Privacy Policy

1. Identity and contact details of the data controller

The data controller is the entity that determines the purposes and means of processing your personal data:

2. Data protection officer (DPO)

Softcallia has fewer than 250 employees and does not carry out large-scale processing of special categories of data within the meaning of Article 37 of the GDPR. The designation of a DPO is therefore not mandatory. Nevertheless, we have designated an internal personal data protection contact.

For any question relating to the protection of your personal data:

• Email: dpo@softcallia.com
• Postal address: Softcallia — Côme Bruchet — 24 rue David, 51100 Reims

3. Personal data collected

We collect only data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (data minimization principle, Article 5.1.c of the GDPR). Here is the detail by category:

3.1. Identification and account data

3.2. Telephone call data

3.3. Appointment data

3.4. Payment data

3.5. Browsing data and technical data

3.6. Data collected from callers (third parties)

When a third party (the User's customer) calls the number configured in the Service, certain data concerning them is collected: phone number, voice content of the call, transcription and summary. The caller is informed at the start of the call that the conversation is processed by an automated assistant. If the business called has requested the audio recording option, the voice agent also announces that the call is recorded and that the caller can object; if they do, the recording is stopped and deleted. For the data of their own customers, the User is the data controller and Softcallia the processor. The User undertakes to comply with their information obligations under Articles 13 and 14 of the GDPR.

3.7. Google Calendar data (optional)

If the User connects their Google Calendar (optional, under Settings then Integrations), Softcallia accesses, with the Google permission “See and edit events on all your calendars” (calendar.events), the events of their calendars: start and end times, status, availability (busy or free), invitation responses, and event titles.

• Read: before offering a time slot to a caller, Softcallia checks that the User is not already busy. The voice assistant only receives busy time ranges, never the title or content of events. Titles are shown only to the User, in their own Softcallia schedule.
• Write: Softcallia creates, updates and deletes in their calendar the appointments booked through the Service.
• Retention: no copy of Google events is kept. They are read when needed; only the identifier of the appointments created by Softcallia and the (encrypted) authorization token are stored.
• What Softcallia never does: sell this data, use it for advertising, use it to train artificial intelligence models, or let a person read it, except with the User's explicit consent, for security purposes or to comply with the law.
• Revocation: the User can disconnect their calendar at any time under Settings then Integrations, or at myaccount.google.com/permissions; the token is then deleted.

Softcallia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes and legal bases of processing

Your data is processed for the following purposes:

5. B2B prospecting

Softcallia contacts businesses that are not yet customers, by email and by phone, to present its service. This section is for the professionals we contact this way. The controller for this processing is Softcallia, Côme Bruchet, sole trader, 24 rue David, 51100 Reims, France, as identified in section 1.

5.1. Who and what data

We contact trade and service businesses that Softcallia can help: plumbers, roofers, electricians, heating and air-conditioning (HVAC) contractors, landscapers and related trades, in France and in the United States, in particular in California. The data we use relates to the business and the people who represent it:

• trade name, legal name, trade, activity and size of the business;
• name and role of the owner or manager, when published;
• business email and phone number, website;
• business address;
• public information: French SIREN or SIRET number, contractor license number, RGE certification, reviews and ratings published online;
• a priority score we compute from this information, to decide which businesses to contact first;
• the history of our exchanges: contact dates, replies, notes and, where applicable, your objection.

5.2. Where the data comes from

We do not ask you for this data: it comes from information that businesses publish themselves or that appears in public registries.

• the business's own website;
• its public listings in directories and map services, such as Google Business Profile, which feeds Google Maps;
• in France, the INSEE Sirene business register and the ADEME list of RGE-certified professionals;
• in the United States, the contractor license registries kept by each state, such as the Contractors State License Board (CSLB) in California;
• professional directories.

On request, we will tell you the exact source of your contact details.

