Effective date: 2.6.26
Qallio AB, company registration number 559573-8815, Kivra: 559573-8815, 106 31 Stockholm, Sweden.
Privacy contact: privacy@qallio.com
1. Introduction and scope
This Privacy Policy explains how Qallio AB ("Qallio", "we", "us") collects, uses, shares, and protects personal data about our users, customers, customer representatives, business contacts, website visitors, and app users.
Qallio provides an AI-powered phone, messaging, booking, routing, and workflow service for businesses (the "Service"). Users accept Qallio's Terms of Service, Data Processing Agreement, and this Privacy Policy electronically during signup, order, account creation, or use of the Service. No handwritten signature is required.
This policy applies to personal data that Qallio processes as controller. It covers:
- Registered Users: business customers, account owners, administrators, authorised users, and representatives using or managing a Qallio account
- Customer contacts and business contacts: people who communicate with Qallio about sales, onboarding, support, billing, partnerships, or administration
- Website Visitors: people who visit Qallio's websites
- App Users: people who use Qallio's web or mobile app on behalf of a customer
This policy is not the main document for callers who contact one of Qallio's customers through the Service. For caller and end-customer data, the customer is normally the data controller and Qallio processes that data as a processor under the Data Processing Agreement.
2. AI transparency
When you use Qallio's Service, AI systems may support account setup, service operation, support, and product functionality.
Where Qallio acts as processor for a customer's caller or end-customer data, that customer is responsible for deciding whether, when, and how to inform callers about AI use, call recording, transcription, automation, and related processing.
We do not use personal data collected through the public "call the live demo" function to train or improve AI models. That function is for demonstration purposes only.
3. When Qallio is the data controller
Qallio acts as data controller for personal data we process for our own business purposes, including account administration, billing, support, security, website and app operation, analytics, marketing, and customer relationship management.
We process personal data only for specified, explicit, and legitimate purposes and only where we have a valid legal basis.
| Who | Purpose of processing | Categories of personal data | Legal basis | Typical retention |
|---|---|---|---|---|
| Registered Users | Create, provide, manage, secure, and support Qallio accounts and the Service. | Name, work email address, phone number, company details, account details, login identifiers, security logs, support communications, subscription details, and payment administration data. | Performance of a contract; legitimate interests in operating and securing the Service; legal obligations where applicable. | For the duration of the customer relationship and normally up to 24 months after it ends, unless longer retention is required for accounting, legal claims, security, or compliance. |
| Registered Users | Billing, payment administration, bookkeeping, and tax compliance. | Billing contacts, invoice data, payment references, transaction records, VAT or tax information, and related correspondence. | Performance of a contract; legal obligations. | Accounting records are retained for 7 years where required by Swedish law. |
| Registered Users and business contacts | Send service updates, onboarding information, product information, and business-to-business marketing. | Name, email address, company details, marketing preferences, campaign attribution, and communication history. | Legitimate interests for relevant business communications, and consent where required. | Until objection, unsubscribe, or normally up to 12 months after the last meaningful engagement, except limited suppression data kept to honour opt-outs. |
| Website Visitors | Run the website securely and effectively. | IP address, browser information, device information, technical logs, and necessary cookie data. | Legitimate interests in operating and securing the website. | Normally up to 12 months, depending on security and operational needs. |
| Website Visitors | Website analytics, attribution, and marketing where enabled. | IP address, cookie ID, browsing behaviour, referral data, analytics events, and marketing engagement data. | Consent where required; legitimate interests where permitted for limited business-to-business analytics and marketing. | Analytics data is normally retained for up to 14 months, unless a shorter period is configured. |
| App Users | Provide the web and mobile app, deliver notifications, maintain account security, and support app operation. | User ID, account ID, email address, device and browser information, app events, push notification tokens, notification preferences, security logs, and support information. | Performance of a contract; legitimate interests in operating and securing the Service; consent where required for optional notifications, analytics, or similar technologies. | For the duration of the customer relationship and normally up to 24 months after it ends, unless shorter product settings apply or longer retention is required for legal, security, or compliance reasons. |
Our legitimate interest in business-to-business marketing is to inform existing and potential customers about updates and services that may be relevant to their business. You have the right to object to direct marketing at any time. If you object, we will stop using your personal data for those purposes.
4. Caller and end-customer data
This section applies to callers and other end customers who interact with one of Qallio's customers through the Service.
- The business you contact is normally the data controller. The Registered User decides why and how your personal data is processed through the Service.
- Qallio processes data on that business's behalf. Qallio acts as processor and processes your data according to the Registered User's instructions and Qallio's Data Processing Agreement.
- Typical caller data may include name, phone number, booking details, message content, call metadata, call recording, transcript, summary, and other information needed to handle the inquiry.
