Privacy policy

We are the data controller for the data of visitors to our website and of the people who use the Diallo dashboard.

When a business (our customer) uses Diallo to answer its calls, that business decides why and how its callers’ data is processed and is the controller of that data. We process it on the business’s behalf, as a processor, under our agreement with it and only on its instructions. If you called a business that uses Diallo, contact that business first about your data; we will help it respond.

From visitors to our website:

• what you enter in the contact form: your name, phone number or Telegram, type of business and language;
• if you try a demo call: your voice and the conversation with the demo agent, as for any call (see below);
• technical data needed to serve the site: IP address, browser type, the pages requested and the time, in server logs.

From users of the dashboard:

• account data: name, email address, language and workspace;
• a password, stored only as a secure hash, never in readable form;
• session and security data: sign-in times, IP address and failed sign-in attempts;
• billing details the business provides for invoices.

From people who call a business that uses Diallo (processed on the business’s behalf):

• the audio recording of the call and its written transcript;
• for a phone call, the number you call from;
• the details the agent is set up to ask for, such as your name, the service you need or a preferred time;
• appointments made during the call, and a short summary and mood of the call produced automatically after it;
• technical call data: date, duration, language and how the call ended.

We do not ask for, and ask our customers not to have the agent collect, special categories of data (such as health, beliefs or biometric data used for identification) unless the business has a lawful basis for it and has told its callers.

• To answer and handle calls for our customers, and to give them the transcripts, requests and appointments that result — to perform our contract with the business, on its instructions.
• To create and run your account, sign you in and keep it secure — to perform our contract with you and for our legitimate interest in protecting the service.
• To reply to a request you send through the website — to take the steps you asked for before a contract, or with your consent.
• To keep the service working, find and fix faults, prevent abuse and measure call quality — our legitimate interest.
• To issue invoices and meet accounting and tax obligations — a legal obligation.

We do not sell personal data and do not use it for advertising. We do not use the contents of our customers’ calls to train AI models.

The summary, mood and captured details of a call are produced automatically by an AI model to help the business follow up. They do not produce decisions with legal or similarly significant effects on callers; the business decides what to do with a request.

Calls answered by Diallo are handled by an AI voice agent, not a person, and every call is recorded and transcribed. Our customers are responsible for telling their callers this at the start of the call — we put this notice in the agent’s greeting when we set it up — and for having a lawful basis to record. If you do not want to talk to an AI agent or be recorded, you can end the call and contact the business another way. More in our AI and call recording notice.

Only as needed to provide the service, with providers bound by contract to protect the data and use it only on our instructions. The current list (also on the Sub-processors page):

Card payments are made on the payment page of Flitt; the acquiring bank, TBC Bank, receives the payment details as an independent controller under its own rules. Phone calls reach the agent through the business’s own telecom operator. Tools a business connects itself — for example its CRM, Google Calendar or Telegram — receive the data the business chooses to send them, under that business’s responsibility.

We may also disclose data where the law requires it, for example at the lawful request of a court or public authority, or to protect our rights. If our business is reorganised or sold, data may pass to the successor under this policy.

Our servers are in the European Union. Some providers listed above process data in other countries, including the United States. We transfer data abroad only where the destination ensures an adequate level of protection or where appropriate safeguards are in place, such as standard contractual clauses, as required by the Law of Georgia “On Personal Data Protection” and, where it applies, the GDPR.

• Call recordings — 90 days, then deleted automatically.
• Transcripts, summaries, requests and appointments — for as long as the business keeps its account, or until the business deletes them.
• Account data — while the account exists; deleted within 30 days after the account is closed, except what we must keep by law.
• Website contact requests — up to 12 months, unless they lead to a contract.
• Invoices and accounting records — for the period required by Georgian tax law.
• Backup copies of the database, made before updates of the service — up to 30 days.
• Server logs — up to 90 days.

The full schedule is on the Data retention page.

Connections are encrypted (HTTPS/TLS). Passwords are stored only as hashes. Each business sees only its own workspace, administrative access to the servers is limited to Individual Entrepreneur Aleksandra Ilina, and the servers are protected against unauthorised access. No system is perfectly secure; if a breach affects your data, we will notify the Personal Data Protection Service of Georgia and, where required, you. More in our Security overview.

Under the Law of Georgia “On Personal Data Protection” (and the GDPR where it applies), you have the right to:

• know whether we process your data and get a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted or its processing restricted;
• receive your data in a structured, machine-readable form and have it passed to another controller;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, where processing is based on consent;
• not be subject to a decision based solely on automated processing that significantly affects you.

To use these rights, write to envmotion@gmail.com. We may need to confirm your identity. We reply within 10 working days; where the law allows, this can be extended once, and we will tell you why. If your data was collected during a call to one of our customers, we will pass your request to that business and help it respond. The procedure is described on the Data requests and complaints page.

You can also complain to the Personal Data Protection Service of Georgia (personaldata.ge) or, in the EU, to your local supervisory authority.

Necessary: a session cookie that keeps you signed in to the dashboard, and your language and cookie choices, saved in your browser. They are needed for the service to work and don’t require consent. We do not use advertising cookies.

Analytics, only with your consent. If you click “Accept” in the cookie banner, the website uses Google Analytics 4 to show us how it is used. Until you do, Google Analytics is not loaded at all, and it never runs in the dashboard or on the sign-in pages. It collects:

• the pages you open, the page you came from, the time spent on the site and clicks on key buttons (the demo call, sending the contact form, switching language, the prices and contact links);
• your device, browser, operating system and screen size, and your approximate location (country and city) derived from the IP address; Google Analytics does not store full IP addresses;
• a random identifier in the _ga cookies, so that repeat visits can be counted; the cookies expire after at most 2 years.

We never send Google Analytics your name, phone number or what you type in forms. Google signals and ad personalisation are switched off, and the data is not used for advertising. Google may process it in the USA (see section 6). Google Analytics data is kept for 14 months and then deleted automatically.

You can withdraw consent at any time: click “Cookie settings” at the bottom of any page and choose “Decline”. Google Analytics then stops and its cookies are deleted from your browser. Withdrawal does not affect processing before it. Every cookie and browser record we use is listed in our Cookie policy.

Diallo is a service for businesses and is not directed at children. We do not knowingly collect data of children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the service or the law changes. The date at the top shows the latest version. We will tell dashboard users about significant changes by email or in the dashboard before they take effect.

• Individual Entrepreneur Aleksandra Ilina, identification code 345855906
• Email: envmotion@gmail.com
• Person responsible for personal data protection: Aleksandra Ilina, envmotion@gmail.com