Records of Processing (Art. 30)

Controller / Processor

[AiFortis LTD] acts as PROCESSOR for client call data and as CONTROLLER for account data. Contact: [dpo@aifortis.example].

Categories of data subjects

• Client account users.
• End customers contacted via the platform (call recipients / callers).

Categories of personal data

• Account: name, email, role, authentication logs.
• Contact: phone number, name, custom variables provided by the client.
• Call: recordings, transcripts, analysis, timestamps, outcome, cost.

Purposes

Provide and secure the voice-campaign service on the client's documented instructions.

Recipients / sub-processors

See the Sub-processors page (Vapi, Supabase, Upstash, Vercel, telephony, email).

International transfers

Where a sub-processor is outside the EEA, EU Standard Contractual Clauses + a Transfer Impact Assessment apply.

Retention

Call data: per the client's configured retention (default 365 days), then deleted / anonymised. Account data: for the life of the account + legal minimums.

Security measures

Encryption of secrets, access control, tenant isolation, audit logging, recording-consent controls — see the Security page.