If you are a caller or end customer and want to exercise your privacy rights, you should normally contact the business you contacted through the Service. Qallio may assist that business as its processor.
5. How long we store personal data
We keep personal data only for as long as necessary for the purpose it was collected, unless a longer period is required or permitted by law.
- Registered Users: account and relationship data is kept for the duration of the customer relationship and normally up to 24 months after it ends, unless longer retention is needed for legal claims, accounting, security, or compliance.
- Financial records: accounting and bookkeeping records are retained for 7 years where required by Swedish law.
- Marketing data: marketing contact data is kept until objection or unsubscribe, and normally up to 12 months after the last meaningful engagement, except limited suppression data kept to honour opt-outs.
- Caller and end-customer data processed for customers: retention follows the customer's instructions, the product settings configured by the customer, and the applicable Data Processing Agreement. Product defaults are 48 hours for voice recordings and 30 days for transcripts, summaries, analyzer outputs, messages, tool-call records, and booking records.
- Website Visitors: technical website logs and necessary cookie data are normally kept for up to 12 months. Analytics data is normally kept for up to 14 months where analytics is enabled.
- App and product analytics: normally kept for up to 14 months, unless a shorter period is configured or longer retention is required for security, abuse prevention, or legal reasons.
6. Who we share personal data with
We share personal data only where necessary for the purposes described in this policy and only with recipients that have a legitimate need to receive it.
Depending on the context, recipients and service providers may include:
| Provider | Purpose |
|---|---|
| Google Cloud | Cloud infrastructure, storage, database, logging, authentication support, AI-related services, and operation of Qallio's backend and app services. |
| Vonage | Telephony, SMS, phone-number services, telecom connectivity, and related communications metadata. |
| HubSpot | Customer relationship management, sales communication, meeting booking, onboarding, support, and marketing operations. |
| Intercom | Website and in-app support chat, customer messaging, and support conversation history. |
| Stripe | Payments, billing, subscription management, payment-method handling, invoicing support, and fraud prevention. |
| PostHog | Product analytics, website analytics, app analytics, usage telemetry, feature flags, and product improvement where enabled and lawful. |
| Google Tag Manager | Managing website tags, analytics scripts, marketing scripts, and consent-dependent tracking configuration. |
| Google Analytics | Website analytics, traffic measurement, attribution, campaign measurement, and visitor behaviour analysis where enabled and lawful. |
| Expo | Mobile app services, push notification delivery, app update infrastructure, device push tokens, and related app operational metadata. |
We may also share personal data with professional advisers, auditors, insurers, legal representatives, public authorities, courts, or regulators where required by law or needed to protect our rights.
For processing where Qallio acts as processor for a Registered User, the current processor-side Subprocessor list is provided in Appendix 2 to the Data Processing Agreement published with Qallio's Terms of Service.
7. International transfers
Qallio aims to use service arrangements that support processing within the EU or EEA where reasonably possible. Some providers may process or access personal data outside the EU or EEA. Where that happens, Qallio uses an appropriate transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where required.
8. Cookies and similar technologies
We use cookies and similar technologies on our website and platform.
- Public website: where required, Qallio asks for consent before using cookies or similar technologies that are not strictly necessary for the website to work, such as analytics or marketing cookies. You can manage your choices in the cookie banner or cookie settings.
- Logged-in platform: Qallio uses cookies and similar technologies that are necessary for authentication, security, session management, preferences, and operation of the platform. If optional analytics or marketing cookies are used in the platform, Qallio will request consent where required.
9. Your rights
Subject to applicable law, you may have the right to:
- request access to your personal data
- request correction of inaccurate or incomplete data
- request deletion of your personal data
- request restriction of processing
- object to certain processing, including direct marketing
- receive personal data in a portable format where the law provides that right
- withdraw consent at any time where processing is based on consent
Registered Users, business contacts, Website Visitors, and App Users can contact Qallio at privacy@qallio.com.
Callers and end customers should normally contact the business they interacted with through the Service. That business is normally the data controller. Qallio may assist the business as its processor.
You also have the right to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
10. Security
We use appropriate technical and organisational measures to protect personal data, taking into account the nature of the data, the processing, and the risks involved. Measures may include access controls, authentication controls, encryption in transit, provider-managed storage security, logging, monitoring, backups, incident response routines, and vendor management.
11. If you do not provide personal data
If you do not provide information that is necessary for us to create an account, manage a subscription, provide support, process payments, meet legal obligations, or respond to your request, we may be unable to provide the relevant service or response.
12. Changes to this policy
We may update this policy from time to time to reflect changes in law, our services, or the way we process personal data. The latest version will be published with an updated effective date or last-modified date. If we make material changes, we may provide additional notice.
13. Contact
If you have questions about this policy or how Qallio handles personal data, contact privacy@qallio.com.