Privacy Policy
This policy explains what data we collect when you use the vocalyy.ro website, when you book a demo, or when you use our AI voice agent service, and how we protect this data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Romanian law, including Law No. 190/2018.
1. Who we are
D.O.D.O. OFFICE OUTLET S.R.L., a Romanian legal entity with its registered office in Romania, operates the vocalyy.ro website and the Vocalyy AI voice agent service. For any questions related to data protection, you can contact us at agent@vocalyy.ro.
2. Our roles: controller vs. processor
D.O.D.O. OFFICE OUTLET S.R.L. acts in two distinct legal capacities, depending on the category of data:
- CONTROLLER for our client's own data (contact person, legal representative, billing data, account/authentication data, commercial communications). For this data, Vocalyy alone determines the purposes and means of processing and answers directly to the client as the data subject.
- PROCESSOR for the data of our client's callers (the customers, patients, or prospective customers of the business who call or are called through the Vocalyy voice agent). For this data, the Vocalyy client is the controller, and Vocalyy processes exclusively on the basis of the client's documented instructions (voice agent configuration, conversation script, purpose of the calls), in accordance with Art. 28 GDPR.
The full details of the controller-processor relationship, including mutual obligations, are governed by the Data Processing Agreement (DPA) signed with each B2B client (Data Processing Agreement).
3. What data we collect
3.1 Data collected when you visit the site
- IP address, browser type, operating system, pages visited
- Date and time of visit, traffic source (where you came from)
- Cookies (see section 12)
3.2 Data you provide when you book a demo
- Full name
- Email address
- Phone number
- Business name and the industry you operate in
- Optional notes about your needs
3.3 Data collected when you test a demo voice agent on the site
- Audio recording of your call with the demo agent (typically up to 2 minutes)
- Automatic transcript of the conversation
- Microphone permission granted to your browser
For this specific interaction, the on-site demo test, we request your explicit consent before activating the microphone. This is the only legal basis used for the demo recording (see the table in section 6).
3.4 Data collected as a Vocalyy service subscriber
- Billing data: company name, tax ID (CUI), address, IBAN if applicable
- Contact details of the authorized person
- Data about your business needed to build the agent (hours, prices, services, frequently asked questions, etc.)
- Data about the calls your agent processes, see section 4
4. Data about your agent's callers: how it works
When your voice agent answers a call or calls a contact, Vocalyy processes data about that caller exclusively on the basis of your documented instructions, acting as processor. Here is exactly what happens with each type of data:
4.1 What the Vocalyy dashboard displays
- The caller's phone number
- visible in the "Call History" section
- Call metadata
- date, time, duration
- The complete conversation transcript
- fully visible in the "Call Transcript" section
- The call's audio recording
- stored directly on the Vocalyy platform (see section 4.2)
We state this honestly: the complete transcript of every conversation is stored and displayed in your dashboard. We do not delete or anonymize the content of the conversation by default.
4.2 Where the audio recording is stored
The audio recording of every call is stored directly by Vocalyy, in our own infrastructure, Supabase Storage, in a European Union data center (Frankfurt, Germany), for 30 days from the date of the call, after which it is automatically and permanently deleted. During that window, the client can listen to and download the recording from the dashboard; from the moment of download, the client becomes the sole controller of that copy. Audio storage can be fully disabled, per agent, from the agent's configuration. The 30 days are our retention policy, applicable to the copy we store. After the call, ElevenLabs transcribes the recording to produce the written transcript; we do not use ElevenLabs storage for recordings, and ElevenLabs' own retention of content processed through their API is governed by the ElevenLabs DPA (section 9.2), not by this policy.
5. Special categories of data and CNP
Conversation transcripts may contain, depending on the client's industry (for example, medical or dental clients), health data or other special categories of data within the meaning of Art. 9 GDPR, as well as a Personal Numerical Code (CNP).
Our client, as controller, guarantees that it holds a valid legal basis under Art. 9 GDPR for any special category of data collected through the voice agent, and that it meets the conditions imposed by Art. 4 of Law No. 190/2018 when processing involves a CNP (including, where the legal basis is legitimate interest, technical minimization measures, defined retention periods, and training of its own staff). Vocalyy processes this data exclusively on the basis of the client's documented instructions, without determining the purpose or legal basis for its collection.
