Calls are searchable by telephone number: the search index over a call covers both numbers and both names, so the controller can find every call involving one number and read the transcript, the events and the recording. That is a real answer to an access request. What does not exist is a single button that assembles it into one document.

Rectification · Article 16

Account data is editable in the console. A transcript is a record of what was said and correcting it is not usually the right remedy — the honest response to a wrong transcript is a note recorded against the call, which today means a person adding one. There is no field on a call whose purpose is a data subject's correction.

Erasure · Article 17

Deleting the recording works and is a real deletion from the object store. Erasing the rest of a call — transcript, messages, tool arguments, event payloads — is a real operation in the code and has no interface: it runs when the retention window expires, or when somebody runs the retention command. The API endpoint that deletes a call is a soft delete and leaves the content in place. Erasing one caller from one call, on request, is a manual database operation today.

Portability · Article 20

Not built. The API can page through calls, transcripts and events, and a customer with their own bucket already holds the audio — so a controller can assemble an export. There is no per-data-subject export, and the CSV on the billing page is usage, not personal data. If a page tells you otherwise, that page is wrong and this one is right.

Objection · Article 21

For outbound calling there is a real mechanism: a suppression list that a dial attempt is checked against, so a number added to it stops being called. For inbound calls and for the processing that follows a call, objection is a conversation with the controller and a decision they make.

Your rights

Five rights, and how each one is really served

Access, rectification, erasure, portability and objection — with the state of each mechanism as it exists today rather than as the Regulation describes it. Two of the five are partly manual and one is not built.

If you rang a company and an AI answered, that company is the controller and your request goes to them. CallAgent runs the software for them and cannot identify you, or find your call, without them.

§01 Direction

Almost certainly not us

When you telephone a business and its assistant answers, the business decides that the assistant exists, what it says, whether the call is recorded and how long the recording is kept. That makes them the controller and us their processor, and it is not a technicality: we hold no index that would let us find your call from your name, and we would be acting unlawfully if we started deleting a customer's records because a stranger asked us to.

So: ask the company you rang. If they do not respond, or you cannot work out who they were, write to us anyway and we will help you identify the controller — that assistance is something a processor owes, and we will give it.

If your data is with us because you have an account, or because you filled in a form on this site, then we are the controller and the request comes straight to us.

§02 Reality

The five rights, one row each

The right-hand column is the mechanism that exists today, not the obligation. Where the mechanism is a person doing something by hand, it says so, because a request that depends on somebody remembering has a different failure mode from one that depends on a job.

Access · Article 15
Partial

Calls are searchable by telephone number: the search index over a call covers both numbers and both names, so the controller can find every call involving one number and read the transcript, the events and the recording. That is a real answer to an access request. What does not exist is a single button that assembles it into one document.
Rectification · Article 16
By hand

Account data is editable in the console. A transcript is a record of what was said and correcting it is not usually the right remedy — the honest response to a wrong transcript is a note recorded against the call, which today means a person adding one. There is no field on a call whose purpose is a data subject's correction.
Erasure · Article 17
By hand

Deleting the recording works and is a real deletion from the object store. Erasing the rest of a call — transcript, messages, tool arguments, event payloads — is a real operation in the code and has no interface: it runs when the retention window expires, or when somebody runs the retention command. The API endpoint that deletes a call is a soft delete and leaves the content in place. Erasing one caller from one call, on request, is a manual database operation today.
Portability · Article 20
Not built

Not built. The API can page through calls, transcripts and events, and a customer with their own bucket already holds the audio — so a controller can assemble an export. There is no per-data-subject export, and the CSV on the billing page is usage, not personal data. If a page tells you otherwise, that page is wrong and this one is right.
Objection · Article 21
Partial

For outbound calling there is a real mechanism: a suppression list that a dial attempt is checked against, so a number added to it stops being called. For inbound calls and for the processing that follows a call, objection is a conversation with the controller and a decision they make.

§03 Correction

What the privacy policy used to say

Until this page existed, the privacy policy said that erasure was "an operation in the product rather than a support ticket" and pointed at the billing CSV as an export. Both were closer to what the code should do than to what it does, and both have been rewritten.

The specifics, so the change is checkable rather than announced. Erasure of call content has no interface and runs through retention or a command. The recording endpoint is the one deletion a customer can perform on demand. The call deletion endpoint is a soft delete. And the usage CSV is billing data, which is not a portability answer for a person who was on a call.

Privacy

§04 Timing

How long it takes, and what we ask you for

A month from receipt, extendable by two more where the request is complex, which is what the Regulation allows and what we will actually use. Nothing is charged for the first request.

We will ask for enough to be sure who you are and to find the processing you are asking about — usually the telephone number you rang from and roughly when. We will not ask for a copy of an identity document to answer a question about a telephone call, because collecting a passport scan to service a privacy request is its own privacy problem.

§05 Escalation

If we get it wrong

You can complain to a supervisory authority. In Romania that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal; in any other Member State, the authority for the place you live or work.

Complaining does not stop you from also writing to us, and the two are not alternatives.

A route to a person, which is the point of publishing this

A DPA nobody can ask a question about is a PDF. If your review turns up something this page does not cover, or something it gets wrong, the form reaches the person who wrote it.

Ask a compliance question See the demo

The rest of the set

The other European documents

None of the seven documents in this set has been through a lawyer. They are engineering statements about a running system, published because a wrong description is worse than a missing one, and they will be reviewed before anybody is asked to sign anything.

Notes

1 Call search over both telephone numbers is a generated full-text column on the calls table; it survives content erasure, which is why the numbers remain findable after a purge.
2 The erasure primitive is App\Services\Calls\RetentionService::stripCall(). It is public, correct, and reachable today only from the retention run.
3 The outbound suppression list is checked before a dial attempt; a suppressed number is skipped with a recorded reason rather than silently dropped.