Privacy Policy

1. Controller and contact

The controller of personal data is AI AGENT HUB PROSTA SPÓŁKA AKCYJNA, registered office in Katowice, ul. Jana III Sobieskiego 11/E6, 40-082 Katowice, Poland, entered in the register of entrepreneurs of the Polish National Court Register (KRS) under number 0001168165, tax ID (NIP) 6343054493, REGON 541503506.

For any matter concerning personal data, including exercising the rights described in section 11, you can contact us by e-mail at support@aiagenthub.pl (please use the subject line “Data protection — Telofia”) or in writing at our registered address.

The Controller has not appointed a data protection officer because it is not required to do so (Article 37 GDPR). Data protection matters are handled by a person designated by the management board, reachable at the e-mail address above.

2. When we are a controller and when we are a processor

We are the controller of the data of website visitors, people who use the contact form, customers and their team members who use the dashboard, participants of “Call me” demo calls and members of the partner program.

For the data of people who call our customers (recordings, transcripts, phone numbers, information given during the call, bookings and messages) we act as a processor, only on the customer’s instructions and under the data processing agreement. The controller of that data is the business the person is calling (see section 8).

3. What data we process

• Account data: name, e-mail address, company name, team role and account settings; when you sign in with Google, basic Google profile data (name and e-mail address).
• Billing data: selected plan, payment and invoice history, company details for invoices (name, address, tax ID). Payment card data is processed only by Stripe; we have no access to full card numbers.
• Content provided by the customer to configure the assistant: business knowledge, instructions, price lists, greetings and the content of the public website indicated when creating the assistant.
• Contact form data: name, e-mail address, company, topic and message.
• Technical data: IP address, browser and device type, time and addresses of requests, in server and security logs; activity performed in the account, in the dashboard audit log.
• Statistics (only with consent): information about website use collected by Google Analytics 4 (see section 10).
• Partner program: the partner code from the referral link and, when the link is clicked, a one-way hash of the IP address, never the full address.
• “Call me” demo call: phone number (in readable form only while the call is set up and the SMS is sent), its one-way hash and masked form (e.g. +48 22 ••• 958), a hash of the IP address, a recording of the call including the voices of both parties, its transcript and technical parameters.
• Conversations with the assistant in the browser or in the widget on a customer’s website: microphone audio transmitted during the conversation, browser language, the address of the page the conversation was started from and a hash of the IP address (for rate limits and abuse prevention).
• Data of people calling our customers (as a processor): phone number, voice recording (if the customer has enabled recording), transcript, call summary and score, information given during the call (e.g. name, appointment time, description of the matter) and the content of SMS and e-mails sent.

4. Purposes and legal bases

• Concluding and performing the Telofia service agreement, maintaining the account, technical support and service communication: Article 6(1)(b) GDPR; for people acting on behalf of a customer: Article 6(1)(f) GDPR (legitimate interest in performing the agreement with the customer).
• Billing, issuing and storing invoices and accounting records: Article 6(1)(c) GDPR in conjunction with tax law and the Polish Accounting Act.
• Replying to contact form messages or e-mails: Article 6(1)(f) GDPR, and where the message concerns concluding an agreement, Article 6(1)(b) GDPR.
• The demo call, sending one summary SMS and recording and automatically analysing the call to improve the assistant: Article 6(1)(a) GDPR (consent given in the form); storing the number hash to limit abuse: Article 6(1)(f) GDPR.
• Website statistics (Google Analytics 4) and storing the partner attribution cookie: Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law (consent to the relevant cookie category given in the banner).
• Settling the partner program: Article 6(1)(b) GDPR (agreement with the partner) and Article 6(1)(f) GDPR.
• Ensuring the security of the website and the service, preventing abuse, keeping event logs: Article 6(1)(f) GDPR.
• Informing customers about new Telofia features and offers: Article 6(1)(f) GDPR; we send commercial information by electronic means only with prior consent, which can be withdrawn at any time.
• Establishing, exercising or defending legal claims: Article 6(1)(f) GDPR.

Providing data is voluntary but necessary to create an account, conclude an agreement, receive a reply or receive a demo call. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

5. Quality analysis and artificial intelligence

Recordings and transcripts of demo calls are analysed automatically, on our own servers and using the Google Gemini (via OpenRouter) and Anthropic Claude language models, to assess audio quality and the course of the conversation and to formulate general rules that improve the assistant. These rules do not contain personal data (among other things, we filter out numbers, e-mail addresses and web addresses). Recordings are deleted after 30 days.

Conversations handled by our customers’ assistants are not used for the quality analysis described above. Their summaries and scores are generated automatically only for the customer concerned, and insights from a customer’s calls (if the customer has enabled assistant learning) are applied only to that customer’s assistant.

We do not train artificial intelligence models on call data, and our language model providers process it only to generate responses, in accordance with their agreements.

