Privacy Policy

The legal entity identified below is the controller for account, website, demo, support and billing data. When Alovo handles caller data on behalf of a Customer, that Customer is the controller and Alovo acts as its processor under the Data Processing Agreement.

• Website and demo data: name, work email, telephone number, company, industry, website, IP address, language and request details.
• Account data: email, company, role, authentication events, sessions, security logs and settings.
• Call data: caller and destination numbers, call time and duration, transcript, summary, outcome, booking details, messages and recording URL or recording when enabled.
• Billing data: plan, usage, currency, invoices, payment-provider identifiers and payment status. Full card details stay with T-Kassa or Stripe.
• Technical data: device and browser information, service logs, error reports and essential cookies.

• Arrange a requested demo and respond to enquiries — consent and steps requested before a contract.
• Create and operate an account, answer calls, provide integrations and bill for use — performance of the contract.
• Prevent abuse, protect accounts, debug failures and keep audit records — legitimate interests and legal obligations.
• Send marketing messages only where separate consent has been given; service and security notices are not marketing.

We use infrastructure, telephony, speech, AI, email, monitoring and payment providers as processors or independent controllers where necessary. Depending on the Customer configuration these may include Vapi or LiveKit, Telnyx or Twilio, Deepgram, ElevenLabs, OpenAI, Anthropic, Google, T-Kassa and Stripe.

A provider may process data in another country. We use contractual and technical safeguards required by applicable law. Russian citizens' personal data must first be recorded and stored in databases located in Russia where Russian localisation rules apply; any subsequent cross-border transfer requires its own lawful basis and notification where required.

• Demo requests: up to 12 months after the last contact, unless a contract begins or deletion is requested sooner.
• Account and contract data: while the account is active and for up to 3 years after termination, unless a longer statutory period applies.
• Payment and accounting records: for the period required by tax and accounting law.
• Caller content: for the period selected by the Customer; the intended default is 90 days for recordings and transcripts, subject to the Customer's configuration and legal duties.
• Security logs and backups: only for the period necessary to investigate incidents and maintain recovery copies, then deleted or anonymised.

Depending on applicable law, a person may request access, correction, deletion, restriction, portability, information about processing, or withdrawal of consent. Withdrawal does not make earlier lawful processing unlawful. Requests can be sent to the support email below; we may verify identity before disclosing data.

We apply access controls, tenant isolation, encryption in transit, restricted credentials, logging, backups and incident procedures. No internet service can guarantee absolute security; suspected incidents should be reported immediately.

The current version and effective date appear on this page. Material changes will be communicated through the site, account or email where appropriate.