Legal

Data Retention Policy

Version 3.2, last updated 23 October 2026

This policy describes how long we keep each category of personal data and what the basis/reason for that period is. The policy implements the principles of storage limitation and data minimization set out in Art. 5(1) of Regulation (EU) 2016/679 (GDPR).

In short: We keep each category of data only for as long as necessary for the purpose for which it was collected, or for as long as the law requires (for example, accounting legislation). When the purpose ceases to apply and there is no legal obligation to retain the data, it is deleted.

1. Vocalyy's roles: controller vs. processor

D.O.D.O. OFFICE OUTLET S.R.L. acts in two distinct legal capacities, depending on the category of data, and the retention periods below must be read with this in mind:

Controller for our client's own data (contact person, legal representative, billing data, account/authentication data, business communications). For this data, Vocalyy alone determines the purposes and means of processing.
Processor for the data of our client's callers (the customers, patients, or prospective customers of the business who call or are called through the Vocalyy voice agent). For this data, the Vocalyy client is the controller, and we process it exclusively based on the client's documented instructions, in accordance with Art. 28 GDPR.

Vocalyy does not determine the purposes or legal basis on which our client collects data about its callers. The client, as controller, is responsible for identifying the applicable legal basis (for example, consent, legitimate interest, or performance of a contract), for informing the data subjects (callers), and for obtaining any necessary consent, including for special category data under Art. 9 GDPR or personal numeric code (CNP) data under Law No. 190/2018.

2. Retention periods table

The table below is the single reference for the retention periods used by Vocalyy.

Default retention periods: 30 days for the audio recording; 90 days for the transcript, the caller's phone number, the summary and the data extracted from the call, including order details. On the client's written instruction, we apply a shorter period. Of each call, only the billing record (date, time, duration, cost) remains, for 5 years. When an account ends (subscription cancelled, or an invoice unpaid for 30 days), all its data is deleted 30 more days later, except the billing record; 7 days before, the account owner is emailed a link to export their data. The audio recording can be fully disabled, per agent, from the agent's configuration.

Category	Period	Legal basis / reason
Caller's phone number	90 days from the call, deleted automatically	Legitimate interest of the client (controller) in the history of the relationship with the caller; Vocalyy's operational necessity as processor
Contact created from a call (number, name noted by the agent, last request)	90 days from the caller's most recent call, deleted automatically	Same as the call data it is taken from; contacts the client adds or imports itself are kept for the duration of the contract
Call billing record (date, time, duration, cost)	5 years, counted from 1 July of the year following the end of the financial year	Legal obligation: Art. 25 of Accounting Law no. 82/1991. Billing record only, without the caller's number or other caller data
Full conversation transcript	90 days from the call, deleted automatically	May contain special category data (for example, health data), requires limited retention and enhanced security under Art. 9 GDPR and Law No. 190/2018
Call audio recording (Supabase Storage, EU/Frankfurt)	30 days from the date of the call, automatic deletion	Legitimate interest of the client (controller) in quality verification and evidence of the conversation; short period in application of the storage limitation principle, Art. 5(1)(e) GDPR
Billing data (Vocalyy client)	5 years, calculated from 1 July of the year following the end of the financial year in which they were prepared	Art. 25 of Accounting Law No. 82/1991, as amended by Law No. 36/2023
Audit logs	24 months	Accountability under Art. 5(2) GDPR and investigation of security incidents (Art. 32 GDPR). The period is longer than the retention of caller data (90 days) precisely so we can later demonstrate what happened to that data and when it was deleted.
Website/demo data (not client caller data)	12 months from the last interaction	Data from website forms (demo requests, contact, sign-up). Vocalyy's legitimate interest (Art. 6(1)(f) GDPR) in managing and following up on commercial enquiries. The period restarts on each new contact; if the person becomes a client, the data falls under the “Account data” regime.
Cookies	Maximum 13 months (non-essential cookies); for the duration of the session (strictly necessary cookies)	Consent, Art. 6(1)(a) GDPR (for non-essential cookies). The 13-month term is the maximum period recommended at European level for analytics cookies, after which consent must be requested again.
Account data (Vocalyy client: name, phone, business, authentication)	For the duration of the contract + 3 years after termination	Performance of the contract, Art. 6(1)(b) GDPR, plus the general 3-year statute of limitations for potential claims (Art. 2517 Civil Code). Accounting documents and invoices are retained separately, per the billing period already indicated above.