6. Recipients of data

We entrust data to service providers who process it on our behalf under data processing agreements, for hosting and database (Supabase, Vercel), voice transport (LiveKit), telephony and SMS (Telnyx, with SMSAPI and Twilio as backups), speech recognition (Soniox), language models (OpenRouter and Google, Anthropic), e-mail delivery (our own mail server of the telofia.com domain, aderlo.cloud hosting) and statistics (Google). The full list, with the purpose and location of processing, is available on the subprocessors page.

Stripe processes payment data as an independent controller under its own privacy policy. Integrations connected by the customer (e.g. Google Calendar, Microsoft Outlook, HubSpot, Pipedrive) receive data on the customer’s instructions.

Data may also be disclosed to providers of accounting and legal services and to public authorities where required by law. We do not sell personal data.

7. Where data is processed and transfers outside the EEA

Our main database and recording storage are in the European Union (Frankfurt, Germany). Voice processing during calls takes place in LiveKit Cloud in the EU and on servers operated by us in Poland, which run, among other things, speech synthesis and quality analysis.

Some providers (in particular providers of language models, speech recognition, e-mail delivery and payments) may process data in the United States or other countries outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified entities) or on standard contractual clauses approved by the European Commission, together with supplementary measures. You can obtain a copy of the safeguards by writing to support@aiagenthub.pl.

8. People who call our customers

If you speak with the Telofia assistant of a business you are calling, that business is the controller of your data. It decides whether calls are recorded and how long recordings and transcripts are kept (from deletion the day after the call to indefinite storage), and we process the data only on its instructions.

Every call starts by telling you that you are speaking with an AI assistant. If recording is enabled, the greeting also says that the call is recorded. You can ask to be put in touch with a person at any time.

For requests about your data, please contact that business first; at its request, we will help it handle your request. If you do not know which business uses Telofia, write to support@aiagenthub.pl and we will forward your request to the relevant customer.

9. How long we keep data

• Account data and configuration content: for the term of the agreement and up to 30 days after it ends (except data we must keep longer); if the account owner deletes the account in the dashboard — immediately.
• Invoices and billing records: 5 years from the end of the calendar year in which the tax payment deadline expired.
• Data processed to defend against claims: until the limitation period for claims expires (as a rule up to 6 years).
• Recordings and transcripts of customers’ calls: for the period set by the customer in the dashboard (Privacy mode); call summaries until deleted by the customer or until the agreement ends.
• Recordings and transcripts of demo calls: 30 days. Hashes of phone numbers and IP addresses from demo calls: 90 days. Notes from demo calls (your name if given, type of business, the website you mentioned and a short summary, kept under the number hash without the number or transcript, so the assistant can continue the conversation in the next call or in a callback you asked for) and scheduled demo callbacks (number encrypted until the call is made): 30 days.
• Contact form messages: up to 12 months after the correspondence ends.
• Data processed on the basis of consent: until consent is withdrawn; cookies for the periods stated in the cookie policy.
• Security logs and the API request log: up to 90 days, unless needed to investigate an incident.

10. Cookies and Google Analytics

We use strictly necessary cookies (for example for signing in, language, currency and remembering your cookie banner choice). Analytics cookies (Google Analytics 4) and marketing cookies (partner attribution) are stored only after you consent to the relevant category in the cookie banner. You can change or withdraw your consent at any time using the “Cookie settings” link in the website footer; withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Google Analytics 4 gives us aggregated visit statistics (e.g. number of visits, pages viewed, traffic sources, approximate location and device type). The service is provided by Google Ireland Limited; data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework. Details are in the cookie policy.

11. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interests (and always to direct marketing) and the right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to support@aiagenthub.pl. We will reply without undue delay and at the latest within one month. We may ask for information needed to confirm your identity.

Account owners can delete the account and its data themselves at any time in the dashboard (Settings → Danger zone → Delete account). Deletion takes effect immediately: we cancel the subscription, release the phone numbers, revoke integration access and delete the assistant, calls, recordings and contacts. We keep only the invoices and payment records that tax law requires us to retain. You can also request deletion by e-mail to support@aiagenthub.pl.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the country of your habitual residence or place of work.

12. Data from Google accounts

If you connect Google Calendar, Telofia only uses: free/busy information, the list of your calendars (so you can choose one), and the events it creates, moves or deletes for bookings made by the assistant. We also read the Google account’s e-mail address to show which account is connected.

Telofia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, do not sell it and do not train AI models on it; humans do not read it unless you ask us to, for security purposes or where required by law.

Access tokens are stored encrypted. You can disconnect at any time in the dashboard (Integrations) or at myaccount.google.com/permissions; when you disconnect, we revoke and delete the token.

13. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular encryption in transit (TLS) and at rest, encryption of integration tokens, role-based access control and least privilege, private recording storage accessible via short-lived signed links, event logging, backups and limits that protect against abuse.

14. Changes to this policy

This policy may be updated, in particular when the law, the service’s features or its providers change. The current version is always available on this page together with the date of the last update. We inform customers of material changes by e-mail or in the dashboard at least 14 days in advance.