Privacy Policy

1. Scope

This policy explains how TelPal handles personal data under the EU General Data Protection Regulation (GDPR). It covers our website (telpal.ai), the TelPal app, and the phone service itself. TelPal is a business phone service: inbound calls to your TelPal number ring in the app over the internet, and missed calls can go to voicemail. Live calls are never recorded — only voicemail messages are.

2. What we collect

• Account data: name, email, business name, business address.
• Number-eligibility (KYC) data required by national numbering rules: business registration number (e.g. an Irish CRO number), identity document, and proof of address. Documents are uploaded to a private, access-controlled store in the EU and shared with our licensed carrier partner, which is legally required to verify them before a number can be activated.
• Call records: caller and called numbers, timestamps, duration, and call outcome.
• Voicemail: the audio message a caller chooses to leave and its automatic transcription, both kept in your dashboard.
• Voice-greeting scripts you write and the generated greeting audio.
• Usage data: feature usage and login activity.
• Billing data via our payment processor (we never store card numbers).
• Mobile app: if you use the TelPal iOS or Android app, a device push-notification token (used only to ring you for inbound calls), a randomly generated per-install device identifier, and your microphone audio during calls. The app uses no advertising identifiers and no cross-app tracking.

3. Callers to your number

When someone calls your TelPal number, we process their phone number and call metadata to route the call, and — if they choose to leave a voicemail — the recording and its transcription. For this caller data, you (the account holder) are the data controller and we act as your processor under our data processing agreement. Your voicemail greeting should tell callers that messages are recorded and transcribed — our default greetings include this notice.

4. Why and on what basis

• Performance of contract — delivering the service you signed up for.
• Legal obligation — verifying number-eligibility documents required by national numbering plans, bookkeeping, and lawful-disclosure obligations that apply to communications providers.
• Legitimate interest — voicemail transcription (so you can read messages instead of dialling in), abuse and fraud prevention, and service improvement.
• Consent — non-essential cookies and product analytics (see section 9).

5. Where your data lives

Account data, call records, voicemail audio, transcripts, and eligibility documents are stored in the European Union. Voicemail audio is kept in a private bucket, accessible only through short-lived signed links from your dashboard. Email notifications carry only basic call details — never the audio itself, which stay in your dashboard. Speech-to-text runs on EU infrastructure, and our telephony carrier processes calls and stores its records in the EU (your voicemail audio is removed from the carrier once it reaches our EU store). Where a sub-processor operates outside the EU/EEA (e.g. payments), transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision — see our sub-processor list. To ring the app for an incoming call, your device's push token is sent through our carrier to Apple's Push Notification service (iOS) or Google's Firebase Cloud Messaging (Android); on iOS, Apple acts as an independent controller for that delivery.

6. Retention

• Voicemail audio: deleted automatically after 90 days (Solo) or 180 days (Team).
• Voicemail transcripts: deleted after 90 days (Solo) or 180 days (Team).
• Call records: caller number, name and transcript are removed after 90 days (Solo) or 180 days (Team); only anonymous call statistics are kept after that.
• Number-eligibility documents: for as long as you hold the number, plus 24 months (numbering regulations require us to be able to evidence eligibility).
• Account data: closing your account starts a 14-day cancellable grace period, after which your account data is erased (residual copies clear from backups within 90 days). Invoices and billing records are kept 7 years as required by bookkeeping law.

7. Sub-processors

We use a small number of vetted service providers, each under a data processing agreement (or, for mobile push delivery, appropriate safeguards): Telnyx LLC, Supabase, Cloudflare, Inc., DigitalOcean LLC, Stripe, Inc., Mailjet (Sinch), ElevenLabs, Gladia SAS, Crisp IM SAS, PostHog (EU Cloud), Google LLC (Firebase Cloud Messaging), Apple Inc. (APNs / PushKit). The full list — including purpose, data involved, and region — is published at telpal.ai/subprocessors.

8. Lawful disclosure

As a communications service we can be legally required to disclose limited data (e.g. subscriber or call records) to competent national authorities. We disclose the minimum required, only against a valid legal order, and log every request.

9. Cookies and analytics

Essential cookies keep you signed in and remember your market, language, and currency choices. Non-essential tools — product analytics (EU-hosted) and the support chat widget — are only loaded with your consent, which you can change at any time via the cookie settings link in the footer. In the mobile app, the same anonymous product analytics can be turned off at any time in Settings → Privacy.

10. Your rights

You can request access, rectification, erasure, restriction, portability, or object to processing by emailing privacy@telpal.ai. You can also delete your account, voicemails, and recordings directly from the dashboard. If you are a caller whose voicemail was recorded, contact the business you called or us. You may lodge a complaint with your local supervisory authority — in Ireland the Data Protection Commission — or with our lead supervisory authority, the Swedish Authority for Privacy Protection (IMY).

11. Who we are

The data controller for account data is the company behind TelPal: Dario Dario AB (org.nr. 559576-4415), Stockholm, Sweden, an EU-established company. Privacy questions: privacy@telpal.ai.