Privacy policy

This policy explains how OmertaCall LLC ("OmertaCall", "we", "us") handles personal information. It covers two things: visitors to OmertaCall.com, and the OmertaCall telephony and messaging service ("the Service") that our business customers use. Section 3 explains when we act as a controller and when we act as a processor.

1. Controller and EU establishment

Registered office (Nevis)

OmertaCall LLC, Hunkins Waterfront Plaza, Suite 556, Main Street, Charlestown, Nevis.

EU establishment (Dublin, Ireland)

OmertaCall (Irish branch of OmertaCall LLC), Office Suites Club, 20 Harcourt St, Saint Kevin's, Dublin 2, D02 H364, Ireland.

OmertaCall LLC is the controller for the website and its own customer relationship, as described in section 3. The Dublin office is its Irish branch and registered EU designated establishment for electronic-evidence orders. This designation does not itself appoint a GDPR Article 27 representative.

For privacy questions and requests, email [email protected]. For sales enquiries, email [email protected].

2. What this policy covers

The website. OmertaCall.com, including the quote and contact form.
Our own customer relationship. Account, billing and onboarding information about the businesses that buy the Service and the people who act for them.
The Service. Calls, messages and related data that our customers create or receive when they use the Service. Our customers decide how that data is used.

If you are a customer, your service agreement and our data processing addendum (DPA) also apply. If they conflict with this policy on the handling of customer data, they prevail.

3. Our roles: controller and processor

We are a controller for website visitor data, sales and contact enquiries, customer account and billing records, know-your-customer (KYC) and compliance records, security logs, and the information we need to run and protect our network. We decide why and how that data is used.
We are a processor (or "operator" under POPIA, or "service provider" under US state laws) for the content and traffic data of our customers' calls and messages: recordings, transcripts, message content, call detail records of our customers' end users, and the results of AI processing. Our customer is the controller. We process this data only on the customer's documented instructions, as set out in the DPA.
If you are the customer's caller, contact or employee, and you want to exercise a right over data we process for a customer, please contact that customer first. We will help them respond. If you send the request to us, we will pass it to the customer unless the law requires us to answer ourselves.

4. Information we process

Website visitors and enquiries

Quote and contact form: name, business email address, company, the service you are interested in, locations and your description of your requirements.
Emails you send us, with anything you attach.
Technical information handled by our hosting and security provider, Cloudflare: IP address, browser and device details, pages requested and security signals, including the result of its Turnstile check.

Customer account and billing

Account holders and users: name, business email, job role, login credentials (stored in protected form), two-factor authentication settings, and the permissions you assign.
Company details, billing contacts, tax details, order forms and invoices.
Prepaid balance, top-up and payment records, including the transaction reference of a cryptocurrency top-up. We do not store full payment-card numbers.
KYC and compliance records: identity and company documents, beneficial-owner information, sanctions and risk screening results, and number-regulation documents that a country requires for a number.

Service data (processed for customers)

Call detail records: calling and called numbers, caller ID, time, duration, route, result and cost.
Recordings: audio of calls that the customer chooses to record.
Transcripts and call analysis: text, translations, summaries, scores and tags produced from calls.
Messages: content and metadata of SMS and WhatsApp messages sent or received through the Service.
Platform data: contact lists, queues, agent and team settings, API activity and audit logs.
AI processing data: audio and text sent to speech, translation and language features, the instructions that configure an AI voice agent, and the outputs. Recordings and transcripts are never used to train anyone's AI models, ours or those of our providers.

Security and operations

Network and signalling logs, device and software details, and fraud and abuse signals.

Please do not put sensitive personal information into free-text fields on the website. In the Service, the customer is responsible for what the people it calls say and for the content it sends.

5. Why we use information, and our legal bases

Where the GDPR, the UK GDPR or a similar law requires a legal basis, we rely on these:

Purpose	Data	Legal basis
Answer enquiries and prepare an agreement	Form and email data	Steps requested before a contract; legitimate interests
Create and run accounts, provide the Service, bill and support	Account, billing, Service data	Performance of a contract
Verify customers, screen against sanctions lists, prevent fraud and money laundering	KYC and account data	Legal obligation; legitimate interests
Secure the website and the network, detect abuse	Technical and security data	Legitimate interests
Provide customer-chosen features such as recording, transcription and AI processing	Service data	Our customer's instructions (we act as processor); the customer's own legal basis
Respond to lawful requests from authorities, and establish or defend legal claims	Any data needed	Legal obligation; legitimate interests
Send service notices about changes, security and billing	Contact data	Performance of a contract; legitimate interests

We do not sell personal information, and we do not share it for cross-context advertising. We do not use customer recordings, transcripts or messages for our own marketing. We do not make decisions about individuals that have legal or similarly significant effects by solely automated means. Where a customer uses AI features to score or analyse calls, the customer is responsible for human review of decisions about people.

