Privacy Policy

1. Who we are

Kovtel is a cloud phone system for businesses, operated by Kovtel (“we”, “us”). This policy covers this website and the Kovtel application. Questions about privacy can be sent to hello@kovtel.com.

2. Our role and yours

For website visitors and our customers’ account details, we decide how the data is used and act as the data controller.

For call data (phone numbers dialled or received, call logs, recordings) our customers decide why calls are made and recorded. For that data the customer is the controller and we act as a processor, handling it only to provide the service and on the customer’s instructions. If you were called by, or called, a business that uses Kovtel, please contact that business first about your data.

3. Information we collect

Website visitors

• Contact form: your name, email address, company, team size, the topic you choose and your message, plus the IP address the form was sent from (used to prevent abuse).
• Technical data: standard server logs such as IP address, browser type, pages requested and timestamps.

Customers and their users

• Account details: name, email address, phone number, password (stored only as a one-way hash), optional profile photo, and licence status.
• Twilio credentials: your Twilio Account SID, Auth Token, API Key, API Secret and TwiML App SID. Tokens and secrets are encrypted before they are stored.
• Phone numbers and settings: the Twilio numbers you import, their names, forwarding rules and recording preferences.
• Call logs: caller and called numbers, direction, status, start and end times, duration and the cost reported by Twilio.
• Call recordings: audio of calls that you choose to record, stored as MP3 files, with the recording’s duration and identifier.
• Support messages: the content of support tickets you send us.

4. How we use information

• To provide the service: placing and receiving calls, forwarding, recording, call history and dashboards.
• To answer enquiries and support requests.
• To manage accounts and licences, and to keep the service secure (for example, rate-limiting logins and blocking abuse).
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising or to build marketing profiles.

5. Legal bases

Where data-protection laws such as the GDPR or UK GDPR apply, we rely on:

• Contract: to provide the service to customers.
• Legitimate interests: to answer enquiries, secure the service and prevent fraud.
• Legal obligation: where the law requires us to keep or disclose data.
• Consent: where we ask for it; you can withdraw it at any time.

6. Calls, Twilio and your Twilio account

Kovtel does not carry phone calls itself. Calls, phone numbers and recordings run on your own Twilio account, which you connect to Kovtel. Twilio Inc. therefore processes call audio, phone numbers and call metadata to connect and record calls.

• Twilio handles that data under your agreement with Twilio and the Twilio Privacy Notice. Its retention and security are governed by Twilio and by the settings in your Twilio account.
• Recordings are kept in your Twilio account and a copy is downloaded to Kovtel so you can play it in the app. Deleting a recording in Twilio does not delete our copy, and the reverse is also true.
• All use of Twilio through Kovtel must follow the Twilio Acceptable Use Policy.

Twilio is a registered trademark of Twilio Inc. Kovtel is an independent product and is not affiliated with, endorsed or sponsored by Twilio.

7. Call recording and consent

Recording is off unless a customer switches it on, either for each call in the dialer or for all outbound calls or selected forwarded numbers. Many countries and US states require that everyone on a call is told, and sometimes that they agree, before it is recorded. Customers who record calls are responsible for giving that notice and getting any consent the law requires. The dialer lets agents pause recording, for example while card details are read out.

If transcription is switched on, the recording is sent to a speech-to-text provider to produce the transcript. It is off by default.

8. Service providers and sharing

We share personal data only with providers that help us run the service, under contracts that protect it:

• Twilio Inc.: telephony, phone numbers and recording, through your own Twilio account (see section 6).
• Hosting and storage providers: to run the application and store data.
• Email delivery providers: to send service and enquiry emails.
• A speech-to-text provider: only if transcription is switched on.

We may also disclose data where the law requires it, to protect our rights or users’ safety, or as part of a sale or merger of our business.

9. Cookies and local storage

When you first visit, a cookie banner lets you accept all, reject non-essential cookies, or manage each category. Rejecting is as easy as accepting, and optional cookies stay off until you turn them on. You can change your choice at any time with Cookie settings, also linked in the footer.

Analytics and marketing cookies are only ever loaded after you allow that category. We do not currently use any; if we add them, they will be listed here and will still wait for your permission.

Record of your choice. To show that consent was given, we keep a record of each choice: a random consent ID, the categories you allowed, the policy version, the date, your browser type and a one-way scrambled (hashed) form of your IP address, never the address itself. These records are deleted after 13 months, and we ask again after 365 days or whenever this policy changes.

Our pages load fonts and styles from Google Fonts and the jsDelivr CDN, which receive your IP address when they deliver those files.

10. International transfers

Our providers, including Twilio, may process data in countries other than yours, such as the United States. Where required, those transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses.

11. How long we keep data

• Account data, call logs and recordings: for as long as the customer account is active, then deleted or anonymised within a reasonable period unless the law requires us to keep them longer.
• Website enquiries: until the enquiry is dealt with and no longer needed, after which staff delete them.
• Server logs: for a short period for security and troubleshooting.

12. Security

We use HTTPS for all traffic, hash passwords, encrypt Twilio tokens and secrets at rest, verify the signature of every request from Twilio, keep each customer’s data separate from other customers, and limit repeated login attempts. No system is perfectly secure, but we work to protect your data and will tell affected people and authorities about a breach where the law requires.

13. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. Residents of California and other US states may have similar rights, and we do not sell or share personal data for cross-context advertising. To use these rights, email hello@kovtel.com. You may also complain to your local data-protection authority.

If your request concerns call data held for one of our customers, we will pass it to that customer and help them respond.

14. Children

Kovtel is a business service and is not meant for children under 16. We do not knowingly collect their personal data.

15. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell customers about significant changes.

16. Contact us

Kovtel.
Email: hello@kovtel.com