Privacy policy.

What we collect, why we collect it, where it lives, how long it stays, and who else touches it. Written for two audiences at once: visitors to this site, and the end customers whose conversations pass through an agent we operate on a customer's behalf.

The two data relationships

For site visitors we are the controller and this policy governs directly. For conversations handled by an agent we operate for a business customer, that business is the controller and we act as processor under the data processing agreement. Those are materially different relationships and the policy separates them explicitly.

What the document specifies

• Categories of data collected, and the lawful basis for each.
• Retention periods, by category, and what triggers deletion.
• Sub-processors and international transfer mechanisms.
• Your rights of access, correction, deletion, and portability.
• How to exercise a right, and the response window.

Call recordings specifically

Recordings and transcripts are the most sensitive category here. The policy sets out when they are recorded, the consent disclosure that precedes recording, how long they are retained, when they are redacted, and how a request to delete one is handled — including under a healthcare build operating on a signed business associate agreement.