Privacy Policy

2. What we collect

If you would like a call recording or transcript deleted sooner than the automatic 30-day removal, contact us at privacy@kallit.ai. What we deliberately don't collect: we do not use analytics, advertising, or tracking technologies of any kind. The exceptions are bot protection and account security: our sign-in, sign-up, and password-reset forms use Cloudflare Turnstile, which briefly checks device and browser signals (such as your IP address and browser characteristics) to confirm you're a real visitor rather than an automated script — it does not build a profile of you, track you across other sites, or set any cookies; and, as described above, we include your IP address, approximate location, and browser/device in password-reset and two-step authentication emails so you can spot a request that wasn't you. Beyond that, we do not track which device or browser you use, your location, or your behaviour on our site. See our Cookie Policy for details.

3. Why we process your data

We rely on the following legal bases under UK GDPR: performance of our contract with you (providing the translation service, billing you for usage), our legitimate interests (keeping the platform secure, preventing misuse, improving reliability), and legal obligation (e.g. retaining financial records for tax purposes). Where we ask for explicit consent, such as for optional communications, you can withdraw it at any time. Call content is different: we process it only on the instructions of the business using the service, as its processor, so the lawful basis for it is that business's, not ours.

4. Who we share it with

We share personal data only with the service providers ("sub-processors") we rely on to run the platform, and only to the extent needed:

• Vercel — hosts the website and web application, and necessarily handles the network traffic (including IP addresses) needed to serve it to you.
• Supabase — our database, authentication, and file storage provider.
• Cloudflare (Turnstile) — verifies you're a real visitor, not a bot, on our sign-in, sign-up, and password-reset forms.
• Resend — sends transactional emails on our behalf, such as account notifications and password reset links.
• Zoho — hosts our support@, privacy@, legal@, and staff email inboxes, so handles any personal data included in correspondence you send us.
• Hetzner — hosts the servers, located in Germany, that connect your calls and relay live audio between you, the other party, and our translation providers.
• OpenAI — translates the fixed opening introduction (no personal data) in every session and, only if your business admin has switched on OpenAI languages (off by default), processes your live call audio in real time for the additional languages Soniox doesn't cover.
• Soniox — processes your live call audio in real time (speech recognition, translation and spoken output) for the language pairs it supports. We use its European region.
• Telnyx — our telephony provider, handling call setup and routing for phone-based access to the service (a saved callback number, or dialling in directly with no app or browser).
• Stripe — processes payments once billing is enabled.

Where a sub-processor is located, or processes data, outside the UK or EEA, we rely on their published data protection safeguards (such as Standard Contractual Clauses). For example, Soniox processes your data in its European region, but as a US company it may carry out limited security and support processing outside it, which is covered by Standard Contractual Clauses and the UK Addendum in our agreement with it. We do not sell your data, and we do not share it with anyone for marketing or advertising purposes. Your conversations are not used to train AI models — we use OpenAI's API, which does not train on API customer data by default, and Soniox is contractually barred from using our data to train models.

5. How long we keep it

We retain account and business data for as long as your account is active, and delete it 12 months after the account is closed. Enquiries you send us through the contact form or by email are deleted 12 months after the matter is resolved. Financial and billing records — including the duration, cost, timestamps, and languages used for each session — are retained for six years, in line with UK statutory record-keeping requirements. Where audio recording or transcripts are switched on, we automatically and permanently delete that audio and transcript content 30 days after the call, regardless of whether you ask us to. You can ask us to delete it sooner at any time.

6. How we protect it

Data is encrypted in transit and at rest by our infrastructure providers. Access to your business's call recordings, transcripts, and account data is restricted by role — only members of your own business can access your business's data through the platform, and where a business is organised into departments, a department owner can only see their own department's calls, not the whole business. A limited number of Kall It AI administrators can also access stored content directly in our database. This is restricted to authorised administrators protected by two-step authentication, used only for support at your request, security investigations or legal requirements, and recorded. If a staff or department-owner account looks compromised, your business admin can remove its two-step authentication and force a sign-out from within Team settings; if a business admin's own account looks compromised, only we can do this, since no one inside the business has authority over the admin's own account. Either way, the affected person is emailed immediately, and it's logged in your business's own Activity Log. If a personal data breach affecting you occurs, we will notify the ICO within 72 hours where UK GDPR Article 33 requires it, and notify affected customers without undue delay. We are actively evaluating additional encryption controls for stored call recordings and transcripts that would remove even our own operational ability to read them; this document will be updated if and when that changes.

7. Your rights

Under UK GDPR, you have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. You can delete a specific call's stored recording or transcript yourself at any time from the Sessions tab of the Translation page, without needing to contact us. For any other request, contact us at privacy@kallit.ai — we will respond within one month of receiving it, or let you know if a complex request needs up to two further months. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

8. Children's privacy

Kall It AI is a business tool intended for use by professional organisations and their staff. It is not directed at, and we do not knowingly collect data from, children.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above, and for material changes we'll make reasonable efforts to notify account owners directly.