Privacy Policy

Draft for legal review. This policy has not been reviewed by a lawyer and is not in force. Georgian data protection law changed in 2024 and the regulator changed in 2026, so counsel must confirm every legal reference before publication.

1. Who we are

iCall is an AI phone assistant service from KCall LLC (Georgian company ID 404509983), registered at [registered address · to be confirmed]. KCall has run a call center since 2016.

This policy explains how we handle personal data in two roles:

• As controller for the data of visitors to our website, people who try the demo, our customers' account users and billing contacts, and security and abuse-prevention data. We decide why and how that data is used.
• As processor for the data of callers and contacts that our business customers bring to iCall. The business that uses iCall decides why and how that data is used and is the controller. We process it on its instructions under a Data Processing Agreement.

If you spoke to an iCall assistant for a business, that business is the one responsible for your data. Contact it first. We will help it answer you.

Privacy contact: [name and email of the privacy contact or DPO · to be confirmed]. Mail address: [registered address · to be confirmed].

2. What data we handle and why

• Data

  Website and contact requests

  Examples

  name, business name, email or phone, your message, technical request data

  Why

  answer your request, offer a price, keep the site secure

  Legal basis

  your request and our legitimate interest [confirm legal bases with counsel · to be confirmed]

• Data

  Demo (planned: today's website demo is a simulation that collects none of this)

  Examples

  microphone audio, transcript, an anonymous demo identifier, a risk signal built from your IP address, the phone number you verify

  Why

  run the demo, keep its limit, prevent abuse, send the verification code

  Legal basis

  your request to use the demo, and our legitimate interest in preventing abuse

• Data

  Account

  Examples

  name, work email or phone, role, sign-in and security data, audit log

  Why

  provide the workspace and keep it secure

  Legal basis

  contract with our customer and legitimate interest

• Data

  Billing

  Examples

  company details, invoice and payment status. Card details are entered with the payment provider and are not stored by iCall

  Why

  invoice and collect payment, meet accounting duties

  Legal basis

  contract and legal duty

• Data

  Support

  Examples

  your messages and our replies

  Why

  solve problems

  Legal basis

  contract and legitimate interest

• Data

  Calls (as processor)

  Examples

  the caller's voice, transcript, phone number, call time and duration, summary, results of actions the assistant took

  Why

  run the assistant for our customer

  Legal basis

  our customer decides, see the DPA

We do not intentionally collect special categories of personal data (health, biometric, political and similar). A caller may say such things on a call. We handle them only as the customer's processor, and we do not build voiceprints or identify callers by their voice.

3. Who we share data with

We share data only with:

• our subprocessors, which run parts of the service. The current list, with their locations, is in the DPA. At the moment it includes Google (AI model), Supabase (database and storage), Vercel (hosting), Hetzner (voice host), Flitt (payments), gosms.ge (SMS), and, when a customer switches them on, Google Workspace, Telegram, Viber and WhatsApp
• the business customer whose assistant you called
• KCall operators, when a customer chooses to hand calls to them
• authorities, courts and advisers when the law requires or to protect legal rights [approve the law enforcement request policy · to be confirmed]

We do not sell personal data and we do not share it for advertising.

4. Where data is processed

Our database and files are in the European Union (Frankfurt, Germany), and our voice host is in Helsinki, Finland. Some providers, such as Google, Vercel and the messengers, may process data outside the European Union or Georgia. Where that happens we rely on the safeguards the law allows, such as an adequacy decision of the competent authority or contract terms [choose the transfer mechanism for each non-EU provider and confirm with counsel · to be confirmed]. The DPA lists the locations.

5. How long we keep data

The data retention schedule gives the periods. In short, the proposed defaults are 60 days for call audio, 180 days for transcripts and 30 days for technical logs, with other periods for invoices and account data. A business customer may shorten the periods for its calls.

6. Your rights

Under the Georgian Law on Personal Data Protection, and the GDPR where it applies to you, you may ask for:

• access to your data and a copy of it
• correction of wrong data
• deletion, blocking or restriction of processing
• transfer of data you gave us, where the law gives you that right
• withdrawal of consent you gave, at any time, as easily as you gave it
• an end to direct marketing
• a person to review an automated decision that has legal or similarly significant effects. iCall does not make such decisions on its own

We respond within the time the law sets. Under Georgian law this is generally 10 working days, which can be extended by up to 10 more working days in special cases, and we will tell you if so. Write to the privacy contact above. If we need to confirm who you are, we will ask. If your request concerns a call with a business, we pass it to the business and tell you.

You may complain to the supervisory authority. In Georgia this is the State Audit Office, which took over the tasks of the Personal Data Protection Service in March 2026 [confirm the complaint contact details of the State Audit Office before publication · to be confirmed]. You may also go to court.

7. Calls with an AI assistant

Every call with an iCall assistant should begin by telling you that you are speaking with an AI assistant, and whether the call may be recorded or written down. You can ask for a person where the business has set that up. Details, and the wording that businesses use, are in the Call recording and AI disclosure policy.

8. Automated processing

The assistant understands and answers speech automatically. It does not decide on your rights, credit, jobs, insurance or similar matters on its own. If a business uses it for something more serious, that business must add human review, as the AUP requires.

9. Security

We protect data with technical and organisational measures that match the risk. See the security overview. We follow the incident notification commitment if something goes wrong.

10. Children

iCall is a service for businesses and is not aimed at children. Under Georgian law, a child under 16 needs a parent or guardian to consent where consent is the basis. If a business uses iCall to speak with children, it must have the lawful basis and parental consent that the law requires. If you think a child's data was given to us without that, tell us and we will delete it.

11. Marketing messages

We send marketing messages only with your consent, which you can withdraw at any time using the link or reply instructions in the message. Entering a phone number for a verification code does not give consent to marketing and does not start a sales call.

12. Cookies

We use only the cookies and storage the site needs to work. See the cookie notice.

13. Changes

We will update this policy when our practices change and show the date at the top. For material changes affecting our business customers, we will notify them as the terms of service describe.

14. Contact

Questions, requests and complaints: [privacy contact email · to be confirmed]. Postal address: [registered address · to be confirmed].