Privacy Policy

This Privacy Policy describes how KALLY INTELLIGENCE, INC. ("we", "us", or "our") collects, uses, and protects your personal data when you use our AI-powered phone assistant service KallyAI ("Service").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

KALLY INTELLIGENCE, INC. is the data controller responsible for your personal data.

2. Data We Collect

2.1 Information You Provide

2.2 Information Generated During Service Use

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): To provide the Service you requested
• Legitimate Interest (Art. 6(1)(f)): For service improvement, security, and fraud prevention
• Consent (Art. 6(1)(a)): For optional features like marketing communications
• Legal Obligation (Art. 6(1)(c)): For tax records and compliance requirements

4. How We Use Your Data

We use your personal data to:

• Execute phone calls on your behalf
• Provide call transcripts and summaries
• Process payments and manage subscriptions
• Improve the AI's performance and accuracy
• Ensure service security and prevent abuse
• Communicate important service updates
• Comply with legal obligations

5. Data Sharing

We share your data only with:

• Twilio: Telephony provider for making calls
• Stripe: Payment processing
• OpenAI: AI language processing (conversation data is not stored by OpenAI)
• Google Cloud Platform (GCP): Cloud infrastructure provider with data centers in both the European Union and United States

We do NOT sell your personal data to third parties.

6. Data Retention

We apply retention periods based on the country you're calling. This ensures compliance with local data protection laws (GDPR for EU, standard requirements for other regions).

For calls to unsupported regions, we apply a minimal retention profile where recordings and transcripts are not stored to ensure maximum privacy.

After retention periods expire, data is automatically and permanently deleted.

7. Data Security

We implement robust security measures:

• Encryption at Rest: All recordings and transcripts are encrypted using AES-256
• Encryption in Transit: All communications use TLS 1.3
• Access Controls: Strict role-based access to data
• Tenant Isolation: Each user's data is cryptographically isolated
• Regular Audits: Security practices are regularly reviewed

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Restrict processing of your data
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Note: Users in Vatican City, Andorra, Faroe Islands, Switzerland, Brazil, Mexico, Australia, New Zealand, and Canada may have additional rights under their respective data protection frameworks. See Section 15 (Regional Disclosures) for details.

9. International Data Transfers

KALLY INTELLIGENCE, INC. is a US-based company. Your data may be processed in both the United States and the European Union.

We implement appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission (for EU/EEA transfers)
• EU-US Data Privacy Framework certification (where applicable)
• Technical and organizational safeguards including encryption at rest and in transit
• Compliance with applicable data protection laws in the jurisdictions where we operate

For users in Australia and New Zealand: Your personal information may be transferred to and stored in servers located outside your country. We take reasonable steps to ensure that overseas recipients handle your personal information in accordance with applicable privacy laws.

10. Cookies and Tracking

Our landing page uses the following types of cookies:

10.1 Essential Storage (localStorage)

We use browser localStorage for:

• Cookie Consent Preference: Remembers your consent choice
• User Preferences: UI settings like modal dismissal

These are not cookies but browser storage that stays on your device and is never sent to our servers.

10.2 Analytics Cookies (Consent Required in Certain Jurisdictions)

We use Google Analytics 4 (GA4) to understand how visitors use our website. For users in the EU, EEA, UK, Switzerland, Vatican City, Andorra, and Faroe Islands, these cookies are only set after you explicitly accept analytics cookies via our consent banner.

Note: Users in Brazil, Mexico, Australia, New Zealand, and Canada may have different cookie consent requirements under their local laws. Analytics cookies are loaded automatically in these jurisdictions unless local law requires explicit consent.

GA4 collects anonymized data including: pages visited, time on site, referral source, device type, and general geographic region. This data helps us improve our website and understand user needs.

10.3 Managing Your Cookie Preferences

For users in certain jurisdictions (EU, EEA, UK, Switzerland, Vatican City, Andorra, Faroe Islands):

• You can accept or reject analytics cookies via the consent banner
• To change your preference, clear your browser's localStorage for this site and refresh the page

For users outside these regions, analytics cookies are loaded automatically as explicit consent is not legally required in most jurisdictions.

11. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or through the Service. The "Last Updated" date at the top indicates the latest revision.

13. Complaints

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the appropriate authority:

13.1 For EU Users

• Your local data protection authority
• The Spanish Data Protection Agency (AEPD): www.aepd.es — for contact purposes, our EU contact address is in Spain

13.2 For US Users

• The Federal Trade Commission (FTC): www.ftc.gov/complaint
• Your state Attorney General's office

13.3 For Other Jurisdictions

You may also contact your local data protection authority:

• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
• Australia: Office of the Australian Information Commissioner (OAIC)
• New Zealand: Office of the Privacy Commissioner (OPC)
• Canada: Office of the Privacy Commissioner of Canada (OPC)

14. Your California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

14.1 Your Rights

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out: You can opt-out of the "sale" of your personal information. Note: We do NOT sell personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

14.2 How to Exercise Your Rights

To exercise your California privacy rights, contact us at [email protected] with the subject line "CCPA Request". We will verify your identity and respond within 45 days.

14.3 Categories of Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (email, user ID)
• Commercial information (subscription and payment history)
• Audio/visual information (call recordings)
• Internet activity (usage logs)

15. Regional Disclosures

This section provides additional information for users in specific jurisdictions who may have additional rights under local data protection laws.

15.1 Brazil

If you are located in Brazil, you may have additional rights under local data protection laws, including:

• Right to access, rectification, deletion, and portability of your personal data
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time
• Right to information about data sharing with third parties

To exercise your rights, contact us at [email protected].

15.2 Mexico

If you are located in Mexico, you may have additional rights under local data protection laws, including:

• Access (Acceso): Request a copy of your personal data
• Rectification (Rectificación): Correct inaccurate data
• Cancellation (Cancelación): Request deletion of your data
• Opposition (Oposición): Object to processing of your data

To exercise your rights, contact us at [email protected].

15.3 Australia

If you are located in Australia, you may have additional rights under local privacy laws. Your personal information may be transferred to and stored in servers located outside Australia. We take reasonable steps to ensure that overseas recipients handle your personal information in accordance with applicable privacy laws.

To exercise your rights, contact us at [email protected].

15.4 New Zealand

If you are located in New Zealand, you may have additional rights under local privacy laws, including:

• Right to access and correction of your personal information
• Right to request information about how your data is used
• Protection against unauthorized disclosure

To exercise your rights, contact us at [email protected].

15.5 Canada

If you are located in Canada, you may have additional rights under local privacy laws, including:

• Right to access and correction of your personal information
• Right to withdraw consent at any time
• Right to file a complaint with the Privacy Commissioner of Canada

To exercise your rights, contact us at [email protected].

15.6 Other Jurisdictions

Users in Vatican City, Andorra, Faroe Islands, and Switzerland may have additional rights under local data protection laws:

• Vatican City: May have additional rights under local law
• Andorra: May have additional rights under local law
• Faroe Islands: May have additional rights under local law (outside EU but may have similar protections)
• Switzerland: May have additional rights under local law

To exercise your rights, contact us at [email protected].

16. Contact Us

For privacy-related questions or concerns:

• Company: KALLY INTELLIGENCE, INC.
• Email: [email protected]