Remute answers phone calls for small businesses with an AI voice assistant. This policy explains what personal data we process, why, on what legal basis, who receives it and what rights you have. It covers two groups: our customers (the businesses that use Remute) and the callers whose calls those businesses route to Remute.
1. Who is the controller
For website visitors and customer accounts, the controller is {{LEGAL_NAME}}, tax ID {{TAX_ID}}, registered address {{ADDRESS}}, contact {{CONTACT_EMAIL}}.
For the content of calls answered on a customer's behalf (recordings, transcripts, caller numbers, messages left), the customer is the controller and Remute acts as its processor. See the Data Processing Agreement summary. If you are a caller and want to exercise your rights over a call, contact the business you called first; we will help them respond.
2. Data we process
Account data: name, work email, password hash, business name, billing country, plan and settings.
Call data: the caller's phone number, call date, time and duration, an audio recording where enabled, a transcript, and the information the caller chooses to give (name, reason for calling, preferred appointment time, contact details). Callers may mention sensitive information such as health details; we ask customers not to collect it through Remute and we do not use it for any other purpose.
Usage and technical data: log data, IP address, device and browser type, pages visited, errors and security events, and minutes consumed.
Messages: emails and support requests you send us.
Cookies and similar technologies: see the Cookie policy. Analytics cookies are only set after you consent, and none are loaded at present.
3. Why we use it and our legal basis
To provide the service and manage your account (performance of a contract, Art. 6(1)(b) GDPR).
To answer, record and summarise calls on behalf of customers (as processor, on the customer's instructions; the customer's legal basis is normally its legitimate interest or the performance of a contract with the caller).
To secure the service, prevent fraud and abuse, and fix errors (legitimate interest, Art. 6(1)(f)).
To meet legal obligations such as tax, accounting and responses to authorities (Art. 6(1)(c)).
To send service emails (contract) and, only where you agree or where permitted by law for existing customers, product news. You can unsubscribe at any time.
To measure website use with analytics (consent, Art. 6(1)(a)). You can withdraw consent at any time.
4. Call recording and customer obligations
Remute announces at the start of a call that the caller is speaking with a virtual assistant. Customers are responsible for informing callers that the call may be recorded and transcribed, for choosing whether recording is enabled, and for having a valid legal basis, including any consent required in their country. Customers must not use Remute to record calls where recording is unlawful.
Remute is not a medical device and does not give medical, legal or financial advice. Remute is not HIPAA compliant at this time and must not be used to process protected health information.
5. Recipients and sub-processors
We share data only with providers that help us deliver the service, under contracts that meet Art. 28 GDPR: Supabase (database and authentication), Vercel (hosting), Vapi (voice agent orchestration), Twilio and/or Telnyx (telephone numbers, call routing and SMS), Resend (transactional email), and the speech-to-text, language-model and text-to-speech providers used by the voice agent. The current list is available on request at {{CONTACT_EMAIL}}.
We may also disclose data to public authorities when the law requires it, and to advisers under confidentiality. We do not sell personal data.
6. International transfers
Some providers are located in, or may access data from, countries outside the European Economic Area, including the United States. Where there is no adequacy decision, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, together with supplementary measures such as encryption in transit and at rest and access controls.
You can request a copy of the safeguards by writing to {{CONTACT_EMAIL}}.
7. How long we keep data
Account data: while your account is active and for up to 12 months afterwards, unless the law requires longer (for example, invoices for 6 years).
Call recordings and transcripts: by default 90 days, or the period the customer configures, after which they are deleted or anonymised. Customers can delete individual calls at any time.
Logs and security events: up to 12 months.
Consent records: for the period needed to prove consent.
These periods are drafts and will be confirmed before launch.
8. Your rights
You may request access, rectification, erasure, restriction, portability and objection to processing, and withdraw consent at any time. Write to {{CONTACT_EMAIL}} and we will reply within one month. We may ask for proof of identity.
If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of your country.
9. Security
We use encryption in transit and at rest, role-based access, row-level security in our database and audit logging. No system is perfectly secure; we will notify affected parties and authorities of personal data breaches as the law requires.
10. Children
Remute is for businesses and is not directed to people under 16. We do not knowingly collect their data.
11. Changes
We will post updates on this page and change the date above. For material changes we will notify account holders by email.