When a customer calls and your agent answers, their voice is processed live. Transcription, conversation and speech synthesis are processed in the European Union, by providers bound to Sayelo by a GDPR-compliant data protection agreement. What remains of the call (the recording if you have switched it on, transcript, summary, contact, appointment) is then stored in a database hosted in France by an HDS-certified host. You set how long it is kept.
The journey of a call, step by step
1. The ring: the call comes in through an operator
The call is routed by telecommunications operators located in France. Numbers and telephony are provided by a partner operator registered with ARCEP (the French telecoms regulator).
2. The first words: the AI announcement
Every call begins with the statement “Please note that you are going to be speaking with an artificial intelligence”. This announcement is mandatory and cannot be switched off, either by Sayelo or by you. If the call is recorded, it is followed by “This call is recorded; you may object to this”. Recordings, included from the Essentiel plan, are opt-in: never active by default. Transcripts, on the other hand, are available on all plans.
3. The conversation: what is processed
During the conversation, four types of data are processed: the voice (audio stream and, where applicable, the recording), the text transcript of the conversation, the call metadata, and whatever the caller volunteers, such as their name or the reason for their call. The voice is personal data in its own right.
Voice AI providers
To understand the caller and answer them, the agent relies on voice AI service providers, which handle transcription, conversational processing and speech synthesis. Transcription, conversation and speech synthesis are processed in the European Union, by providers bound to Sayelo by a GDPR-compliant data protection agreement, as stated in our privacy policy (in French, article 7). These providers only process call audio and transcripts: data from Google Calendar is never passed to them. Your call data (recordings, transcripts, summaries, contacts, appointments), for its part, is hosted in France by an HDS-certified host. The up-to-date list of our subprocessors, by name, is provided to customers on request, and we inform you of any addition or replacement.
4. After the call: what is kept, and where
Calls, recordings, transcripts, summaries, contacts, appointments and knowledge bases are stored in the application database, by an HDS-certified host (health data hosting provider), in France, on all plans, as shown on the pricing page. The application that runs the agent operates in the European Union.
5. The summary
The call summary is sent to you by email, via an email delivery service located in France.
In one table: what is processed, and where
| Data | Example | Where |
|---|---|---|
| Voice | What the caller says, the recording if you have switched it on | Processed in the European Union; recordings stored in France, by an HDS-certified host |
| Transcript | The text of the conversation | Produced in the European Union; stored in France, by an HDS-certified host |
| Metadata | Numbers, timestamps, duration | Routed by operators in France; stored in France, by an HDS-certified host |
| Data provided by the caller | Name, reason for calling, contact details | In the transcript, the summary and the contact record, stored in France by an HDS-certified host |
| Connected Google Calendar | Slots, events | Database in France by an HDS-certified host, application hosting in the European Union; never passed to AI services |
The providers on our list that may process data outside the European Union are used for the marketing website, payment and additional services (call summaries, service continuity in the event of an outage), under the safeguards provided for by the GDPR. Wherever possible, Sayelo favours hosting and processing within the European Union.
Who has access to the data
- You, from your dashboard and your summaries.
- The Sayelo team, with restricted, logged access, on the principle of least privilege. Authorised staff are bound by a duty of confidentiality.
- Subprocessors, each for its own function only, with protection obligations equivalent to ours.
Communications and data are encrypted in transit. Your data is used solely to run your agent. It is never used to train AI models, never sold and never used for advertising.
How long it is kept
According to our privacy policy, call recordings and transcripts are kept for a limited period, set to the shortest time necessary and configurable by the customer, in line with the recommendations of the CNIL (the French data protection authority) on call recording. After that, the data is deleted. At the end of the contract, you choose: return of the data, then deletion, unless there is a legal obligation to keep it.
Your rights, and your callers' rights
For calls, you are the data controller: Sayelo acts as a processor, within the meaning of Article 28 of the GDPR. You inform the people you deal with that a voice agent is in use, which the announcement at the start of the call makes easier, and, where applicable, you obtain their consent to recording. For a healthcare practice, such as a GP, enhanced safeguards and an impact assessment may be necessary.
Everyone has the rights of access, rectification, erasure, restriction, objection and portability. When a caller contacts Sayelo, their request is passed on to you, and we help you respond to it. Anyone can also lodge a complaint with a data protection authority (in France, the CNIL).
This page is not legal advice. To go further, our Security and GDPR page summarises our safeguards, the guide to HDS hosting explains this certification, and the guide to GDPR and call recording details the rules on informing callers and on retention.