For this reason, we treat the security and retention of transcripts as priorities, see sections 7 and 13.
6. Why we collect it (legal basis)
| Data category | Purpose | GDPR legal basis |
|---|---|---|
| Web traffic data, analytics cookies | Understanding site usage | Consent (Art. 6.1.a) |
| Demo form data | Scheduling and preparing the call | Pre-contractual steps (Art. 6.1.b) |
| On-site demo audio recording + transcript | Operation of the interactive demo | Consent (Art. 6.1.a) |
| Billing and contractual data (Vocalyy client) | Performance of the service contract | Contract (Art. 6.1.b) + Legal obligation (Art. 6.1.c) |
| Account data | Provision and administration of the account | Contract (Art. 6.1.b) |
| Data about the agent's callers | Provision of the service to the B2B client | Determined by the client, as controller (typically Art. 6.1.a, 6.1.b, or 6.1.f), Vocalyy processes as processor |
7. How long we keep your data
Full details are published in our Retention Policy.
| Category | Period | Legal basis / reason |
|---|---|---|
| Caller's phone number | 90 days from the call, deleted automatically | Client's (controller) legitimate interest in the history of the relationship with the caller; Vocalyy's operational necessity as processor |
| Call billing record (date, time, duration, cost) | 5 years, counted from 1 July of the year following the end of the financial year | Legal obligation: Art. 25 of Accounting Law no. 82/1991. Billing record only, without the caller's number or other caller data |
| Complete transcript | 90 days from the call, deleted automatically | May contain special category data, limited retention and enhanced security under Art. 9 GDPR / Law 190/2018 |
| Call audio recording | 30 days from the date of the call, automatic deletion | Client's legitimate interest in quality verification and evidence of the conversation; short period per the storage limitation principle, Art. 5(1)(e) GDPR |
| Billing data (Vocalyy client) | 5 years, from 1 July of the following year | Art. 25, Accounting Law No. 82/1991, as amended by Law No. 36/2023 |
| Audit logs | 24 months | Accountability under Art. 5(2) and Art. 32 GDPR |
| Site/demo data | 12 months from the last interaction | Data from website forms (demo requests, contact, sign-up). Vocalyy's legitimate interest (Art. 6(1)(f) GDPR) in managing and following up on commercial enquiries. The period restarts on each new contact; if the person becomes a client, the data falls under the “Account data” regime. |
| Cookies | Maximum 13 months (non-essential); session duration (strictly necessary) | Consent, Art. 6(1)(a) |
| Account data | Duration of the contract + 3 years after termination | Art. 6(1)(b), plus the 3-year statute of limitations (Art. 2517 Civil Code) |
The call audio recording is stored directly by Vocalyy for 30 days from the date of the call, then automatically deleted. It can be fully disabled, per agent, from the agent's configuration (see section 4.2).
8. Who we share it with (sub-processors)
We use external providers who process data on our behalf. All of them sign GDPR-compliant data processing agreements.
