Privacy
Zvani answers a business's phone with an AI assistant and shows the owner what was said. That means we handle recordings and transcripts of real conversations. This page says plainly what we do with them, who else sees them, and how long we keep them.
Two different people are involved
The business that signs up for Zvani decides what the assistant does and why it is recording. Under the GDPR that business is the controller, and Zvani is its processor: we handle call data on their instructions and do not use it for our own purposes.
The person who calls that business is whose voice is recorded. Telling callers that the line is answered and recorded by an AI assistant is the business's responsibility, not ours — the assistant is configured to disclose that it is an AI, but the legal duty to inform sits with the business.
If you rang a company and want your recording removed, contact that company. If they ask us, we delete it.
What we process
| Data | Why |
|---|---|
| Caller's phone number | To group calls by caller, show history, and let the business ring back. |
| Call audio | Streamed live to the AI so it can hold the conversation, and recorded so the business can listen back. |
| Transcript | Written from the audio; it is what the business reads instead of listening to everything. |
| Summary and analysis | A second AI pass produces a summary, a sentiment, a quality score and follow-up tasks. |
| Anything said in the call | A name, an address, an order number — whatever the caller chose to say ends up in the transcript. |
| Account data | The email address and hashed password of each person who signs in, and which workspaces they belong to. |
| Notification settings | Which events send a push, quiet hours, a daily cap, and the app's language. |
| Push token | A device identifier from Apple or Google so a notification can reach that phone. Removed when you sign out. |
We do not run advertising, we do not sell anything to anyone, and we do not build profiles of callers beyond the record of their calls to the business they rang.
Who else sees it
A conversation cannot happen without a few other companies. Each gets only what it needs to do its part:
- Telnyx — the telephone carrier. It carries the call and produces the recording.
- Google — the AI models. Call audio is streamed to the Gemini API to hold the conversation, and the finished transcript is sent once more for the summary and scoring.
- Apple and Google — push notifications, if the business turns them on. A notification carries the caller's number and why it needs attention, so it is readable on a lock screen.
A business can switch on further integrations — a calendar, a Telegram channel, an SMS to the operator, a lookup into its own database. Those send data where that business has chosen to send it. Nothing is enabled by default.
How long we keep it
Recordings are deleted after 90 days. The transcript, summary and analysis stay with the call record, so the business keeps a written history without keeping the audio.
Call records live as long as the workspace does. When a business deletes its workspace, its calls go with it. Account data is kept while the account exists.
Where it is stored
On servers in Helsinki, Finland, inside the European Union. Backups, when configured, stay in the EU. The AI models are operated by Google and may process the audio and text outside the EU under that company's own terms.
The mobile app
The Zvani app is a client for the service above; it shows you your own workspace and nothing else. On your phone it stores:
- your sign-in token, in the system keychain;
- a local copy of the calls you have looked at recently, so they are readable without signal;
- actions you took offline, until they can be sent;
- your language choice and the email you last signed in with.
Signing out erases all of it and unregisters the phone from notifications. The app has no analytics, no advertising identifiers and no third-party trackers.
Security
Traffic is encrypted in transit. Passwords are stored hashed, never in the clear. Credentials a business enters for its own integrations are encrypted at rest and are never shown back to the browser. Each workspace is isolated: a request carrying one workspace's token cannot read another's calls.
Your rights
Under the GDPR you can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Write to the address below and we will answer within 30 days. If you are the caller rather than the customer, ask the business you rang — they decide, and we act on their instruction.
You may also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).
Changes
If this page changes in a way that affects what we do with call data, we will tell customers by email before it takes effect. The date at the top always says when it last changed.
Contact
Zvani is operated by BRANDO.PRO SIA, Latvia.
Questions about this page or a request about your data: info@zvani.lv