1. Who we are
Calltura (“we”, “us”, “our”) is an AI voice receptionist service. For the purposes of UK GDPR, Calltura is the data processor acting on behalf of each client business (the data controller) that deploys our agent.
Contact: hello@calltura.com
2. What data we collect
- Call audio & transcripts — voice recordings and text transcripts of calls handled by the Calltura agent.
- Caller phone number — when callers ring via a Telnyx UK number; not collected for WebRTC browser demos.
- Booking details — name, phone number, and appointment time when a caller books via Cal.com during a call.
- Call metadata — duration, outcome (e.g. booked / transferred), timestamp, and LiveKit room name.
- Portal usage — admin portal login events and page visits (no tracking pixels or marketing cookies).
3. Legal basis (UK GDPR Article 6)
- Legitimate interests (Art. 6(1)(f)) — call handling, booking management, and call quality review on behalf of the client business.
- Contract performance (Art. 6(1)(b)) — to fulfil the service agreement between Calltura and each client business.
- Consent (Art. 6(1)(a)) — where the client business has obtained consent from callers before routing calls to the AI agent.
4. How we use data
- Answering inbound calls and routing/booking on behalf of the client business.
- Storing call transcripts and recordings in the client’s admin portal.
- Improving response quality via aggregated, anonymised analytics.
- Generating invoices based on minute usage.
We do not sell caller data, use it for advertising, or share it with third parties except as described in section 5.
5. Sub-processors
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database (call logs, transcripts, bookings) | EU (Frankfurt) |
| LiveKit Cloud | Real-time audio/video infrastructure | US (with EU option) |
| Google Cloud (Vertex AI) | Speech recognition & language model | US (us-central1) |
| Google Cloud Storage | Call recording storage | Configured per-client |
| Cal.com | Appointment booking | EU |
| Telnyx | UK telephony / SIP | UK / EU |
| Sentry | Error monitoring (no PII logged) | EU |
Transfers outside the UK are governed by UK Addendum to EU SCCs or adequacy decisions. Contact us for transfer impact assessments.
6. Retention
- Call transcripts & recordings — retained for 12 months by default. Client administrators can delete individual records at any time via the portal.
- Booking records — retained until the client requests deletion or the service is terminated.
- Portal access logs — retained for 90 days.
7. Your rights
Under UK GDPR, callers whose data is processed by Calltura on behalf of a client business may exercise the following rights against the data controller (the client business):
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to object (Art. 21)
- Right to data portability (Art. 20)
To exercise these rights, contact the business whose phone number you called. To escalate unresolved concerns, contact the ICO at ico.org.uk.
8. Security
All data in transit is encrypted (TLS 1.2+). Data at rest is encrypted by Supabase (AES-256). Access to the admin portal is restricted to authenticated users via password-gated sessions. We conduct access reviews quarterly.
9. Changes to this policy
We will post material changes at least 30 days before they take effect. Continued use of the service constitutes acceptance.
10. Contact
Data protection enquiries: hello@calltura.com