You are the controller
Your business is the data controller; Apeka Group Limited (Ringwise) is the processor. We sign a data processing agreement.
Data protection
Where your call data lives,
for how long, and who can see it
Where do callers' voices and details go? The data flow, sub-processors, retention periods and agreements, plainly.
In short
Four
Facts
Live audio processed in the US
Speech recognition, the language model and speech synthesis run on US-based sub-processors during the call. Transfer safeguards are set out in the agreement.
Database in the EU
Transcripts, summaries and caller details live in our Frankfurt database; each business's data is separated by row-level access rules.
Recording can be off
If recording is on, the file is stored by default in the call platform's US storage. Switch it off and only the transcript and summary are kept. Retention is set in the contract.
Data flow
Where Data Goes
During a Call
01
Call
The caller dials your number; forwarding brings the call to the number allocated to you.
02
Platform
The call is handed to the call platform (US).
03
Conversation
Speech to text, the reply, the voice. All in real time, on US-based sub-processors.
04
Result
The result reaches our server functions in Frankfurt; the transcript and summary are written to the database.
05
Alerts
An instant SMS to your team and, where needed, an information SMS to the caller. Everything in your own panel.
Sub-processors
What Is Processed
Where
| Processing | Data processed | Country / region |
|---|---|---|
| Phone number, call delivery and SMS | Caller number, audio in transit, SMS content | Türkiye / UK (set at setup) |
| Call platform | Audio, transcript, call logs; the audio file if recording is on | US |
| Speech recognition, language model, speech synthesis | The caller's voice, conversation text, your business information, the assistant's reply | US |
| Database, server functions, panel login | Transcripts, summaries, caller details, requests, panel accounts | EU (Frankfurt) |
| Calendar (only if used) | Appointment details | Set out in the contract |
| Panel account emails | Panel user's email address | Set out in the contract |
| Web panel hosting | Panel access logs (e.g. IP) | US |
Provider names, retention periods and transfer safeguards are given in the sub-processor list for your setup and in the data processing agreement; available on request.
Agreements
What Gets
Signed
Data processing agreement
Security measures, the sub-processor list, retention and deletion rules, breach notification, and the safeguards for processing outside the UK.
Sub-processor list
Role, data processed, country and retention period for every provider actually used in your setup; providers not used are not listed.
Retention and deletion
You set the period; expired records are deleted automatically. Deletion requests come to you as controller, you pass them to us, we delete within the agreed time.
Opening notice
What Callers Hear
at the Start
Every call opens with a short notice that the caller is speaking to an AI and how the call is processed. The final wording is agreed with your legal adviser.
Example: recording on“Hello, I'm Sophie, the AI assistant answering calls for [Business name]. This call is recorded and processed to handle your request and improve our service. You can find the full privacy notice at [your website]. How can I help?”
Recording off, and special cases
Recording off: “Hello, I'm Sophie, the AI assistant answering calls for [Business name]. This call is transcribed, not recorded; the full privacy notice is at [your website]. How can I help?”
Notice is not consent. The notice does not say “continue if you agree”; where consent is required it is collected separately.
Minors: where callers may be under 18, we recommend keeping recording off and a short retention period. Outbound calls: marketing calls only to contacts you may lawfully call under UK rules.
Access
Who Can
Access Data
Five rules
- The database is in Frankfurt; each business's data is separated by row-level access rules (RLS).
- The public key used by the website cannot read call data; the full-access key lives only on the server.
- The panel requires a user account and password; you decide who gets access.
- The Ringwise team accesses data only to run the service, fix faults and provide support.
- Alerts to your team go by SMS; Ringwise's own technical alerts contain no personal data.
Questions
Data
Questions
Does data leave the UK?
Yes. Live audio is processed in the US and the database is in the EU (Frankfurt). The safeguards for this are set out in the data processing agreement.
Is Ringwise compliant?
Compliance is not a single label: your privacy notice, lawful basis, contracts and technical measures are assessed together. As processor we provide the agreement, the sub-processor list and the measures on this page; please take advice for your own setup.
What if a caller asks for their data to be deleted?
The request comes to you as controller. You pass it to us; we delete the transcript, summary and recordings within the agreed time and confirm.
What about health data in clinics?
The assistant gives no medical advice and asks for no more than an appointment needs. Keeping recording off and choosing a short retention period reduces risk.
For the agreement template, sub-processor list and a notice adapted to your business: hello@ringwise-app.com.
Your Own
Data Flow
Let's talk through recording and retention in the demo call; you can request the agreement template and sub-processor list.
or email hello@ringwise-app.com