5.3. Purpose and legal basis

We use this data to present Softcallia to you: an AI receptionist with full management software for businesses in your trade, covering call answering day and night, urgent-call triage, appointment booking, scheduling and invoicing. We also use it to keep track of our exchanges.

This processing is based on our legitimate interest (Art. 6.1.f GDPR): making our service known to the businesses whose trade it serves. In France, the CNIL, the French data protection authority, allows email prospecting of professionals without prior consent, provided the message relates to the recipient's profession and the recipient can easily object in every message (Art. L.34-5 of the French Postal and Electronic Communications Code). Phone prospecting of professionals rests on the same basis and gives the same right to object.

5.4. Retention period

We keep this data for 3 years from collection or, if you replied to us, from our last exchange, as the CNIL recommends. It is then deleted. If you object to prospecting, the rule in section 5.6 applies.

5.5. Recipients and transfers

Your data is never sold, rented or passed on to third parties. Only Softcallia has access to it, with four sub-processors:

• Google, which provides our Google Workspace business email;
• Supabase, which hosts our prospect database;
• Vercel, which hosts the administration interface through which we view that database;
• Anthropic, whose AI assistant Claude we use to research the public sources listed in 5.2 and to prepare our messages.

These companies are based in the United States: transfers of data to the United States are governed by the European Commission's Standard Contractual Clauses and the measures described in section 8.

5.6. Your right to object

5.7. Your other rights

You also have the rights of access, rectification, erasure and restriction, and the right to lodge a complaint with the CNIL, as described in section 9.

6. Automated decisions and profiling

In accordance with Article 22 of the GDPR, we inform you that the Service uses automated processing involving artificial intelligence. This processing constitutes profiling within the meaning of Article 4(4) of the GDPR because it automatically analyzes the content of calls to infer information (urgency, type of issue, summary).

6.1. Automated processing carried out

6.2. Safeguards

• None of these automated decisions produces a legal effect or a similarly significant effect on the persons concerned within the meaning of Article 22.1 of the GDPR. These are decision-support tools: it is always the human User who decides on the final action (call back, ignore, confirm an appointment, etc.).
• Transcriptions and summaries are automatic interpretations that may contain errors. Unless the business has turned on the audio recording option, the call is not recorded and cannot be listened to again to verify a transcription: the transcription may be contested and corrected through human intervention (see below).
• You have the right to contest a classification, express your point of view and obtain human intervention by contacting dpo@softcallia.com.

7. Data retention periods

We retain your data only for as long as necessary for the purposes for which it was collected, in accordance with the storage limitation principle (Article 5.1.e of the GDPR):

Upon expiry of these periods, the data is permanently deleted or irreversibly anonymized for statistical purposes.

8. Sub-processors and international data transfers

To provide the Service, we use technical sub-processors (Articles 28 et seq. of the GDPR). These sub-processors act solely on our documented instructions and are contractually bound to protect your data in accordance with the GDPR. Data Processing Agreements (DPAs) have been concluded with each of them.

8.1. List of sub-processors

8.2. Transfers outside the European Economic Area (EEA)

Some of our sub-processors are located in the United States. Transfers of data to the United States are governed by the following mechanisms, in accordance with Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs) approved by the European Commission (implementing decision 2021/914 of 4 June 2021), incorporated into the DPA of each sub-processor;
• EU-US Data Privacy Framework (adequacy decision of 10 July 2023) for certified sub-processors (Stripe);
• Additional measures: encryption in transit (TLS 1.3) and at rest (AES-256), minimization of transferred data, regular risk assessment.

We never sell your data to third parties. Your data is shared only with the sub-processors listed above, strictly to the extent necessary to provide the Service.

9. Your rights

In accordance with Articles 15 to 22 of the GDPR and Articles 48 to 56 of the French Data Protection Act, you have the following rights over your personal data:

9.1. How to exercise your rights

• By email: dpo@softcallia.com, specifying your identity (first name, last name, account email) and the right you wish to exercise.
• Via your dashboard:the “GDPR” tab of the Settings page lets you export your data (portability) and request the deletion of your account (erasure).
• By post:Softcallia — Côme Bruchet — 24 rue David, 51100 Reims.

