PRIVACY
Privacy notice (GDPR)
Last reviewed 19 Aug 2026
1. Who controls the data
For personal data about your own callers, you are the controller and we act as a processor on your instructions. For account data about your workspace users, we are the controller. The legal entity, its registered address, and its EU representative where one is required are the fields still to be filled in before this notice is published.
2. What we process
Account data: name, email, workspace membership, sign-in events, IP and device. Call data: caller and called number, call time and duration, audio recording, transcript, summary, and any details stated during the conversation such as a name given for an appointment. Billing data: plan, credit movements, payment provider references. We never receive card numbers; those stay with the payment provider.
3. Why we process it
To place and answer calls on your behalf, to transcribe and summarise them, to schedule appointments, to meter usage and bill for it, to detect abuse and fraud, and to meet record-keeping obligations. Recordings are not used to train models.
4. Legal bases
Performance of a contract for delivering the service and billing it (Article 6(1)(b)). Legitimate interests for security, abuse prevention and product reliability (Article 6(1)(f)). Consent where a call is a marketing call, obtained by you and evidenced through the consent registry (Article 6(1)(a)). Legal obligation for retention that tax or telecom rules require (Article 6(1)(c)).
5. Who else sees it
Sub-processors only, each under a data processing agreement: the database and storage provider, the real-time voice infrastructure, the transcription and speech providers, the language model provider, the telecom carrier you selected, the payment providers, and the error-monitoring provider. The current list with each provider's role is available on request and will be published here before this notice is finalised.
6. Transfers outside the EEA
Database and file storage sit in the EU region. Some AI and telecom sub-processors operate outside the EEA; those transfers rely on Standard Contractual Clauses together with the supplementary measures in our agreements. The per-provider mapping is the second field to be completed before publication.
7. How long we keep it
Call recordings are deleted 90 days after the call. Transcripts and summaries are anonymised after 12 months. Call metadata needed for billing and regulatory records is kept for 10 years. Account data is deleted one year after the account closes. An erasure request from your panel is processed within 30 days.
8. Your rights
Access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent at any time without affecting processing already carried out. Where we act as your processor, a request from one of your callers should reach you first and we will support you in answering it.
9. Complaints
You may complain to the supervisory authority in your country of residence or place of work. Naming the lead supervisory authority is the third field pending, since it follows from where the controlling entity is established.
Contact
Customers in Turkey should read the binding Turkish notice: KVKK notice