Privacy Policy

For our customers’ data (account, billing, dashboard usage), Tinos is the data controller.

For data collected during calls received on a customer’s number (recordings, transcriptions, caller contact details), the customer is the data controller and Tinos acts as a data processor, in accordance with Article 28 of the GDPR. Tinos processes this data only on the customer’s instructions and to provide the Service to them.

Tinos can be contacted via our contact page.

2.1. Customer data provided directly

• Registration data: email address, authentication account
• Profile data: name of the organization, business sector, configured number(s)
• Assistant configuration: script, qualification rules, time slots, routing rules
• Payment data: handled by Stripe (we do not store your banking details)
• Communications: support requests, messages via the contact form, demo bookings (name, email, phone, company, website)

2.2. Data collected automatically

• Dashboard usage data: pages visited, features used
• Technical data: IP address, browser type, operating system
• Service usage data: number of calls, duration, minutes consumed

2.3. Data collected during calls

When a call is handled by the voice assistant, the Service may process, on behalf of the customer:

• The audio recording of the call and its text transcription
• The caller’s number and the contact details they provide (name, phone, email, address)
• The subject of the request, its urgency, the appointment time slot and the call summary

Depending on the customer’s sector and the content of the conversation, this data may contain sensitive information within the meaning of the GDPR. The customer is responsible for the lawfulness of the collection under the GDPR. Two notices are, however, provided by Tinos at the start of every conversation: the assistant announces that it is an artificial intelligence, and it informs the caller that the call is recorded, indicating that they may object. If they object, the audio recording of the call is deleted.

3.1. Provision of the service

• Create and manage your account and your assistant configuration
• Receive, qualify and route calls, book appointments
• Notify you by email and provide transcriptions and summaries
• Display your appointments, including the caller’s name and phone number, in the calendar application of your choice through your subscription link (if you use this link)
• Manage your subscription and payments, provide support

3.2. Improvement of the service

• Analyze the usage and quality of the Service in an aggregated manner
• Fix errors and improve the quality of the voice assistants

Call content is not used to train third-party AI models for those providers’ own purposes.

3.3. Security and compliance

• Detect and prevent fraud and abuse
• Comply with our legal obligations and retain proof of an appointment

3.4. Advertising

No advertising on Tinos. Your data is never sold to third parties.

• Contract: to perform our Terms of Use and provide the Service
• Consent: for processing that requires your explicit agreement
• Legitimate interest: to improve the Service and ensure security
• Legal obligation: to comply with applicable legislation

For callers’ data, the legal basis lies with the customer, who is the data controller and must ensure that individuals are informed and, where applicable, that their consent is obtained.

Your data is never sold. It may be shared with:

5.1. Technical subprocessors

• Supabase (hosting, database and transcriptions, European Union region)
• Twilio (telephony and SMS)
• LiveKit (real-time voice transport, call rooms)
• Deepgram (speech recognition / transcription)
• OpenAI (the assistant’s language model)
• Stripe (payment processing)
• Vercel (dashboard hosting)
• Railway (voice assistant hosting)
• Resend (email delivery)
• Cartesia (voice synthesis)
• Cloudflare (Turnstile, invisible anti-bot check on the email sign-in form; processing described in the Turnstile Privacy Addendum)
• Cal.com (calendar and booking of demos)
• Google (calendar and Google Meet video calls for demos)

5.2. Transfers outside the European Union

During a call, the voice is processed in real time by specialized providers, some of which are located outside the EU. Some of our subprocessors may therefore process data on servers located outside the European Union (notably in the United States). These transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection. Our database, which holds your accounts, contacts, appointments and call transcripts, is hosted in the European Union, in Frankfurt (Germany).

5.3. Authorities and legitimate third parties

• Law enforcement upon legal request
• Courts in the context of legal proceedings

5.4. Change of subprocessors

Tinos reserves the right to add, replace or remove a subprocessor at any time for technical, economic or security reasons. Any material change will be notified by email or via the dashboard with reasonable advance notice, allowing customers who object to it to terminate at no cost before the change takes effect.

• Account data: until the account is deleted + 3 years for legal obligations
• Payment data: 10 years in accordance with accounting obligations
• Call audio recordings: 30 days for all accounts (stored in our own storage, European Union region), then automatic deletion. Transcripts and summaries: kept for 1 year, then deleted or anonymized; calls with no useful content (cold calls, calls with no interaction) are deleted as soon as the call ends
• Aggregated usage data: 2 years maximum
• Technical logs: 13 months maximum
• Support data: 3 years after resolution

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: delete your data under certain conditions
• Right to restriction: restrict the processing of your data
• Right to portability: retrieve your data in a structured format
• Right to object: object to processing on legitimate grounds
• Right to withdraw consent: withdraw your consent at any time

To exercise these rights, contact us via our contact page. If your request concerns a call received by one of our customers, it will, where applicable, be forwarded to the customer acting as data controller.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr), the French supervisory authority.

We implement appropriate technical and organizational measures:

• Encryption: data encrypted in transit (TLS) and at rest
• Access control: strong authentication, principle of least privilege
• Passwords: hashed and salted, never stored in plain text
• Payments: handled entirely by Stripe (PCI DSS certified)
• Transcriptions hosted in the European Union region

The Tinos dashboard may use cookies that are strictly necessary for the operation of the Service (session, authentication). No advertising or tracking cookie is placed without your consent.

When you delete your account:

• Your personal data is deleted from our servers
• The associated recordings and transcriptions are deleted or anonymized
• The voice assistant stops handling your calls
• Certain accounting data may be retained in accordance with legal obligations

Because Tinos acts as a processor for callers' data, a Data Processing Agreement (DPA) sets out the terms of the processing, the sub-processors and the security measures. It forms part of the Terms of Use and can be read on our Data Processing Agreement page.

For any question about this Policy or to exercise your rights: our contact page.