6. Artificial intelligence features

Some features, such as transcription, translation, search of calls and AI voice agents, use machine-learning models. We send only the data needed for the requested function. Our contracts with AI providers forbid them from training on this data. Customers decide whether to turn these features on, and must tell the people on their calls that they are being recorded or that they are speaking with an AI system, where the law requires it.

Telecom carriers and network partners, to set up, route and terminate calls and messages. They receive the numbers, caller ID and routing data needed for that.
Messaging platforms, such as WhatsApp, for messages that a customer sends through them.
Hosting, infrastructure and security providers, including Cloudflare, who process data on our instructions.
AI, speech and analytics providers, for the features a customer turns on.
Identity, screening and payment providers, including cryptocurrency payment processors, for KYC, sanctions screening and top-ups.
Professional advisers, authorities and courts, where the law requires it or to protect rights. Our approach to government requests is described on the Law enforcement page.
A buyer or successor, if our business is reorganised or sold, subject to this policy.

Sub-processors. The providers that process customer data on our behalf are our sub-processors. They are bound by written terms no less protective than the DPA. We keep a current list, and you can request it by emailing [email protected] or through the contact page. Customers are told before we add a sub-processor and may object, as the DPA sets out.

8. International transfers

OmertaCall LLC is based in Nevis, and the Service runs on a network with more than 30 edge nodes. As a result, personal information may be transferred to and processed in countries other than your own. Where the GDPR or the UK GDPR applies and the destination has no adequacy decision, we use the European Commission's standard contractual clauses (SCCs), with the UK addendum or the UK international data transfer agreement for UK data, together with a transfer risk assessment and additional safeguards where needed. For South Africa, we apply the conditions for cross-border transfers in POPIA. A copy of the relevant clauses is available on request.

9. How long we keep information

Data	Retention
Quote requests and related emails	Up to 24 months after our last contact, unless they lead to a customer relationship
Account and contract records	For the life of the account and up to 7 years afterwards for tax, accounting and legal needs
KYC and compliance records	At least 5 years after the relationship ends, or longer if the law requires
Call detail records	As needed to bill and to meet telecom record-keeping rules, and no longer than the account and contract records
Recordings, transcripts and messages	Set by the customer in its settings. Where the customer has not set a period, we delete them within 12 months. On termination we delete them within 90 days, unless the law requires otherwise
Security and network logs	Generally up to 12 months
Website technical logs	Held by Cloudflare under its own, generally short, periods

We may keep information longer where it is needed for a legal claim, an investigation or a legal hold.

10. Security

We protect personal information with technical and organisational measures that include:

Encryption in transit. All calls are encrypted: signalling uses SIP over TLS and media uses SRTP. Web and API traffic uses TLS.
Encryption at rest for recordings, transcripts and stored credentials.
Access control. Role-based access, two-factor authentication and audit logs.
Resilience. Redundant edge nodes and tested business-continuity plans.
Independent assurance. We hold ISO 27001 and SOC 2 Type 2, and our controls are subject to independent audit. More on the security and compliance page.
Incident response. We notify affected customers of a personal data breach without undue delay and within 72 hours of becoming aware of it.

No system is completely secure, and we cannot promise absolute security.

11. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy;
correct inaccurate information;
delete your information;
restrict or object to processing, including processing based on legitimate interests;
receive your information in a portable format;
withdraw consent where we rely on it;
not be subject to solely automated decisions with significant effects;
lodge a complaint with a supervisory authority.

EEA and United Kingdom (GDPR and UK GDPR). You have all the rights above. You can complain to your national data-protection authority or, in the UK, to the Information Commissioner's Office.

South Africa (POPIA). You may ask us to confirm what we hold, to correct or delete it, and to object to processing. You may complain to the Information Regulator. We treat requests as described in the POPIA operator terms of our DPA.

California and other US states. If a state privacy law applies to you, you may ask us to disclose the categories and specific items of personal information we collected, to delete or correct it, and to opt out of sale or sharing. We do not sell or share personal information, and we do not discriminate against anyone for using these rights. An authorised agent may act for you with proof of authority.

To use a right, email [email protected] or write to either office listed in section 16. We may need to verify your identity. We will answer within the time that applicable law requires, normally within one month. If your request concerns data we process for a customer, see section 3.

12. Health information and HIPAA

The Service is not designed to be a repository of health records, but customers may use it for calls that include protected health information. If you are a covered entity or business associate under the US HIPAA rules, we will sign a business associate agreement (BAA) on request before you use the Service for that purpose. Contact [email protected]. Without a BAA, you must not use the Service to handle protected health information.

13. Cookies

The website uses only strictly necessary cookies and similar technologies, mainly for security. We do not use analytics or advertising cookies. See our Cookie policy for details.

14. Children

The website and the Service are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children.

15. Changes to this policy

We may update this policy. The "Last updated" date at the top shows the current version. If we make material changes, we will say so on this page and, for customers, notify them by email.

16. Contact