Data processing terms
Call recordings are the most sensitive thing we hold, so these terms are specific.
The processing terms a compliance team will ask for, published rather than hidden behind a sales conversation. A signed version is issued at contract, and on the Exchange plan it is signed before go-live.
- 01
Who decides and who processes
For every call handled on your telephone line, you decide why the call happens, what may be resolved on it and what is kept afterwards. You are the controller. We process that call on your documented instructions, which are the configuration you approved, and we are the processor.
We never use call content for our own purposes. There is no secondary use buried in a clause, no advertising profile and no resale.
- 02
Scope and duration of processing
- Subject matter
- Answering and placing voice calls, and the records those calls produce
- Duration
- For as long as your account is active, plus the retention windows you set
- Nature
- Speech recognition, intent detection, reads and writes to systems you connected, synthesis, recording, transcription
- Purpose
- Resolving the caller request and letting you review the call afterwards
- Data subjects
- Your callers, the people you call, and your own staff who receive handoffs
- Categories
- Voice, transcript text, contact identifiers, booking or order references, and whatever a caller volunteers
- 03
Your instructions, and when we will refuse one
Your configuration is the instruction. Changing what may be resolved, which systems are read, how long recordings live and who can hear them are all changes you make and we follow.
We will refuse an instruction that would require the service to break a rule of the line, such as removing the AI disclosure, continuing after a request for a human, or calling numbers that should have been suppressed. We will tell you in writing why, and if the instruction stands, the agreement ends rather than the rule.
- 04
Security measures
- AES-256 encryption at rest for recordings, transcripts, summaries and logs
- TLS 1.2 or above in transit, including the media path with your telephony provider
- Separate storage for audio and text, so one can be deleted while the other is retained
- Role based access, with single sign-on and enforced two factor authentication
- No standing engineer access to call content, only time boxed access tied to a ticket you raised
- Access logging on every recording, with the person, the time and the stated reason
- Network segregation between the call path, the storage layer and the administration layer
- Annual independent penetration testing, with the summary available under confidentiality
- 05
People with access
Access is granted on need, reviewed quarterly and removed on the day someone leaves. Everyone with any possible access is bound by confidentiality that survives their employment, and has been trained on handling call recordings specifically rather than generic security awareness.
- 06
Sub-processors
We use a small number of sub-processors, each under a written contract with the same obligations we accept to you. The current list is available on request and inside the product.
- Cloud infrastructure and storage, in the region you selected
- Speech recognition and speech synthesis services, with reuse of content contractually prohibited
- Telephony carriage, which is usually a provider you already had a relationship with
- Transactional email for the confirmations and digests you configured
- 07
Changing a sub-processor
A new or replacement sub-processor that touches call content is notified at least 30 days before it is used. You can object in writing inside that window. If the objection cannot be resolved, you may terminate the affected service without penalty and receive a pro rata refund.
- 08
Where data sits, and cross border transfer
Call data is stored in India by default. Other regions are available where a plan supports it, and the region is selected by you rather than assigned by us.
Where a transfer out of the storage region is needed, it happens under standard contractual clauses or an equivalent lawful mechanism, with a transfer assessment available on request. Transfers for convenience are not made.
- 09
Helping you answer a caller request
When a caller asks for access, correction, deletion, a copy of a recording, or withdrawal of recording consent, the request belongs to you and we help you meet it. Search, export and delete are available directly in the product so most requests need no contact with us at all.
Where a request reaches us instead of you, we do not answer it on your behalf. We acknowledge it, tell the person it has been passed on, and route it to you.
- 10
Breach notification
If call content is exposed, you are notified without undue delay and in any case within 72 hours of us confirming it. The notice carries what happened, which data was affected, how many records, what has been contained, and what we recommend you do.
We will send a partial notice early rather than a complete one late, and we will keep updating it. We will not ask you to agree a joint statement before you are told.
- 11
Audit and evidence
Once a year, or after a confirmed incident, you may audit our processing of your data. In most cases the penetration test summary, the security documentation and a written questionnaire answer the question. Where they do not, a remote audit session is arranged at a reasonable time.
Audits are at your cost unless they find a material failure on our side, in which case ours.
- 12
Deletion and return on exit
When the agreement ends, exports stay available for 30 days in open formats. After that, all call content is deleted, including from backups, within a further 30 days, and a written confirmation of deletion is issued on request.
Opt-out records are the single exception and are retained, because the purpose of an opt-out is that it does not expire when a contract does.
Where a signed data processing agreement is in place, that agreement governs and these terms describe its substance.