1. Introduction
Protecting your personal data is a priority for Kalyvox. This privacy policy explains how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR).
2. Data controller
The data controller is:
KALYVOX SASU
Registered office: 6 place du Président Thomas Woodrow Wilson, 31000 Toulouse, France
Toulouse Trade & Companies Register: 999 458 409
Email: dpo@kalyvox.ai
3. Data we collect
As part of our AI phone-qualification service, we collect:
- Business identification: company name, email, professional phone number
- User data: first name, last name and professional email of staff members
- Call data: caller phone number, conversation transcript, intent qualification
- Connection data: IP address, connection logs, browser type
- Billing data: payment information via Stripe (we do not store card details)
4. Processing purposes
Your data is processed for the following purposes:
- Providing the automated phone-qualification service
- Generating ticket summaries of calls
- Customer relationship management and technical support
- Billing and subscription management
- Improving our AI algorithms (in anonymised form)
- Compliance with our legal obligations
5. Legal basis
Data processing is based on:
• Performance of the contract for delivering the phone-qualification service
• Your consent for marketing communications
• Our legal obligations for the retention of billing data
• Our legitimate interest for service improvement and security
6. Recipients
Your data may be shared with the following sub-processors:
- Supabase Inc. – Hosting and database (Singapore / AWS EU)
- Twilio Inc. – Telephony and virtual numbers (United States, Standard Contractual Clauses)
- Stripe Inc. – Payment processing (United States, Privacy Shield certified)
- OpenAI / AI providers – Voice processing and transcription (with anonymisation)
No data is sold to third parties. Competent authorities may access data upon a valid legal request.
7. Retention periods
- Account data: duration of subscription + 3 years after termination
- Call transcripts: rolling 12 months (configurable by the company)
- Billing data: 10 years (legal accounting obligation)
- Connection logs: 12 months
8. Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure: delete your data ("right to be forgotten")
- Right to portability: receive your data in a structured format (JSON/CSV)
- Right to object: object to processing on legitimate grounds
- Right to restriction: temporarily freeze processing
To exercise these rights, contact us at: dpo@kalyvox.ai
Response time: 30 days maximum.
9. Data security
We implement robust technical and organisational measures:
• Encryption of data at rest (AES-256) and in transit (TLS 1.3)
• Secure authentication with password hashing
• Role-based access control (Row-Level Security)
• Hosting on AWS infrastructure certified ISO 27001
• Regular security audits and penetration tests
10. International transfers
Some of our sub-processors are located outside the EU (United States). These transfers are framed by:
• The European Commission's Standard Contractual Clauses
• Privacy Shield certifications (where applicable)
• Additional security measures consistent with CNIL recommendations
11. Cookies
Our website only uses cookies that are strictly necessary for operation:
• Authentication cookie (user session)
• Preferences cookie (theme, language)
No advertising or third-party tracking cookies are dropped without consent.
12. Changes
This policy may change to reflect legal evolutions or changes to our practices. Any substantial change will be notified by email to affected users at least 30 days before it takes effect.
13. Contact and complaints
For any question regarding this policy or your personal data:
Email: dpo@kalyvox.ai
Address: KALYVOX SASU, 6 place du Président Thomas Woodrow Wilson, 31000 Toulouse, France
If you believe your rights are not being respected, you may lodge a complaint with the French data-protection authority CNIL: www.cnil.fr
14. Manage cookie preferences
Based on our legitimate interest (same safeguards as Google Analytics 4), we measure aggregate, anonymous audience data via Google Analytics and PostHog (cookieless mode: no cookie, no persistent identifier, daily rotating hashed visitor ID, IP not stored). You can change at any time your choices for cookies subject to consent: Google Ads advertising, identified product analytics (linked to your account) and session recording. PostHog data is stored on servers located in the European Union (eu.i.posthog.com).