Privacy & Cookie Policy

§1Who is responsible for your data

The controller of personal data - the party that decides why and how the data is processed - is:

For any question about your privacy, just write to the address above - we reply as quickly as we can.

§2What we collect and where it comes from

We only handle the information needed to run the chat and callback service. In practice this is:

• the phone number you leave in the call-request window - without it we could not call you back;
• the time and date of your request and the callback slot you choose;
• the address of the page the request came from, plus basic technical details of your browser (IP address, device type), used for security and troubleshooting;
• the course of the call to the extent required to connect and account for it (duration, call status), and - if the business turned recording on - the call recording;
• chat messages on the business's website - what you write, the replies from an agent or the AI assistant, and any details you share in the chat (e.g. name, email, number);
• Messenger and Instagram messages - when you write to a business that connected its Facebook Page or Instagram account to CallsYou: the message content, the conversation ID assigned by Meta and your name (or account name) from your profile.

If you have a CallsYou panel account (as a business or an agent), we also process: email, name, sign-in data (including from your Google account if you sign in with Google), company and invoice details and payment history. We never see card details - Stripe handles them.

We do not ask for data we do not need, and we do not build marketing profiles from your number.

§3Why we process it and on what basis

Every processing activity has a clear purpose and a legal ground under the GDPR (Regulation 2016/679):

• Calling you back and handling your request - based on the consent you give by requesting a call and on steps taken at your request (Article 6(1)(a) and (b) GDPR);
• Keeping the service reliable and secure (logs, abuse prevention) - carried out under the controller's legitimate interest (Article 6(1)(f) GDPR);
• Billing and accounting duties of the businesses that use the tool - where required by law (Article 6(1)(c) GDPR).

Providing your phone number is voluntary, but without it you cannot request a callback - it is the only piece of information that is truly essential.

§4How long we keep it

Data tied to a single request is kept only as long as the purpose we collected it for requires. We delete or anonymise the call history and number once they are no longer needed to handle the contact, and at the latest after the periods set by law (for example, limitation of claims or tax obligations). You may withdraw your consent at any time - after that, we no longer process the data for the purpose the consent covered.

§5Who we share data with

To connect a call we rely on trusted technology providers. Your data may be passed to:

• the telecom operator that technically sets up the call (currently Telnyx LLC) - strictly to the extent needed to place the call;
• the server and hosting provider that runs the service;
• the AI model provider (currently OpenAI), which prepares the AI assistant's replies from the conversation - the data is not used to train its models;
• the payment processor Stripe (for businesses paying for the service) and the email provider we use to send sign-in links and notifications;
• the business that placed the CallsYou tool on its website - it is the party we call back on your behalf.

Each of these is bound by an agreement guaranteeing appropriate data protection. We do not sell data and we do not share it with anyone for advertising.

§6Transfers outside the European Economic Area

Some of our providers (including the telephony operator, the AI provider and the payment processor) are based outside the EEA, including in the United States. In such cases we make sure the transfer relies on mechanisms permitted by the GDPR - above all the Standard Contractual Clauses approved by the European Commission, which provide a level of protection equivalent to the European one.

§7Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it;
• rectify data that is inaccurate or complete data that is incomplete;
• erase your data (the “right to be forgotten”);
• restrict processing and object to processing based on legitimate interest;
• have your data transferred to another controller;
• withdraw consent at any time, without affecting the lawfulness of actions taken beforehand.

To use any of these rights, simply write to us at the address in §1. You also have the right to lodge a complaint with a supervisory authority - in Poland this is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

§8Cookies

On our website and in the call-request window we use small files stored in your browser (cookies and similar technologies). We use them to:

• run the service - e.g. to remember that the call window has already been shown, and to keep the consultant's panel session;
• keep things secure - limiting abuse and invalid requests;
• gather anonymous statistics - so we know which parts of the site to improve. We use Google Analytics 4 (Google Ireland Ltd.) for this; the data is aggregate and is not used to identify you.
• measure how our ads perform - only with your consent to marketing cookies. We use the Meta Pixel and Conversions API (Meta Platforms Ireland Ltd.): we share that, after clicking an ad, you checked the assistant on your website, created an account, started a trial or paid for a plan, together with your hashed email address, IP address and browser data. You can withdraw consent at any time in the cookie settings.

Files essential to the service are always set, because the site simply will not work without them. You can control the rest in your browser settings - disabling some of them may, however, affect how comfortably you can use the site.

§9Messenger, Instagram and deleting your data

Businesses using CallsYou can connect their Facebook Page and Instagram account. Messages you send them then reach that business's panel, the AI Assistant or an agent replies, and replies return to you through Meta (Meta Platforms Ireland Ltd.). We process messages from these channels on behalf of the business you write to - it is their controller.

How to delete your data:

• write to the address in §1 with the name of the business you wrote to and your name or account name - we will delete your conversations and data within 30 days and confirm by email;
• you can also ask the business you wrote to directly - it will delete the conversation in its CallsYou panel;
• when a business disconnects Messenger or Instagram in its panel (Chat and AI Assistant → Channels), it stops receiving new messages and we delete the access token for its Page immediately.

§10Changes to this policy

If we change how the service works, or new legal requirements arise, we will update this document and mark the effective date of the new version at the top of the page. We encourage you to check back from time to time.