Who the controller is
- Controller: Codelabs Studio S.L.
- Tax ID (CIF): B88708797
- Registered address: PASAJE Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain
- Privacy contact: show the contact email
For the calls you make with CallCenterSuite (the contacts you call or who call you, their recordings and transcripts), you, our customer, are the controller, and we process that data on your behalf as a processor, under the data processing agreement.
What data we process
- Website visits: technical data (IP address, browser, pages viewed) needed to serve and protect the website; and, only if you accept it in the banner, chat analytics and the Meta pixel (details in the cookie policy).
- Website chat: what you write in the help chat.
- Account: name, email, organisation and role of each team member (administrator or closer) and the phones each closer registers to call from.
- Calls (on the customer's behalf): the contact's name and phone number, the goal and script of the call, the scheduled date and time, the audio, the recording (unless “Do not record” is pressed), the transcript, the objections detected, the notes, the summary and the follow-up draft, and the outcome.
- Consent for AI calls (on the customer's behalf): the consent record of each contact an AI agent calls, and the do-not-call list.
- Billing: company name, tax ID, billing address, plan, amounts and invoices. Card details are entered on Stripe's payment page and never go through our servers.
What we use it for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Serving the website and protecting it from abuse | Legitimate interest in a secure service (art. 6.1.f GDPR) |
| Answering in the help chat | Your request (art. 6.1.b GDPR) |
| Creating and maintaining your account and your team's | Performance of the contract (art. 6.1.b GDPR) |
| Scheduling, making, recording, transcribing and analysing the customer's calls | On the customer's behalf, under their instructions (art. 28 GDPR) |
| Measuring our ads with the Meta pixel | Your consent (art. 6.1.a GDPR), only if you accept |
| Charging plans and issuing invoices | Performance of the contract and legal obligation |
We do not sell data, we do not advertise with call data and we do not use it to train artificial intelligence models. We make no automated decisions with legal effects on anyone.
Safeguards on calls
- An AI agent only calls people whose consent is on record (article 66.1.a of the Spanish General Telecommunications Act), within the legal calling hours and not on the do-not-call list.
- Calls never go out from a hidden number.
- The contact is told the call is recorded and can ask for it not to be; then “Do not record” is pressed and the recording is deleted.
- The follow-up draft prepared by the AI never goes out by itself.
How long we keep it
- Account: while it is active; once closed it is deleted within 30 days at most.
- Call data: as long as the customer, as controller, decides, and at most for the term of the contract; afterwards it is deleted or returned to them.
- Website chat conversations: as long as needed to handle your question.
- Technical security logs: up to 90 days.
- Billing: the periods required by law (up to 6 years under the Spanish Commercial Code).
Who we share it with
Only with the providers needed to deliver the service, as processors or sub-processors:
- AgenteUno (Codelabs Studio S.L.): a product of the same company that provides call audio, the phone line, the voice of the AI agents, transcription and recording, and serves the website help chat.
- Telnyx: the telephone carrier AgenteUno uses to dial, receive and transfer calls.
- Deepgram: transcription of call audio, with Telnyx as a fallback.
- Cloudflare, Inc.: DNS and the network that protects the website, and storage of recordings (Cloudflare R2).
- Hetzner Online GmbH: servers in Germany (European Union) hosting the application and the database.
- Language model providers: those AgenteUno uses for live suggestions, summaries and objection analysis, and for the website chat; they only receive the text each task needs.
- Stripe Payments Europe, Ltd. (Ireland): charging the paid plans.
- Meta Platforms Ireland Limited: only if you accept the “Advertising” category in the banner (Meta pixel).
We do not disclose data to third parties unless required by law.
Transfers outside the European Economic Area
Our servers are in the European Union. Some providers (for example telephony, transcription, language models, Cloudflare, Stripe or Meta) may process data outside the European Economic Area. In those cases the transfer relies on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on standard contractual clauses.
How we protect it
- All traffic is encrypted with HTTPS.
- Each organisation is isolated: nobody from another organisation sees its calls, and a closer only sees their own organisation's.
- Lists show at most the last three digits of each phone number.
- Access to the servers is restricted and goes through a private network.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to show the contact email. If processing is based on your consent, you can withdraw it at any time. We reply within one month at most.
If you received a call made with CallCenterSuite, the controller is the company that called you: contact them. If you write to us, we will pass your request on to them.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency at www.aepd.es.
Changes to this policy
If we change anything important, we will publish it here with a new date and, if you have an account, tell you before it applies.