Privacy notice: European Union and EEA

1. Who this covers

People in the European Union, Iceland, Liechtenstein and Norway, where the GDPR applies: when a business in the EEA uses the service, when a business uses it to offer goods or services to people in the EEA, and for account holders in the EEA.

The law: GDPR, Regulation (EU) 2016/679.

2. Who is responsible

• For the people a business calls or chats with, that business (the workspace) decides why and how the data is used. We process it on its instructions, under our Data Processing Agreement. Under the GDPR the workspace is the controller and we are its processor. (Art. 4(7), 4(8), 28)
• For the accounts of people who sign up with us, we are the controller.

3. Why we may use the data

• Account data: to provide the service you signed up for (contract); to keep billing records the law requires (legal obligation); and to keep accounts secure and investigate misuse (legitimate interests). (Art. 6(1)(b), (c), (f))
• People a workspace contacts: the workspace chooses the legal basis and must have one before it calls or messages anyone. The national rules on unsolicited calls and messages also apply to it.
• Every call an agent makes or answers opens with a spoken statement that it is an automated AI assistant, and that the call may be recorded if recording is on. No workspace setting removes it.
• Since 2 August 2026 the EU AI Act requires that people be told when they are interacting with an AI system. (AI Act Art. 50(1))
• We do not sell personal data, use it for advertising, or train models on calls or chats.

4. Your rights

• Access to your data and a copy of it. (Art. 15)
• Correction. (Art. 16)
• Erasure. (Art. 17)
• Restriction of processing. (Art. 18)
• Portability: your data in a structured, machine-readable form. (Art. 20)
• To object, and to stop direct marketing at any time. Saying so on a call, replying STOP on WhatsApp or using the opt-out link puts your number on that business's do-not-call list. (Art. 21)
• To withdraw consent, without affecting what was done before. (Art. 7(3))
• An answer within one month, which can be extended by two further months for complex requests. (Art. 12(3))

If a business called or messaged you through Dialora AI, ask that business first: it decides what happens to your data, and the workspace has the tools to find, export and erase it. If you do not know which business it was, write to privacy@aicall.vitrano.in with the number that contacted you and the date, and we will pass your request on. If you hold an account with us, write to the same address.

5. Data leaving your country

• Our servers are in Ahmedabad, India, so using the service moves data to India. Services a workspace connects with its own account, such as Twilio, Deepgram, ElevenLabs or a hosted AI model, are mostly in the United States.
• India has no adequacy decision from the European Commission, so a transfer to us needs a safeguard such as the Standard Contractual Clauses. (Art. 45, 46; Decision (EU) 2021/914)

Where each service is: sub-processor list. Terms for businesses: Data Processing Agreement.

6. If there is a breach

• We tell the workspace without undue delay after we become aware of a breach of its data. (Art. 33(2))
• The controller tells its supervisory authority within 72 hours where the breach is likely to put people at risk, and tells the people affected where the risk is high. (Art. 33(1), 34)

7. Complaints

• You can complain to the data protection authority in the EEA country where you live or work, or where you think the law was broken. (Art. 77)
• The list of authorities is kept by the European Data Protection Board. (EDPB members)

8. Still open