Privacy Policy: AI Receptionist

2. What we collect

What we deliberately don't collect: we do not use analytics, advertising, or tracking technologies of any kind. The exceptions are bot protection and account security: our sign-in, sign-up, and password-reset forms use Cloudflare Turnstile, which briefly checks device and browser signals (such as your IP address and browser characteristics) to confirm you're a real visitor rather than an automated script — it does not build a profile of you, track you across other sites, or set any cookies; and, as described above, we include your IP address, approximate location, and browser/device in password-reset and two-step authentication emails so you can spot a request that wasn't you. See our Cookie Policy for details.

3. Why we process your data

We rely on the following legal bases under UK GDPR: performance of our contract with you (answering your calls, delivering your messages, billing you for your plan), our legitimate interests (keeping the platform secure, preventing misuse, improving reliability), and legal obligation (e.g. retaining financial records for tax purposes). Where we ask for explicit consent, such as for optional communications, you can withdraw it at any time. Call content is different: we process it only on the instructions of the business using the service, as its processor, so the lawful basis for it is that business's, not ours. The business is responsible for telling its callers how its calls are handled, beyond the receptionist's own announcement at the start of every call.

4. Who we share it with

We share personal data only with the service providers ("sub-processors") we rely on to run the platform, and only to the extent needed:

• Telnyx — our telephony provider: supplies your business's number, connects every call to our servers, and sends the text messages to callers and to your business.
• Hetzner — hosts the servers, located in Germany, that answer the calls and pass the audio to and from the AI providers below.
• Soniox — turns the caller's speech into text and the receptionist's replies into speech, in real time. We use its European region.
• Google Cloud (Vertex AI) — the language model that understands what the caller says and decides what the receptionist says next, including the message written for your business. We use its EU region.
• OpenAI — only as a fallback to produce the spoken greeting when Soniox cannot; the greeting contains your business's name and your chosen wording, never a caller's data.
• ePostcode — a UK address database used to check an address a caller gives against the postcode, so it is written down correctly.
• Microsoft Azure — stores and scans for malware any documents or photos a caller uploads through a link the receptionist sends them.
• Supabase — our database, authentication, and file storage provider, hosted in the EU (Ireland).
• Vercel — hosts the website and web application, and necessarily handles the network traffic (including IP addresses) needed to serve it to you.
• Cloudflare (Turnstile) — verifies you're a real visitor, not a bot, on our sign-in, sign-up, and password-reset forms.
• Resend — sends emails on our behalf: your per-call messages and daily summaries where you choose email, and account notifications such as password reset links.
• Zoho — hosts our support@, privacy@, legal@, and staff email inboxes, so handles any personal data included in correspondence you send us.
• Stripe — processes payments.

Where a sub-processor is located, or processes data, outside the UK or EEA, we rely on their published data protection safeguards (such as Standard Contractual Clauses). Soniox and Google process call data in their European regions, but as US companies may carry out limited security and support processing outside them; Telnyx and OpenAI are US companies. Each is covered by Standard Contractual Clauses or the UK International Data Transfer Addendum in our agreement with it. We do not sell your data, and we do not share it with anyone for marketing or advertising purposes. Calls are not used to train AI models: we use Google's and OpenAI's business APIs, which do not train on customer data, and Soniox is contractually barred from using our data to train models.

5. How long we keep it

We retain account and business data for as long as your account is active, and delete it 12 months after the account is closed. The messages the receptionist takes — the caller's details and what they asked for — stay in your call history for as long as your account is active, since they are your business's records; you can ask us to delete any of them sooner at privacy@kallit.ai. Call recordings and transcripts, where switched on, are automatically and permanently deleted 30 days after the call, regardless of whether you ask us to. Documents and photos uploaded by callers are deleted with the call record they belong to. Enquiries you send us through the contact form or by email are deleted 12 months after the matter is resolved. Financial and billing records — including the time, duration and outcome of each call — are retained for six years, in line with UK statutory record-keeping requirements.

6. How we protect it

Data is encrypted in transit and at rest by our infrastructure providers. Access to your business's calls, messages, recordings, transcripts and account data is restricted by role — only members of your own business can access your business's data through the platform. A limited number of Kall It AI administrators can also access stored content directly in our database. This is restricted to authorised administrators protected by two-step authentication, used only for support at your request, security investigations or legal requirements, and recorded. If a staff account looks compromised, your business admin can remove its two-step authentication and force a sign-out from within Team settings; if a business admin's own account looks compromised, only we can do this. Either way, the affected person is emailed immediately, and it's logged in your business's own Activity Log. If a personal data breach affecting you occurs, we will notify the ICO within 72 hours where UK GDPR Article 33 requires it, and notify affected customers without undue delay.

7. Your rights

Under UK GDPR, you have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. Business admins control whether calls are recorded or transcribed at all, from the receptionist's settings. For any request, contact us at privacy@kallit.ai — we will respond within one month of receiving it, or let you know if a complex request needs up to two further months. If you are a caller, the business you rang is the controller of what you told the receptionist; contact it directly, or contact us and we will help. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

8. Children's privacy

Kall It AI is a business tool intended for use by businesses and their staff. It is not directed at, and we do not knowingly collect data from, children. A child may of course ring a business that uses the receptionist; what they say is passed to that business in the same way as any other call.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above, and for material changes we'll make reasonable efforts to notify account owners directly.