Privacy Policy

Kilma AI operates a managed AI voice calling service for business customers. This policy explains what we collect, why we collect it, and how long we keep it.

This policy covers our website and our service. It does not cover our customers' own privacy practices.

For our website and account data, Kilma AI acts as a data controller.

For calls placed or received by agents we operate on a customer's behalf, Kilma AI acts as a data processor. The customer is the controller and decides the purpose of each call.

• Account data: name, business email, company name, and billing details.
• Configuration data: agent scripts, call flows, phone numbers, and integration settings.
• Call data: audio recordings, transcripts, call metadata, and outcomes.
• Usage data: minutes consumed, call volumes, and feature usage.
• Website data: IP address, browser type, and pages visited.

Our service records and transcribes calls so agents can operate and so customers can review outcomes. Recordings and transcripts may contain personal information disclosed by the caller.

Customers are responsible for providing any notice and obtaining any consent required before a call is recorded. We provide configurable disclosure prompts, but the legal obligation sits with the customer as controller.

• To operate, configure, and monitor voice agents.
• To transcribe calls and generate summaries and analytics.
• To provide support and investigate technical issues.
• To bill for usage and manage accounts.
• To detect fraud, abuse, and service misuse.
• To meet legal and regulatory obligations.

We do not use customer call content to train publicly available AI models.

We may use aggregated and de-identified usage statistics to improve service quality and reliability.

We use third party providers for speech recognition, language models, speech synthesis, and telephony. Call audio and transcripts are shared with these providers only as needed to deliver the service.

We contract with these providers as sub-processors under written data protection terms. A current sub-processor list is available on request.

• Speech to text and voice processing providers.
• Large language model providers.
• Telephony and carrier partners.
• Cloud hosting and infrastructure providers.
• Payment and billing processors.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

We disclose information to sub-processors acting on our instructions, to professional advisers, to acquirers in a corporate transaction, and to authorities where required by law.

Retention periods are configurable per account. Absent a customer setting, we apply the defaults below.

Customers may request earlier deletion at any time. Some records are retained longer where required for legal, tax, or dispute resolution purposes.

• Call recordings: 30 days by default.
• Transcripts and call metadata: 12 months by default.
• Account and billing records: for the term of the agreement plus 7 years.
• Website analytics: 14 months.

We encrypt data in transit and at rest, restrict access on a least privilege basis, and log administrative access.

No system is completely secure. We maintain an incident response process and notify affected customers without undue delay.

We process data in the United States and the European Union. Regional data residency is available on Enterprise plans.

Where data leaves its region of origin, we rely on Standard Contractual Clauses or another approved transfer mechanism.

Depending on your location, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing.

If your information was collected during a call handled for one of our customers, contact that customer first. We will forward your request to them and assist as their processor.

Our website uses strictly necessary cookies and limited analytics cookies. We do not use advertising cookies.

You can control cookies through your browser settings.

We may update this policy. Material changes will be announced by email or in the product at least 30 days before they take effect.

For privacy questions, data subject requests, or sub-processor enquiries, contact help@kilma.ai.