Privacy policy
Version in force on {{DATE_VERSION}}. This is a translation; the French version prevails.
This policy is for {{MARQUE}} customers and website visitors. If you received a call made through {{MARQUE}}, a shorter page is for you: {{DOMAINE}}/en/call.
1. Who is responsible for your data
Mohamed Reda Khadra EI (sole trader, France), trading as {{MARQUE}}, SIRET {{SIRET}}, {{ADRESSE_EDITEUR}}.
Data protection contact: rgpd@{{DOMAINE}}.
When a business customer uses {{MARQUE}} to call its own contacts, that customer is the controller of those contacts' data and {{MARQUE}} acts as its processor (see the DPA). This policy covers the data for which {{MARQUE}} is the controller.
2. What we don't do
- We do not record the audio of calls.
- We do not use your content to train AI models.
- We do not sell your data or use it for third-party marketing.
- The website sets no advertising or analytics cookies (see Cookies).
- No decision producing legal effects concerning you is based solely on automated processing. The one temporary exception: if two different people report your calls within 24 hours, your account cannot call new numbers until a person has reviewed those reports (within 24 working hours); we tell you, and you can give your side (Terms of Use art. 8.2).
3. Our processing
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account | email, password (hashed), verified mobile number, name, account type; for businesses: company name, SIREN, address | Performance of the contract (Art. 6(1)(b) GDPR) | Life of the account, then see "identification data" below |
| Make your calls and report back | task, number called, name of the person called if given, questions and answers, transcript, summary, status, durations, callback time requested by the person called | Contract (6(1)(b)) | Transcripts and summaries: 90 days, then automatic deletion; you can delete them earlier. Status and durations without content: life of the account |
| Keep your secrets out of our records | values marked [secret: …] and detected card numbers |
Security (6(1)(f); Art. 32 GDPR) | Encrypted during the task, deleted when it ends; only the last 4 digits of a card are kept in the history |
| Payment and invoicing | amounts, Stripe payment references, invoices | Contract (6(1)(b)) and legal obligation (6(1)(c)) | Invoices: 10 years (accounting law). Card details are never sent to us |
| Keep identification data linked to the telephone service | declared identity, email, verified mobile number, billing address, payment references | Legal obligation (6(1)(c); Art. L. 34-1 II bis of the French Postal and Electronic Communications Code) | 5 years after the account is closed |
| Prove what you accepted and chose | acceptance of the Terms of Use and Terms of Sale; for a consumer, your request that top-ups or your subscription be usable immediately; your acceptance of the warning when you change the agent's recommended identity settings (with the settings chosen). For each: text shown, version, date and time, channel (website, API, AI agent), IP address | Legal obligation (6(1)(c); proof of the express request required by Arts. L. 221-25 and L. 221-28 of the French Consumer Code) and legitimate interest: proving the contract and who is responsible for what (6(1)(f)) | Life of the account, then 5 years after it is closed (limitation period), then automatic deletion |
| Prevent abuse and fraud | logs of refused tasks and answers, reports received about your calls (reason, date, call concerned; never the identity of the person reporting), warnings, temporary restrictions to numbers already called, and suspensions, numbers and frequency of calls, IP address | Legitimate interest: protecting the people called and the service (6(1)(f)) | 1 year after the report or the end of its review; longer if proceedings are pending |
| Prove compliance with the AI disclosure | when you ask us not to repeat the AI disclosure: your confirmation that the person called already knows (with what you say about it), date and time, account and call | Legal obligation (6(1)(c); EU AI Act, Art. 50) and legitimate interest: proving the service is used in line with its rules (6(1)(f)) | 1 year, then automatic deletion; longer if proceedings are pending |
| Respect the objection of people called | phone number of the person who no longer wants to be called | Obligation to honour objections (Art. 21 GDPR) | As long as the service exists; reviewed every 3 years |
| Send service messages | email, message content (invoices, number release notices, security alerts) | Contract (6(1)(b)) | Life of the account |
| Secure and operate the service | technical logs (IP address, date, request, errors) | Legitimate interest: security (6(1)(f)) | 30 days; encrypted backups: 14 days |
| Answer your requests (support, complaints, GDPR rights) | exchanges, documents provided | Contract or legal obligation | 3 years after the last request; GDPR requests: 5 years |
| Handle disputes | evidence | Legitimate interest: defending our rights (6(1)(f)) | Applicable limitation period |
Other account data (settings, history without content): deleted 1 year after the account is closed. An account inactive for 3 years is closed after a warning email.
4. Who receives your data
- You, and the applications you connect (AI agent, webhook URL).
- Our technical processors, acting only on our instructions:
| Provider | Role | Where | Safeguard outside the EU |
|---|---|---|---|
| Contabo GmbH (Germany) | Hosting of the website, API and customer area | European Union | — |
| Supabase Pte. Ltd. (Singapore) | Database | EU (Paris); support access and sub-processors outside the EU possible | EU standard contractual clauses |
| LiveKit Inc. (USA) | Real-time voice platform, agent hosting | EU (Frankfurt); transit outside the EU possible | EU-US Data Privacy Framework and standard contractual clauses |
| Telnyx LLC (USA) | Phone line, numbers, verification texts | USA and EU | Data Privacy Framework and standard contractual clauses |
| Deepgram Inc. (USA) | Speech-to-text during the call | EU endpoint; no retention | Standard contractual clauses |
| Groq (USA) | Language model that makes the agent talk | USA; no retention | Standard contractual clauses |
| ElevenLabs (USA) | Voice synthesis | USA, EU or Singapore | Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe Ltd (Ireland) | Payment | EU, with transfers to the USA | Data Privacy Framework and standard contractual clauses |
| Brevo (Sendinblue SAS, France) | Service emails | European Union | — |
The up-to-date list is published at {{DOMAINE}}/legal/sous-traitants.
- Independent controllers: Stripe for fraud prevention and its regulatory obligations; Telnyx for call detail records (numbers, times, durations) it processes as a carrier.
- Authorities: only upon a lawful request.
- Our chartered accountant, for invoices.
- If the business is transferred to a company set up by Mohamed Reda Khadra (see the terms of sale), that company will become the controller on the same terms; you will be informed in advance.
5. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on our legitimate interest. In your customer area you can already export all your data and delete your tasks and transcripts.
Email rgpd@{{DOMAINE}}. We reply within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to prove your identity if we have reasonable doubts.
You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr/fr/plaintes), or with the authority of your country of residence.
6. Security
Encrypted connections (HTTPS/TLS), hashed passwords, API keys stored as hashes, task secrets encrypted then deleted, restricted database access, encrypted backups, time-limited logs. If a data breach creates a risk, we notify the CNIL within 72 hours and, if the risk is high, the people concerned.
7. Minors
The service is for adults only.
8. Changes
We email customers about any significant change before it takes effect. The version date is shown at the top of this page.