Privacy Policy

1. Introduction

Protecting your personal data is a priority for Kalyvox. This privacy policy explains how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

2. Data controller

The data controller is:
KALYVOX SASU
Registered office: 6 place du Président Thomas Woodrow Wilson, 31000 Toulouse, France
Toulouse Trade & Companies Register: 999 458 409
Email: dpo@kalyvox.ai

3. Data we collect

As part of our AI phone-qualification service, we collect:

• Business identification: company name, email, professional phone number
• User data: first name, last name and professional email of staff members
• Call data: caller phone number, conversation transcript, intent qualification
• Connection data: IP address, connection logs, browser type
• Billing data: payment information via Stripe (we do not store card details)

4. Processing purposes

Your data is processed for the following purposes:

• Providing the automated phone-qualification service
• Generating ticket summaries of calls
• Customer relationship management and technical support
• Billing and subscription management
• Improving our AI algorithms (in anonymised form)
• Compliance with our legal obligations

5. Legal basis

Data processing is based on:
• Performance of the contract for delivering the phone-qualification service
• Your consent for marketing communications
• Our legal obligations for the retention of billing data
• Our legitimate interest for service improvement and security

6. Recipients

Your data may be shared with the following sub-processors:

• Supabase Inc. – Hosting and database (Singapore / AWS EU)
• Twilio Inc. – Telephony and virtual numbers (United States, Standard Contractual Clauses)
• Stripe Inc. – Payment processing (United States, Privacy Shield certified)
• OpenAI / AI providers – Voice processing and transcription (with anonymisation)

No data is sold to third parties. Competent authorities may access data upon a valid legal request.

7. Retention periods

• Account data: duration of subscription + 3 years after termination
• Call transcripts: rolling 12 months (configurable by the company)
• Billing data: 10 years (legal accounting obligation)
• Connection logs: 12 months

8. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your data ("right to be forgotten")
• Right to portability: receive your data in a structured format (JSON/CSV)
• Right to object: object to processing on legitimate grounds
• Right to restriction: temporarily freeze processing

To exercise these rights, contact us at: dpo@kalyvox.ai
Response time: 30 days maximum.

9. Data security

We implement robust technical and organisational measures:
• Encryption of data at rest (AES-256) and in transit (TLS 1.3)
• Secure authentication with password hashing
• Role-based access control (Row-Level Security)
• Hosting on AWS infrastructure certified ISO 27001
• Regular security audits and penetration tests

10. International transfers

Some of our sub-processors are located outside the EU (United States). These transfers are framed by:
• The European Commission's Standard Contractual Clauses
• Privacy Shield certifications (where applicable)
• Additional security measures consistent with CNIL recommendations

11. Cookies

Our website only uses cookies that are strictly necessary for operation:
• Authentication cookie (user session)
• Preferences cookie (theme, language)

No advertising or third-party tracking cookies are dropped without consent.

12. Changes

This policy may change to reflect legal evolutions or changes to our practices. Any substantial change will be notified by email to affected users at least 30 days before it takes effect.

13. Contact and complaints

For any question regarding this policy or your personal data:
Email: dpo@kalyvox.ai
Address: KALYVOX SASU, 6 place du Président Thomas Woodrow Wilson, 31000 Toulouse, France

If you believe your rights are not being respected, you may lodge a complaint with the French data-protection authority CNIL: www.cnil.fr