certain functionality depends on the availability of Cisco Webex, the connected CRM, Google Cloud Platform, and other connected services. Virtual Guardians is not responsible for inaccurate CRM records, incorrect caller identification, AI-generated content errors, Customer data quality or permission configuration, third-party platform outages or API changes, or misuse of the Service — see the Terms of Service for the governing provisions.

3. Information we process

Account and administrative information (we are the controller)

• Names, work email addresses, and Webex identifiers of Customer administrators and agents who sign in to Herald;
• Organization details: company name, Webex organization ID, license/seat assignments and tier (Standard or Pro);
• Billing records (company name, billing contact, seat counts). Payments are handled by our billing provider; Herald does not collect or store payment card numbers;
• Support and sales communications you send us.

Call event data (we are a processor)

When an inbound call rings a User's Webex Calling line, Cisco Webex sends Herald a call notification containing the caller's phone number, the network-provided caller name, the called agent's Webex identifier, a call identifier, and timestamps. Herald uses this to look the caller up in the Customer's connected CRM and show the answering agent who is calling. If a caller has withheld their number (private/anonymous calling), Herald performs no CRM lookup for that call.

CRM data (we are a processor)

With the Customer's authorization, Herald searches the Customer's connected CRM (currently HubSpot) for contacts matching the caller's phone number and displays matching contact details to the answering agent (such as name, title, company, lifecycle stage, record owner, and related records the CRM returns). For Customers on the Pro tier, Herald can also write to the connected CRM: it logs completed calls as CRM call activities (direction, ring/talk duration, outcome) and, where the Customer has enabled Webex call recording with AI summaries, appends the Webex-generated call transcript or AI notes to that CRM call record. Herald retrieves transcript content from Webex transiently for this purpose and does not keep its own copy; Herald never accesses or stores call audio.

Authorization tokens

Herald stores the OAuth tokens that Users and administrators grant it (Webex and the connected CRM). Tokens are encrypted at rest with AES-256-GCM; encryption keys are held in Google Secret Manager. Herald never stores customer passwords — sign-in always happens on the connected platform's own pages. Herald requests only the narrow permission scopes it needs (for example, reading the signed-in User's own incoming-call events and profile), and tokens are revoked and deleted when a User is offboarded, an integration is disconnected, or authorization is revoked.

Technical and diagnostic information

• Service logs: tenant and call identifiers, timestamps, processing/API status, match results, and delivery status, kept for troubleshooting and reliability. Caller numbers in logs are redacted to their last four digits. Logs never contain call transcripts, CRM notes or contact details, call recordings, OAuth tokens, or complete phone numbers;
• Client diagnostics from the pop and sidebar interfaces: browser and operating-system type, connection events, and error reports;
• Audit logs of administrative and vendor actions (who did what, when).

4. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising;
• We do not use Customer call or CRM data to train AI or machine-learning models;
• We do not access or store call audio recordings;
• We do not build our own marketing database from the contacts in a Customer's CRM;
• We do not use advertising analytics or behavioral tracking technologies;
• We do not make automated decisions that produce legal or similarly significant effects concerning individuals;
• We process only the minimum data necessary to provide the requested functionality, and request only the minimum third-party permissions necessary.

5. Health information (HIPAA)

Herald is not designed to independently collect Protected Health Information ("PHI"). Any PHI processed through Herald results solely from the Customer's configuration of connected systems (for example, PHI the Customer keeps in its own CRM fields or that appears in its own call transcripts). Virtual Guardians is not a Covered Entity under HIPAA. Where required for a healthcare Customer, Virtual Guardians will execute a separate Business Associate Agreement (BAA) — contact info@virtual-guardians.com.

6. Cookies

Herald uses only essential first-party cookies: session and authentication cookies that keep Users, administrators, and vendor staff signed in, and short-lived cookies that protect sign-in flows (OAuth state). These are HttpOnly where the browser permits and are not used to track you across other sites. Herald sets no advertising cookies and no third-party tracking cookies, and uses no third-party analytics services. The installable pop app uses standard browser storage to cache its own interface files.

7. How long we keep information

We keep Customer Data no longer than necessary to provide the Service:

Data	Retention
Screen-pop delivery events (event bus)	Expire 10 minutes after the call; automated deletion completes within ~24 hours of expiry
Per-call records (call status, CRM record linkage)	No longer than necessary to provide the Service — typically ~24 hours after the call; automated deletion completes within ~24 hours of expiry
Operational and diagnostic logs	~30 days (Google Cloud Logging default)
OAuth tokens	Deleted when a User is offboarded, an integration is disconnected, or authorization is revoked
Account, license, and audit records	Life of the Customer's subscription, then deleted per the DPA; billing records kept as required by law

Data Herald writes into the Customer's connected CRM (call logs, transcripts/AI notes) lives in the Customer's own CRM account and is governed by the Customer's agreement with that provider and its retention practices, not by this table.

8. Who we share information with

• Subprocessor — Google LLC (Google Cloud Platform). Herald is hosted on Google Cloud (currently Cloud Run, Firestore, Secret Manager, and Cloud Logging, including successor products) in the us-east1 (South Carolina, USA) region. Google processes data solely to provide us infrastructure.
• Billing — Rev.io. Our billing platform receives Customer company information, billing contacts, and subscription/seat information — never call metadata, CRM data, or transcripts.
• Platforms you connect. Cisco Webex and the connected CRM (e.g., HubSpot) process your data under your own agreements with them. Herald exchanges data with those platforms only as authorized by your organization's administrators and Users.
• Legal. We may disclose information if required by law, or to protect our rights, our Customers, or the public. We will notify the affected Customer before disclosure whenever we are legally permitted to do so.
• Business transfers. In a merger or sale of our business, information may be transferred with notice where lawful; any successor organization remains bound by this Privacy Policy until a replacement policy becomes effective.

Our vendors may access information only to provide their contracted services and are contractually obligated to protect it. We will notify Customers before adding or replacing subprocessors, as described in the DPA.

9. Security

All traffic is encrypted in transit (HTTPS/TLS). Webhooks from Webex are authenticated with HMAC signatures. Tokens are encrypted at rest (AES-256-GCM) with keys in Google Secret Manager, and Virtual Guardians does not store customer passwords. Administrative access is granted only to authorized personnel with a legitimate business need, requires multi-factor authentication, and every administrative action is audit-logged. Herald requests least-privilege OAuth scopes from Webex and the connected CRM. Our security controls are periodically reviewed and updated. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures, and we will notify affected Customers without undue delay if we become aware of a personal-data breach.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information.

• Agents and callers: because Herald processes call and CRM data on behalf of the Customer organization, please direct requests to that organization (your employer, or the company you called). We will assist the Customer in fulfilling verified requests.
• Administrators and billing contacts: contact us directly at info@virtual-guardians.com.

We do not sell or "share" (as defined by the California Consumer Privacy Act) personal information, and we act as a "service provider" with respect to Customer data under that law. We do not discriminate against anyone for exercising privacy rights.

11. Where data is processed

Herald currently operates only within United States infrastructure: it is operated from the United States and hosted in the us-east1 (South Carolina) Google Cloud region. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

12. Children

Herald is a workplace tool and is not directed to children under 16. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL and update the "Last updated" date; for material changes we will also notify Customer administrators.

14. Contact us

Virtual Guardians, LLC
1608 Queen Street #21, Wilmington, NC 28401, USA
info@virtual-guardians.com · (910) 530-1600