Privacy Policy · Dialgem

01Who we are

Dialgem is a voice AI platform owned and operated by Achroweb Solutions (“we”, “us”), registered in [JURISDICTION OF REGISTRATION], with its registered office at [REGISTERED ADDRESS].

This policy explains how we handle personal data on our website (dialgem.com), in the Dialgem console and API, and when a call runs through the platform. Questions go to privacy@dialgem.com.

Two roles, one important distinction. For information about our own customers (account details, billing, support), we are the controller. For the content of calls our customers run on the platform — audio, transcripts, and what the people on those calls say — the customer is the controller and we are their processor, acting on their instructions under our Data Processing Addendum. If you spoke to an AI agent and want to exercise rights over that call, see If you were on a call.

02What we collect

Account and organisation data

Name, email address, organisation name, role and membership, a hashed password or the identifier from a social sign-in provider, API key hashes (the key itself is shown once and never stored in readable form), and invitation records.

Billing data

Prepaid credit balance, a ledger of top-ups and usage, invoices, and the billing details you give our payment processor. We do not store full card numbers; they are handled by Stripe.

Configuration you create

Agents, prompts, flows, voices, functions, webhook URLs, phone numbers, SIP trunk settings (credentials are encrypted before storage), and campaign and contact lists you upload.

Call data (customer content)

Depending on the settings each customer chooses per agent: call audio recordings, transcripts, call metadata (numbers, times, duration, disconnection reason), tool and function results, and analysis produced after the call. This may include personal data of the people on the call, and anything they choose to say.

Usage and technical data

Request logs, IP address, browser and device type, request identifiers, error and performance metrics, and the actions taken in the console, kept to run, secure and debug the service.

Website and email enquiries

If you email us we receive what you send (typically your name, email address and the content of your message) and use it to reply. Our marketing site sets no advertising or analytics cookies — see Cookies.

03Why we use it, and our legal basis

Purpose	Data	Basis (UK/EU GDPR)
Provide the platform: authenticate you, run agents, place and receive calls, store recordings and transcripts as configured	Account, configuration, call data	Performance of a contract; for call content, on the customer’s instructions as processor
Take payment, issue invoices, prevent billing fraud	Billing, account	Contract; legal obligation (tax records)
Secure the service, detect abuse, enforce our Acceptable Use Policy	Usage and technical, account, call metadata	Legitimate interests (keeping the service safe)
Support and communicate with you, including service notices	Account, enquiry content	Contract; legitimate interests
Improve reliability and performance	Aggregated usage and technical data	Legitimate interests
Comply with law and respond to lawful requests	As required	Legal obligation
Marketing emails about the product, if you are a business contact	Name, work email	Legitimate interests, or consent where required; you can opt out at any time

We do not sell personal data, and we do not use customer call content to train our own or third-party AI models.

04If you were on a call

If you spoke to an AI agent that runs on Dialgem, the business that deployed it decided to make that call, what the agent would say, and whether the call is recorded or transcribed. That business is the controller of your call data and is who you should contact first — its details should be in its own privacy notice or at the start of the call.

We can only act on that business’s instructions, but we will pass on and help with any request you send us. Write to privacy@dialgem.com with the phone number you called from or to and the approximate time, and we will route it to the right customer or, where we can identify it, act on their behalf.

Recording is a setting the customer controls per agent. When it is off, the recording tap is never attached. Customers can also turn off transcript storage, redact personal data from transcripts, and set a retention period.

05Who we share it with

A real-time voice call cannot be run by one party alone. To provide the service we use a small set of vendors (“subprocessors”) for speech recognition, language models, speech synthesis, telephony, payments, email and storage. The current list, with what each receives, is on the Subprocessors page, and customers can choose some of them per agent.

We also disclose personal data:

to the customer whose account or call it relates to;
to professional advisers, auditors and insurers under confidentiality;
where required by law, court order or a valid request from a public authority, or to protect the rights, safety or property of Achroweb Solutions, our customers or others;
to a buyer or successor in a merger, acquisition or sale of assets, on terms that keep this policy’s protections in place.

A customer who points an agent at its own provider account (for example its own transcription or voice vendor) is sending that call data under its own contract with that vendor.

06International transfers

Our subprocessors operate in several countries, including the United States, so personal data may be processed outside the country where you are. Where we transfer personal data from the UK or EEA to a country without an adequacy decision we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an equivalent safeguard, as set out in our Data Processing Addendum.

07How long we keep it

Data	Kept for
Call recordings, transcripts and call analysis	Whatever the customer sets per agent or for the organisation. Expired data is removed by an automatic background sweep. If no period is set, until the customer deletes it or closes the account.
Account and configuration data	For the life of the account, then deleted or anonymised within 90 days of closure, except as below.
Billing ledger and invoices	As long as tax and accounting law requires (commonly six to seven years).
Server and request logs	Up to 90 days, longer only where needed to investigate abuse or an incident.
Email enquiries	Up to 24 months after our last contact, unless you become a customer.
Backups	Overwritten on a rolling cycle, so deleted data can persist in backups for a further limited period before it is purged.

08How we protect it

Every customer is an organisation whose data is scoped to it in the database layer and checked on every request. API keys and passwords are stored hashed, SIP trunk credentials are encrypted before they reach the database, the console never holds a platform secret, and data in transit is encrypted with TLS.

No system is perfectly secure, and we do not currently hold third-party security certifications such as SOC 2 or ISO 27001. If we become aware of a breach affecting personal data we will notify affected customers without undue delay and, where the law requires, the relevant regulator. To report a vulnerability, write to security@dialgem.com.

09Your rights

Depending on where you live (including under the UK and EU GDPR, and the laws of several US states and other countries) you may have the right to:

know whether we hold personal data about you, and get a copy;
correct inaccurate data;
delete your data, subject to legal retention duties;
restrict or object to certain processing, including direct marketing;
receive your data in a portable format;
withdraw consent where we rely on it, without affecting earlier processing;
not be discriminated against for exercising these rights.

Email privacy@dialgem.com. We may need to verify your identity, and will answer within one month (or the period your law sets). You can also complain to your local data protection authority. For call data we hold as a processor, we will refer your request to the customer concerned.

10Children

Dialgemis a business service and is not directed to anyone under 18. We do not knowingly collect personal data from children. Customers must not deploy agents that knowingly collect data from children without the consents the law requires. If you believe a child’s data has reached us, tell us and we will delete it.

11Changes and contact

We will update this policy as the product and the law change. The date at the top shows the latest revision; for material changes we will notify account owners by email or in the console before they take effect.

Achroweb Solutions, [REGISTERED ADDRESS]. privacy@dialgem.com