Privacy Policy

CallVA is operated by Juko Trade OÜ, registry code 11716813, VAT number EE101369226, with a registered address at Vihuri tn 4-29, 10311 Tallinn, Estonia. References to “CallVA”, “we”, “us” or “our” mean Juko Trade OÜ.

For questions or privacy requests, contact support@callva.io.

This policy applies when you visit callva.io, use the CallVA dashboard, APIs or CLI, or receive services that use the CallVA platform. It does not replace the privacy notices of a CallVA customer that contacts people through its voice operation.

For account, website and billing data, Juko Trade OÜ generally acts as the data controller. For call content and business data a customer submits to CallVA, we generally process that data on the customer's behalf. The customer remains responsible for its instructions, legal basis, notices and permissions.

Depending on how CallVA is used, we may process:

• Account and profile data, including name, email address, organisation, memberships and authentication records.
• Project and configuration data, including agents, prompts, knowledge resources, custom fields, schedules, automations and integration settings.
• Call data, including phone numbers, timestamps, status, business outcomes, recordings, transcripts, extracted fields and technical metrics.
• Billing data, including billing identity, address, VAT information, wallet activity, usage records and payment status. Card details are handled by our payment provider rather than stored directly by CallVA.
• Technical and security data, including IP address, browser and device information, logs, identifiers, API activity and diagnostic events.
• Communications you send to support or provide during onboarding and service delivery.

We use personal data to provide and secure the service, authenticate users, run configured call workflows, store and present results, process payments, support customers, investigate faults, prevent abuse, comply with law and improve the reliability and usability of CallVA.

Our legal bases may include performance of a contract, legitimate interests in operating and protecting the service, compliance with legal obligations and consent where consent is required. When we process customer-controlled call data, the customer's instructions and legal basis govern that processing.

Voice calls can involve personal data and communications laws that differ by country. Customers must ensure that their calls, recordings, transcriptions, disclosures, contact lists and automated outreach are lawful, appropriately authorised and consistent with the expectations communicated to call participants.

CallVA does not determine whom a customer may call or whether a customer has obtained the consent required for a particular workflow.

We use service providers to host and secure the platform, deliver authentication and email, process payments, provide telephony and voice infrastructure, transcribe or generate content, monitor reliability and support customer-selected integrations. These providers process data only for the services they supply and under their own applicable terms and safeguards.

If a customer connects VAPI, Retell, ElevenLabs, Ultravox, LiveKit, a telephony carrier or another external service, data needed for that integration may be sent to that provider. The customer's relationship with the selected provider also applies. We do not sell personal data.

Some providers may process data outside Estonia or the European Economic Area. Where data protection law requires it, we use an appropriate transfer mechanism or rely on the safeguards supplied by the relevant provider.

We retain account and service data for as long as needed to provide the service, follow customer instructions, resolve disputes, maintain security and meet legal obligations. Retention for recordings, transcripts and project data can depend on customer configuration and connected providers. Financial records may be kept for the period required by accounting and tax law.

When data is deleted, limited copies may remain temporarily in backups or logs until their normal expiry, unless law requires longer retention.

We use technical and organisational measures intended to protect data against unauthorised access, alteration, disclosure and loss. No system is completely secure, and customers are responsible for protecting their credentials, API keys and connected accounts.

If we become aware of a personal-data breach, we will investigate it and notify affected customers or authorities when applicable law requires notification.

Depending on applicable law, you may have rights to access, correct, delete or restrict personal data, object to processing, receive a portable copy, withdraw consent and complain to a supervisory authority. These rights may be limited where another legal obligation applies.

If your data was collected by a CallVA customer through its call operation, contact that customer first. We will assist the customer with an appropriate request where required.

We may use cookies or similar local technologies that are necessary for authentication, security, preferences and website operation. If we introduce optional analytics or marketing technologies that require consent, we will provide the relevant choice before using them.

We may update this policy as CallVA or applicable law changes. The latest version will be published on this page with a revised update date. Material changes may also be communicated through the service or by email.