Privacy Policy
Privacy Policy
Last updated: 20 October 2026
Who is responsible
The controller of your personal data is the provider of Behalf.
For anything about your data, write to us through the app.
What we process and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: name, email, password (hashed), your own phone number | Run your account, forward calls to you | Contract, Art. 6(1)(b) |
| Number registration: your name and the billing address you enter at checkout, passed to our telephony provider | Assign and register your Polish number | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Briefs, transcripts, summaries, vault facts | Make and answer calls for you, show you what happened | Contract, Art. 6(1)(b) |
| What callers and callees say, and their numbers | Hold the conversation you asked for | Legitimate interest, Art. 6(1)(f) |
| Call times, durations, minutes used | Deliver and bill the service, prevent abuse | Contract and legitimate interest |
| Payments and invoices | Take payment, keep accounting records | Contract and legal obligation, Art. 6(1)(c) |
| Security logs | Keep the service safe | Legitimate interest, Art. 6(1)(f) |
| Waiting-list email and name | Tell you when access opens | Consent, Art. 6(1)(a) |
We never use your calls, transcripts or vault to train AI models, and we do not sell data.
Calls and transcripts
The other person on every call is told at the start that an AI assistant is speaking and that the call is transcribed. Audio is not stored by default: it is turned into text during the call and discarded. If you turn on keeping audio, it is deleted after 30 days.
The secretary sorts incoming callers (for example expected, sales, spam) only to decide whether to forward the call or notify you. Every caller can leave a message, and you can review each decision.
How long we keep it
- Transcripts and summaries: until you delete them, at most 30 days on Starter and 12 months on Plus and Pro.
- Vault facts: until you delete them. Deletion is permanent.
- Account data: while your account is open, then deleted. Backups clear within 30 days.
- Invoices: 5 years, as tax law requires.
- Security logs: 12 months.
Who processes data for us
We use providers that act on our instructions under data processing agreements:
- Telephony and numbers: Telnyx
- Real-time voice: LiveKit
- Speech recognition, AI language model and speech synthesis: specialist voice and AI providers
- Payments: Stripe, or the app store when you subscribe in an app
- Hosting: cloud hosting in the EU
- Push notifications: Apple and Expo (notifications carry no call content)
Some providers process data outside the EEA. Those transfers are covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We share data with authorities only when the law requires it.
Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and we report breaches to the supervisory authority within 72 hours.
Your rights
You can ask to access, correct, delete, restrict or export your data, object to processing based on legitimate interest, and withdraw consent at any time. If you spoke with a Behalf secretary on a call, you have the same rights; write to us through the app with your number and the time of the call. We answer within one month.
You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl).
The service is for adults (18+).