Version 2026-09-26-draft1
CallQA Privacy Policy
DRAFT, not legal advice, to be reviewed by counsel. Version:
2026-09-26-draft1. Not in force.[COUNSEL: ...]notes and[À COMPLÉTER]fields must be resolved before publication. Legal references were consulted on 2026-09-26.
Last updated: [À COMPLÉTER: publication date]
This policy explains how CallQA handles personal data when you visit callqa.dev, use
app.callqa.dev and its API, or are on the receiving end of a CallQA test call.
1. Who is responsible
Controller: [À COMPLÉTER: legal entity name, address, registration number], "CallQA",
"we". Contact for privacy questions: [À COMPLÉTER: [email protected]].
[COUNSEL: a Data Protection Officer is mandatory only in the cases of GDPR art. 37; confirm
that CallQA does not fall in them (large scale regular and systematic monitoring?). If no DPO,
say so and keep the contact above.]
CallQA plays two roles: - Controller for data about our customers' accounts, billing, website visitors, security, and prevention of abuse of the telephone network (sections 2.1 to 2.5 and 2.8). - Processor on behalf of our customer for the content of test calls and scenarios (sections 2.6 and 2.7). For that data, the customer organization is the controller: its own privacy notice applies, and our Data Processing Agreement governs what we do. If you were on a line that a customer tested, you can contact that customer, or us and we will forward your request.
2. What we process, why, and on which legal basis
The legal bases are those of GDPR art. 6(1) (Regulation (EU) 2016/679, https://eur-lex.europa.eu/eli/reg/2016/679/oj).
| # | Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|---|
| 2.1 | Account: name, work email, hashed password, organization, role, invitations, login timestamps, IP address of sessions | You, your admin | Create and secure your account, provide the Service | Contract, art. 6(1)(b) |
| 2.2 | Billing: billing contact, company name, address, VAT number, subscription, invoices, Wallet ledger. Card data is handled by Stripe, we never see full card numbers | You, Stripe | Charge, invoice, keep accounting records | Contract, art. 6(1)(b); legal obligation, art. 6(1)(c), for accounting records |
| 2.3 | Target number records: phone number, name and description you give it, verification attempts and their outcome (the code is never stored in clear), Number Attestation (signer name, email, IP, date, text version) | You, the Service | Prove that calls were authorized; prevent abuse; defend legal claims | Legitimate interest, art. 6(1)(f): preventing unlawful calls and establishing, exercising or defending legal claims |
| 2.4 | Audit log and API logs: who did what and when (action, object, IP, API key prefix); API request metadata (method, path, status, duration, IP, user agent, no body) | The Service | Security, troubleshooting, showing your organization its own activity, abuse investigation | Legitimate interest, art. 6(1)(f); contract for the log shown to your admins |
| 2.5 | Abuse and safety: reports we receive (reporter's contact, number called, date), signals computed from call metadata and transcripts, suspension decisions | Reporters, the Service | Detect and stop calls to people who did not agree; cooperate with carriers and authorities | Legitimate interest, art. 6(1)(f); legal obligation where an authority requires it |
| 2.6 | Call content (processor role): transcripts of both sides of the call, call events, timings, scores, AI-generated evaluations, and audio recordings when the customer enables them. May contain the voice, words and name of a person who answered a tested line (for example a call center agent) | The call | Provide the testing service to the customer | Determined by the customer as controller (DPA) |
| 2.7 | Scenarios and test data (processor role): personas, goals, criteria, injected test data | The customer | Idem | Determined by the customer as controller. Customers must use fictitious data only (AUP section 1.7) |
| 2.8 | Website and early access: email and country entered in the early access form, anti-bot check result; cookieless, aggregated audience measurement | You, the landing page | Answer your request, invite you to the free report, measure audience | [COUNSEL: consent (art. 6(1)(a)) for the early access form, or legitimate interest for B2B prospecting as the CNIL allows; choose]. Audience measurement: legitimate interest |
| 2.9 | Support: messages you send and our replies | You | Answer you | Legitimate interest, art. 6(1)(f) |
| 2.10 | Campaign attribution: the campaign parameters of the link that brought you (utm_source, utm_medium, utm_campaign, utm_content, utm_term, a partner code ref), the name of the site you came from (host only) and the first page you opened, for your first and your latest visit through a campaign; attached to your account when you sign up, and to the organizations you create |
The link you followed, your browser | Know which campaigns and partners bring customers, and compute partner commissions | Legitimate interest, art. 6(1)(f): measuring our own advertising and partnerships. No profiling, no cross-site tracking, not used to target you |
We do not use call content or test data to train machine learning models, and we do not
sell personal data. [PRODUCT: keep this true, including for AI subprocessors, see DPA
Annex 3.]
Automated scoring. Calls are scored by language models. The scores evaluate the tested
system, not a person, and produce no legal or similarly significant effect on anyone. They are
not decisions within the meaning of GDPR art. 22. [COUNSEL: confirm, in particular if a
customer uses scores to evaluate human call center agents; the AUP may need to forbid or frame
that use.]
AI voice. Our test caller speaks with a synthetic voice. [COUNSEL: Regulation (EU)
2024/1689 (AI Act) art. 50(1) requires providers of AI systems intended to interact directly
with natural persons to design them so that those persons are informed that they are
interacting with an AI system, unless obvious from the context; confirm the date of
application to CallQA and whether the caller must announce itself as an automated test call
at the start of each call.]