3. Audio recording

In short: The audio recording of every call is kept for 30 days, then automatically and permanently deleted.

The audio recording of every call is stored by Vocalyy, in Supabase Storage, European Union (Frankfurt, Germany), for 30 days from the date of the call. Once that period expires, our copy is automatically and permanently deleted, through a daily cleanup process.

During those 30 days, the client can listen to and download any recording from the Call History section of the dashboard. The downloaded copy remains in the client's possession, on their own device, indefinitely, from the moment of download, the client becomes the sole controller of that copy and is solely responsible for its security, storage, and any further processing.

The audio recording can be fully disabled, per agent, directly from the agent's configuration. Vocalyy does not keep audio beyond the 30 days and does not use it to train any AI model.

Important clarification regarding sub-processors. The 30-day period is Vocalyy's retention policy and applies to the copy we store. Vocalyy does not use the transcription provider's (ElevenLabs) storage for call recordings; however, that provider's own retention of content processed through its API is governed by the ElevenLabs DPA, section 9.2, not by this policy. For non-enterprise services, ElevenLabs reserves the right, without undertaking the obligation, to delete content after 180 days of inactivity. We therefore cannot guarantee a deletion deadline on their behalf.

4. Automatic deletion

We have automated mechanisms that run periodically to delete data that has exceeded the applicable retention period set out in the table in Section 2. These mechanisms are periodically monitored to confirm correct operation.

5. Deletion at your request (Art. 17 GDPR)

You have the right to request the deletion of your personal data ("the right to be forgotten," Art. 17 GDPR) at any time, through:

Email to agent@vocalyy.ro or agent@vocalyy.ro
The "Delete account" button in the dashboard (where available)
Written request to the registered office of D.O.D.O. OFFICE OUTLET S.R.L.

We commit to responding within a maximum of 30 days of receiving the request, in accordance with Art. 12 GDPR.

6. Exceptions to deletion

Under Art. 17(3) GDPR, the right to erasure is not absolute. We cannot delete certain data when there is a legal obligation to retain it, including:

Billing data: kept for 5 years under Art. 25 of Accounting Law No. 82/1991 (as amended by Law No. 36/2023)
Data necessary for the establishment, exercise, or defense of a legal claim: until the expiry of the applicable limitation period
Audit logs: necessary to fulfill security obligations under Art. 32 GDPR

In these cases, we restrict access to the relevant data to authorized personnel only and do not use it for any purpose other than the one that justifies its retention.

7. Physical deletion: the technical cascade

Once triggered, the deletion of a data category propagates through all systems in which it is stored:

Primary database: deletion from the active system
Cache and operational logs: removal as soon as reasonably possible
Backups: removal at the next backup cycle rotation
Sub-processors: we request corresponding deletion in accordance with the contractual obligations assumed under the Data Processing Agreement (DPA) signed with each sub-processor

8. Audit and verification

The retention policy is reviewed periodically to confirm that the stated periods correspond to actual practice and to the legal obligations in force.

9. Changes to the policy

Any change to this policy will be:

Published on this page, with the date of the new version
Communicated to our clients with sufficient advance notice before taking effect, for significant changes

10. Contact

For questions about retention or to request deletion of your data:

Privacy contact channel: agent@vocalyy.ro
Data subject access requests (DSAR): agent@vocalyy.ro

The address agent@vocalyy.ro is a privacy contact channel and does not, in itself, imply the formal designation of a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR.

Governing version. This document is published in Romanian and in English. In case of any discrepancy between this English version and the Romanian version, the Romanian version prevails.