| Provider | Service | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| SpaceX Super Intelligence LLC (xAI) | The voice agent's AI. Grok Voice (grok-voice-3.0) hears the caller, decides the answers and actions during the call and speaks the agent's replies | Caller's voice (audio), phone number, conversation content, details captured on the call | USA (and other countries where xAI and its sub-processors process data) | Standard Contractual Clauses (Commission Decision 2021/914, Module Two or Three), incorporated in the xAI DPA, §8.2 |
| OpenAI Ireland Ltd (with OpenAI, L.L.C. and its affiliates) | Models used alongside the voice agent. gpt-4o-mini-transcribe listens again, during the call, to a short sentence the agent may have misheard; gpt-5.6-luna extracts, after the call, the details the business asked for; text-embedding-3-small searches the agent's knowledge base | Caller's voice (audio), phone number, conversation content, details captured on the call | USA | OpenAI Ireland Ltd is the processor, in the EU; its onward transfer to its US affiliates relies on Standard Contractual Clauses (OpenAI DPA, §4.1) |
| ElevenLabs [exact registered name and address, to be confirmed] | Transcribes the call recording after the call (Scribe, speech-to-text), producing the written transcript the business reads. Not used during the call and not the agent's voice. Only for agents with recording switched on. ElevenLabs' own retention is governed by the ElevenLabs DPA (section 9.2) | The call's audio recording (both voices) | USA (State of New York) | SCC (incorporated in the ElevenLabs DPA) |
| Telnyx LLC | Telephony: phone numbers, call routing, carrying the call's audio to the voice engine, transfers to a person, optional noise suppression, and SMS notifications | Phone number, call audio in transit, call metadata, content of SMS notifications (may include details captured on the call) | USA [EU data residency option to be reconfirmed] | DPF [to be reconfirmed] |
| Supabase Inc. | Database, authentication and file storage, including call recordings and transcripts | All data held by the platform: account data, call data, recordings, transcripts | EU (Frankfurt, Germany) | N/A (within the EU) |
| Render Services, Inc. | Hosting of the voice engine | Call audio and the call's data passing through the voice engine | EU (Frankfurt, Germany) | Servers in the EU; US company: DPF [to be reconfirmed] |
| Vercel Inc. | Hosting of the platform and the website | All data processed by the platform: account data, call data, recordings and transcripts in transit | EU (Frankfurt, Germany); requests cross its global network on the way | Servers in the EU; US company: DPF [to be reconfirmed] |
| Resend | Email: account emails and after-call notifications to the business | Email addresses; notification content, which may include the caller's number and details captured on the call | USA | SCC-DPF [to be reconfirmed] |
| Google LLC / Google Ireland Limited (Gemini API) | AI language models used beside the voice agent's own: drafting, summaries and checks on call content | Transcripts and details captured on the call; the agent's configuration | USA / EU | SCCs + TIA [to be confirmed] |
| Google Cloud / Firebase (Google LLC / Google Ireland Limited) | Cloud infrastructure: compute, storage, database and authentication services | Caller Data in transit and at rest; account data | EU / USA | SCCs + TIA where USA [to be confirmed] |
| Stripe Payments Europe Ltd. | Payments | Billing/payment data | EU (Ireland) | N/A (within the EU) |
| 2invoice [registered name to be confirmed] | Issuing invoices | The client's billing details | Romania | N/A (within the EU) |
| Formagrid, Inc. (Airtable) | Receives the sign-up form of new clients | The client's contact details from the sign-up form (company, name, email, phone, tax ID, address) | USA | [To be confirmed] |
| Anthropic PBC | AI-assisted drafting of support-ticket replies, and the replies of the business's Telegram chatbot if the business connects one. Not part of the phone call flow | Support message content; Telegram chat messages | USA | DPF |
| Telegram | Optional. After-call notifications to the business's Telegram group (sent by Vocalyy's bot), and the business's own Telegram chatbot | Caller's number, details captured on the call and, if the business asks for it, the transcript; chat messages | [To be confirmed] | [To be confirmed] |
| Google LLC / Google Ireland Limited | Optional. Calendar (bookings) and Sheets (a row per call), when the business connects its Google account; Maps geocoding, on Vocalyy's account, for agents that check a delivery zone | Caller's name, number and request; details captured on the call; the delivery address (geocoding) | USA / global | DPF [to be reconfirmed] |
| Microsoft Ireland Operations Ltd | Optional. Bookings in the business's Microsoft 365 (Outlook) calendar, when the business connects its account | Caller's name and number | EU / USA | DPF [to be reconfirmed] |
| Calendly LLC | Optional. Reads the business's free slots, when the business connects its account | No caller data is sent; details of people who book through Calendly are received | USA | DPF [to be reconfirmed] |
| ChoiceQR, boogiT, SoftOK, GestSel | Optional, per agent. Sends phone orders into the restaurant's ordering or till system | Caller's name, phone number, delivery address and order | Romania / EU [to be confirmed per provider] | N/A (within the EU) [to be confirmed] |
| HubSpot, Pipedrive, Zoho, Streak | Optional. Logs each call in the business's CRM, when the business connects it | Caller's name and number, call summary and transcript, a link to the call in Vocalyy (no audio file) | USA / EU, per provider | Per the provider's DPA [to be confirmed] |
Entries marked “to be confirmed” are contractual details (registered names, transfer mechanisms) still being confirmed with each provider; the services and the data each provider receives are as stated.
