# Privacy and data retention

> What Allerto keeps about each call, for how long, recordings and the AI disclosure.


# Privacy and data retention

Allerto processes calls on behalf of the organisation that owns the agent. This page describes what the platform does; the data processing agreement (DPA) is available on request.

## Where data lives

Calls, transcripts, extracted data and recordings are stored in the European Union (Frankfurt, Germany). The voice models (OpenAI GPT-Live, Google Gemini Live) process the audio of the conversation while it happens; Telnyx carries the phone call.

## What each call keeps

| Data                                               | Kept                                  |
| -------------------------------------------------- | ------------------------------------- |
| Caller number, transcript, extracted data, summary | 24 months, then anonymised            |
| Tool calls, sentiment quotes, what was delivered   | 24 months, then removed               |
| Recording (agents with `recording: true`)          | 24 months, then deleted               |
| Duration, outcome, usage, sentiment scores         | Kept, for statistics and billing      |
| Do-not-call list                                   | Kept: it exists to respect the person |

Anonymisation runs automatically every hour on calls older than 24 months. An anonymised call keeps its id and `anonymized_at`; its `from`, transcript, `result.data`, summary and recording are gone.

## AI disclosure

Every agent is instructed to say at the start that it is an AI virtual assistant and never to pretend to be a person (EU AI Act, article 50). Allerto also checks it: each call records `ai_disclosed`, whether the agent's first words contained the disclosure. The console flags calls where it did not.

## Recordings

Off by default. With `recording: true` on an agent:

- the agent says, right after introducing itself, that the call is recorded, and tells anyone who objects that they can end the call and use the office's usual channels;
- the audio of both voices is stored as one mono WAV, encrypted at rest (AES-256-GCM);
- it is available at `GET /v1/calls/{id}/recording` and in the console, only to those who can see the call;
- browser test calls from the console are never recorded.

Recording is the agent owner's choice and responsibility: check the legal basis for it (for example legitimate interest with information to the caller, or consent) before enabling it.