Privacy Policy

1. Who we are

• Agenton Oy, Business ID 3490327-5
• Helsinki, Finland
• Contact: [email protected]

This policy covers the Agenton AI voice platform and this website (the "Service"). For our website and our own account holders, Agenton is the data controller. When we run the Service for a business customer, that customer is the controller of the data in their calls and account, and Agenton is their processor, acting only on their documented instructions under a Data Processing Agreement.

2. Data we process

What we process depends on how the Service is used:

• Account and dashboard data: name, email, and profile of users at our business customers
• Call audio and transcripts: recordings of handled calls and their transcriptions
• Details shared on calls: names, phone numbers, emails, and booking, vehicle, or service information given verbally
• Call metadata: caller ID, duration, and timestamps
• Website and usage data: technical data and cookies when you visit our site (Section 9)

We use this data only to run and support the Service. We do not sell personal data, and we do not use it for advertising.

3. No AI training on your data

• We do not use your personal data, recordings, transcripts, prompts, or outputs to train or fine-tune AI models, or to build products for others, without written consent. Anonymised or aggregated data is treated the same way.
• We still process data as needed to run the Service, such as reviewing calls, tuning prompts, checking accuracy, and comparing AI model performance.
• Our AI providers, including Microsoft Azure OpenAI, do not use this data to train their own models.

4. Legal basis for processing

Where Agenton is the controller, we rely on:

• Contract: to provide the services you request
• Legitimate interest: to secure, maintain, and improve the Service and prevent fraud
• Consent: for optional cookies, analytics, and marketing

Where a business customer is the controller, that customer is responsible for the legal basis and for any caller notice or consent, including for call recording.

5. Sub-processors

• We use a limited set of vetted sub-processors, each under a written data-protection agreement. They cover telephony, speech-to-text, AI model inference, hosting and storage, and notification emails.
• Production services run in the EU/EEA (Ireland, Germany, Belgium, Sweden, and the Netherlands).
• Some providers have parent companies outside the EEA. Those transfers are covered by EU Standard Contractual Clauses, the Microsoft EU Data Boundary, or an adequacy decision.
• Business customers can request the current sub-processor list and transfer safeguards from their work email at [email protected].

6. International transfers

• Personal data is stored and processed in the EU/EEA.
• Where support access or a sub-processor operates from outside the EEA, EU Standard Contractual Clauses, the Microsoft EU Data Boundary, or an adequacy decision apply.
• On request, we disclose the applicable transfer mechanisms.

7. Data retention

We keep personal data only as long as needed to run the Service or meet legal requirements. Typical call-data retention:

On termination, we delete or return data at the customer's choice and purge backups within 30 days. Account data for our own account holders is deleted on account closure.

8. Data security

• Encryption in transit: TLS across telephony, runtime, model, and storage connections
• Encryption at rest: enabled by default across our storage providers
• EU/EEA residency: production services pinned to EU/EEA regions
• Access control: least-privilege access with multi-factor authentication on production-critical systems
• Logging and backups: system telemetry and automated backups, within the retention periods above
• Breach response: we notify affected controllers without undue delay

9. Cookies

• Strictly necessary cookies keep the site working.
• Optional analytics cookies run only with your consent through our cookie banner.
• You can accept or decline optional cookies at any time. Declining does not affect site access.

10. Your rights

• You can access, correct, erase, restrict, or port your data, and object to processing or withdraw consent.
• For data where Agenton is the controller, contact [email protected].
• If your data came from a business customer's use of the Service, for example a call to a dealership, that customer is the controller. We forward any request to them and help them respond.

11. Changes to this policy

We may update this policy. Material changes are shared by email or in the Service, and the "Last updated" date above changes accordingly.

12. Contact

Questions or requests: [email protected]