The complete, up-to-date list is published at the Sub-processors List. We notify B2B clients by email at least 30 days before any change.
9. International transfers
Certain providers (xAI, OpenAI, ElevenLabs, Telnyx, Resend, Anthropic, Airtable, Google, Telegram) are based or have servers outside the European Economic Area. Transfers are protected by the EU-US Data Privacy Framework (DPF) and, where applicable, by Standard Contractual Clauses. Exact details for each provider are available at the Sub-processors List. We do not transfer data to other third countries beyond those listed there.
10. Your rights (GDPR)
You have the right to:
- Access (Art. 15): find out what data we hold about you
- Rectification (Art. 16): correct inaccurate data
- Erasure / "right to be forgotten" (Art. 17): ask us to delete your data
- Restriction of processing (Art. 18): temporarily limit processing
- Portability (Art. 20): receive your data in a structured format
- Object (Art. 21): to processing based on legitimate interest
- Not be subject to a decision based solely on automated processing (Art. 22)
- Withdraw your consent at any time (where we relied on consent), without affecting the lawfulness of processing carried out before its withdrawal
Requests are sent to agent@vocalyy.ro. We respond within one month at most of receiving the request, a period that may be extended by a further two months in complex cases, with prior notice to you. Exercising these rights is free of charge.
If you are a caller of a Vocalyy client (not our direct client), your rights are exercised primarily against the controller, the business using the voice agent. Vocalyy, as processor, assists the client in resolving such requests in accordance with Art. 28(3)(e) GDPR.
11. Security breach notification
In the event of a breach of the security of personal data, Vocalyy notifies the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) without undue delay and, where feasible, within a maximum of 72 hours from the moment we became aware of the breach, in accordance with Art. 33 GDPR.
If the breach is likely to result in a high risk to the rights and freedoms of data subjects, we inform the affected individuals without undue delay, in accordance with Art. 34 GDPR, except where the exceptions provided by law apply (for example, the data was encrypted, or we have taken subsequent measures that eliminate the high risk).
For the data of our clients' callers (where Vocalyy is processor), we immediately notify the affected client, who remains responsible, as controller, for notifying ANSPDCP and its own data subjects, with our support.
12. Cookies and similar technologies
We use cookies for:
- Strictly necessary cookies (site functionality, remembering your cookie choice, agent-setup progress and the setup-assistant conversation), no consent required
- Analytics cookies (Google Analytics: visitor numbers and which pages are read), only with your consent, under Art. 6.1.a GDPR
- Marketing cookies (Meta Pixel and Google Ads: measuring ads and showing relevant Vocalyy ads), only with your consent, under Art. 6.1.a GDPR. Meta and Google may transfer this data to the US under the EU-US Data Privacy Framework
We ask for your consent via the banner shown on your first visit, where you can accept, reject or choose analytics and marketing separately. Nothing for analytics or marketing loads before you choose. You can change your choice at any time via the "Cookie settings" link in the site footer. The full list, with providers and durations, is in our Cookie policy.
13. Security
We use appropriate technical and organizational measures, in accordance with Art. 32 GDPR: encryption in transit (HTTPS / TLS 1.2+), role-based access control, hashed passwords, continuous monitoring. Because transcripts may contain health data or other special categories, we treat security and access to this data as a priority. No system is 100% impenetrable, see section 11 for our procedure in the event of a breach.
14. Minors
The Vocalyy service is exclusively addressed to businesses (B2B). We do not knowingly collect data from individuals under 16 through our website or demo forms. If you notice that a minor has provided data, write to us at agent@vocalyy.ro and we will delete it.
15. Changes to this policy
We may update this policy. Significant changes are announced by email (to clients) or via a banner on the site at least 30 days before they take effect. The current version is indicated at the top of the page.
16. Contact and complaints
For any question or request about your data: agent@vocalyy.ro.
If you are not satisfied with our response, you can file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
- anspdcp@dataprotection.ro
- www.dataprotection.ro
Related documents: Terms and Conditions, Retention Policy, Sub-processors List, About the AI System, Data Processing Agreement (DPA).