3. How long we keep data
The following durations are proposed defaults for counsel and product validation. Where the law sets a duration, the source is given; otherwise the duration is a product choice.
| Data | Proposed retention | Reason / source |
|---|---|---|
| Call transcripts, call events and AI evaluations (2.6) | Per plan, counted from the call: Free report 30 days, Starter 90 days, Growth 180 days, Scale 365 days, custom plans as agreed. The customer can delete earlier | Product choice. The code has a per-plan retention_days field (default 90) that is not enforced yet |
| Audio recordings (2.6), when enabled | 30 days on all plans, configurable down to 0 (never stored). Up to 90 days on Scale | Product choice: audio is the most sensitive element (voice) |
| Aggregated results without transcript or audio (score, verdict, latency, duration, cost) | Life of the organization | Needed for regression dashboards; contain no call content |
| Scenarios and test data (2.7) | Until deleted by the customer or end of contract (DPA section 10) | Contract |
| API request logs (2.4) | 30 days | Product choice |
| Webhook delivery payloads | 30 days | Product choice |
| Audit log, Number Attestations, verification records (2.3, 2.4) | Life of the organization plus 5 years after its closure | To defend claims. [COUNSEL: confirm. French civil limitation period is 5 years (Code civil art. 2224). US federal claims such as TCPA private actions fall under the 4 year catch-all period of 28 U.S.C. § 1658(a) (https://www.law.cornell.edu/uscode/text/28/1658); some state claims may be longer.] |
| Abuse reports and evidence (2.5) | 5 years after the case is closed | Same reasons, to be confirmed by counsel |
| Account data (2.1) | Life of the account; deleted or anonymized within 30 days after account or organization closure | Contract |
| Invoices and accounting records (2.2) | 10 years | Code de commerce art. L123-22 (accounting documents). [COUNSEL: confirm the article and scope.] |
| Early access list (2.8) | Until you join or ask to be removed, and at most 3 years after your last interaction | [COUNSEL: aligned on the CNIL's usual 3 year recommendation for prospects; confirm.] |
| Support messages (2.9) | 3 years after the last message | Product choice |
| Campaign attribution cookie (2.10) | 90 days in your browser | Product choice: length of a campaign's attribution window |
| Campaign attribution of an account (2.10) | Life of the account or organization, deleted with it | Revenue attribution and partner commissions |
| Backups | Rolling 30 days, then overwritten | Product choice. [PRODUCT: today local backups are kept 14 days but the offsite copy has no expiry, see README.] |
4. Who receives data
- Our staff, on a need to know basis (support, security, abuse handling).
- Subprocessors that help us provide the Service: telephony, AI models (speech to text, language models, text to speech), payment, email, hosting, DNS and CDN. Their current list, location and role are in Annex 3 of the DPA. We update it before adding a new one.
- Stripe also acts as an independent controller for some payment data, under its own privacy policy.
- Carriers, regulators, courts and law enforcement, when the law requires it or to respond to an abuse of the telephone network, limited to what is necessary.
- A successor in case of merger or sale of the business, under the same commitments.
5. International transfers
Several subprocessors are established in the United States (see DPA Annex 3). Transfers of personal data from the European Economic Area rely on: - the EU-US Data Privacy Framework, for recipients certified under it (the Commission adequacy decision of 10 July 2023; list of certified organizations: https://www.dataprivacyframework.gov/list), and otherwise - the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), with a transfer impact assessment.
[COUNSEL + PRODUCT: the certification status and the transfer mechanism of each subprocessor
must be checked one by one before publication; none has been verified for this draft.]
6. Security
We protect data with measures described in Annex 2 of the DPA, including encryption in transit, hashed credentials and API keys, role-based access, an append-only audit log, and signed webhooks. No system is perfectly secure; we will notify you and the competent authority of a personal data breach where GDPR art. 33 and 34 require it.
7. Your rights
If the GDPR applies to you, you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing is based on consent (GDPR art. 15 to 21). To exercise them, write to [À COMPLÉTER: [email protected]]. We answer within one month (GDPR art. 12(3)). We may need to verify your identity.
For call content (section 2.6), we act for our customer: we forward your request to it and help it answer.
You can lodge a complaint with a supervisory authority, in France the CNIL (https://www.cnil.fr/fr/plaintes), or the authority of your country of residence or work.
United States residents. [COUNSEL: check whether CallQA meets the thresholds of the
California Consumer Privacy Act (Cal. Civ. Code § 1798.140) or other state privacy laws, and
add the required notice if so. As a processor of customer call content, CallQA would be a
"service provider"; the DPA may need matching terms.]
8. Cookies and audience measurement
app.callqa.devuses cookies that are strictly necessary (session and CSRF protection) and one first-party campaign attribution cookie,callqa_attr: it is set only when you arrive through a link carrying campaign parameters (or from another site), holds those parameters, the referring host and the landing page (section 2.10), is signed, readable only byapp.callqa.dev, and expires after 90 days. It contains no identifier and is never shared with or read by third parties. The referral cookiecallqa_ref(60 days) works the same way for the "refer a friend" link.callqa.devkeeps the same campaign parameters in your browser storage (no cookie, 90 days) only to pass them on its links toapp.callqa.dev. Nothing is sent elsewhere.[COUNSEL: confirm that this strictly first-party campaign attribution, used only to measure our own campaigns, can rely on legitimate interest without consent (ePrivacy art. 5(3), CNIL guidance on audience measurement exemptions), or whether a notice in the footer is enough.]callqa.devmeasures audience with a self-hosted, cookieless tool that does not store identifiers on your device.[COUNSEL: confirm that no consent banner is needed for this setup (CNIL exemption for audience measurement), and describe the anti-bot check used on the early access form.]
9. Children
The Service is for businesses. It is not directed at children and must not be used to call them.
10. Changes
We will post changes on this page and notify account admins by email of material changes.
Version history
| Version | Date | Change |
|---|---|---|
| 2026-09-26-draft1 | 2026-09-26 | First draft for counsel review |