We will respond to your request within a maximum of 30 days from receipt. This period may be extended by two additional months in the event of complexity or a large number of requests, in which case you will be informed within the initial one-month period (Art. 12.3 GDPR).

9.2. Complaint to the CNIL

If you believe that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the French Data Protection Authority (CNIL), the competent supervisory authority in France:

• Website: www.cnil.fr
• Address: CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Phone: +33 1 53 73 22 22

10. Data security

In accordance with Article 32 of the GDPR, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk:

10.1. Technical measures

• Encryption in transit: TLS 1.3 for all communications between your browser, our servers and our sub-processors.
• Encryption at rest: AES-256 for the database (Supabase/AWS) and uploaded files.
• Data isolation: Row Level Security (RLS) on Supabase ensures that no company can access another's data (multi-tenant isolation at the database level).
• Access control: role-based access control (RBAC) with three levels (administrator, agent, viewer).
• Audio recordings (option): listening limited to the owner and admins of the customer business, from its application. Every playback is logged; none is served from a public address or cached.
• Rate limiting: protection against brute-force attacks via Upstash Redis (sliding window).
• Passwords: hashed with bcrypt (cost factor 10), individual salting. No password is stored in plain text.
• Authentication: JWT tokens with automatic rotation and secure refresh.
• HTTP security headers: Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
• Webhook validation: HMAC signature for Stripe, secret key for n8n.

10.2. Organizational measures

• Principle of least privilege: each component of the system has access only to the data strictly necessary for its function.
• Logging: sensitive access and operations are traced in an audit log (GDPR audit log).
• Monitoring: monitoring of errors and anomalies via Sentry, with automatic alerts.
• Breach notification: in the event of a data breach, the CNIL is notified within 72 hours and the persons concerned are informed as soon as possible in accordance with Articles 33 and 34 of the GDPR.

11. Transparency on the use of artificial intelligence

In accordance with Regulation (EU) 2024/1689 of 13 June 2024 on artificial intelligence (EU AI Act) and the CNIL's recommendations on the use of AI in the processing of personal data:

11.1. AI systems used

• Provider: OpenAI Inc. (GPT and Whisper models via API)
• Functions: voice transcription (speech-to-text), summary generation, urgency classification, categorization of issues, conversational voice responses to callers
• Risk classification (EU AI Act):limited risk — the system interacts directly with natural persons (callers) and generates synthetic content (voice)

11.2. Transparency obligations

• The caller is informed at the start of the call that they are interacting with an automated assistant using artificial intelligence (transparency obligation, Art. 50 EU AI Act).
• The AI is a decision-support tool, not an autonomous decision-making system. It is always the human User who decides on the action to take.
• No data transmitted via the OpenAI API is used to train or improve OpenAI's AI models(in accordance with OpenAI's API data policy — zero data retention for API customers).
• Transcriptions and summaries are automatic interpretations that may contain errors, omissions or inaccuracies. They do not constitute a guaranteed faithful reproduction.

12. Cookies and trackers

The Site and the Application use cookies and similar technologies. For detailed information about the cookies used, their purposes, retention periods and the ways to manage your preferences, please consult our dedicated Cookie Policy.

13. Data of minors

The Service is intended for professionals (B2B). It is not designed to be used by persons under the age of 18. We do not knowingly collect personal data of minors. If we find that data of minors has been collected inadvertently, we will delete it as soon as possible.

14. Changes to this policy

We may modify this policy at any time to reflect regulatory, case-law or technical developments. Any substantial change will be notified:

• by email to the address associated with your account;
• by a notification in the Application;
• by updating the date shown at the top of this page.

For changes affecting processing based on consent, your consent will be requested again.