This Privacy Policy explains how RingLily collects, uses and protects personal data when businesses use our AI phone receptionist service, when you visit our website, and when people call a business that uses RingLily.
Who we are
RingLily is operated by [Company legal name], [registered address], [company registration number and tax ID] (“RingLily”, “we”, “us”).
Our customers are businesses (“customers”) that use RingLily to answer their phone calls with an AI agent. People who call those businesses are called “callers” in this policy.
Our role: controller and processor
For our customers' account data and for visitors to our website, we are the data controller.
For call data (call audio, transcripts, summaries, messages, appointments and callers' phone numbers), the customer whose number was called is the controller, and we act as a processor on the customer's behalf under a data processing agreement in line with Article 28 of the GDPR, which customers can request at [contact email].
If you called a business that uses RingLily and have a question about your data, please contact that business first. We will help it respond to your request.
Data we collect
Depending on how you interact with RingLily, we process the following categories of personal data:
- Account data – the name, email address, business name, country, interface language and hashed password of people who sign up and use the dashboard, and the business information customers enter to configure their agents.
- Call audio – the audio of each call is processed in real time by Twilio to recognise speech and to generate the agent's voice. We do not store audio recordings of calls.
- Transcripts and summaries – the text of each call, an AI-generated summary, the caller's intent and the outcome of the call, plus any messages taken or appointments booked during the call.
- Caller phone numbers – the number a caller is calling from, the number they called, the time and length of the call, and any details callers share, such as their name or reason for calling.
- Usage and technical data – call minutes used, billing history, IP addresses, log files and the session cookie that keeps you signed in.
Why we use personal data
We use personal data only for these purposes and on these legal bases:
- Providing the service – answering calls, producing transcripts and summaries, booking appointments and showing call data in the dashboard (performance of a contract, Art. 6(1)(b) GDPR, and, for call data, the customer's instructions).
- Billing and accounting – managing subscriptions, invoices and taxes (performance of a contract and legal obligations, Art. 6(1)(b) and (c) GDPR).
- Service communication – sending account emails, call alerts and important notices about the service (performance of a contract).
- Security and abuse prevention – protecting accounts, preventing fraud and misuse, and keeping the service reliable (legitimate interests, Art. 6(1)(f) GDPR).
- Legal obligations – complying with applicable laws and responding to lawful requests from authorities (Art. 6(1)(c) GDPR).
Service providers (processors)
We use the following service providers to run RingLily. Each processes personal data only on our instructions and under a data processing agreement:
- Twilio – telephony (phone numbers and call routing), real-time speech recognition and voice synthesis. Twilio may use its own subprocessors for speech recognition and voice synthesis.
- Anthropic – the AI model that understands callers, generates the agent's replies and writes call summaries, based on the call transcript and the business information the customer provides.
- Stripe – payment processing and subscription management. We do not store full card numbers.
- Email provider – our email delivery provider, to send account emails and call alerts.
- Hosting and database – our cloud hosting and database providers, to run the application and store data.
Drafting note: Name your email, hosting and database providers and the region where data is stored, and list Twilio's speech and voice subprocessors.
An up-to-date list of subprocessors is available on request at [contact email].
International data transfers
Some of our providers, including Twilio, Anthropic and Stripe, are based in the United States. When personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework to protect it.
How long we keep data
Call transcripts, summaries and related call details are deleted automatically after the retention period each customer sets in their account settings. The default is 90 days, and customers can choose between 7 and 3650 days.
Customers can delete individual calls at any time, and deleting an account deletes all of its data, including agents, calls, messages and appointments.
We keep account and billing records while the account is active and afterwards only as long as the law requires, for example for tax and accounting purposes.
Drafting note: State how long invoices and accounting records are kept under the tax laws that apply to you.
AI disclosure to callers
Callers are always told that they are speaking with an AI assistant and that the call is transcribed. Every agent's default greeting includes this disclosure, in line with Article 50 of the EU AI Act and similar rules in US states.
Customers can edit their agent's greeting but must keep this disclosure, and are responsible for any additional notice or consent required where their callers are located. The dashboard warns customers when a greeting does not mention the AI.
Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted (the “right to be forgotten”);
- restrict how we process your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO), or the authority in your country of residence.
If you are a caller, the business you called is the controller of your call data. Send your request to that business, and we will help it respond.
If you live in the United States, Canada or Australia, you may have similar rights under your local privacy laws. To exercise any of these rights, contact us at [contact email]. We will respond within the time limits required by law.
Security
We protect personal data with measures appropriate to the risk, including encryption in transit, hashed passwords, strict separation of each customer's data, access controls and signature checks on telephony webhooks.
Drafting note: Describe additional measures, such as encryption at rest and backups.
Children
RingLily is a service for businesses and is not directed at children. We do not knowingly collect personal data from children under 16 through our website or dashboard.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version on this page and, if the changes are significant, notify customers by email before they take effect.
Contact
Questions about this policy or your personal data? Contact us:
- Company – [Company legal name]
- Address – [registered address]
- Email – [contact email]
Drafting note: If you have appointed a data protection officer, add their name and contact details here.
See also: Terms of Service