Privacy Policy

The controller of personal data within the scope described in chapter 3(a) is Ivorylab, the operator of the BrosBots platform available at brosbots.com and app.brosbots.com (the “Controller”, “we”).

• Registered address: ul. Wincentego Witosa 14, 95-100 Zgierz, Poland
• Registration details: Tax ID (NIP) 7322198230, entered in the Polish Central Register of Business Activity (CEIDG)
• Contact for personal data matters: kontakt@brosbots.com

We have not appointed a data protection officer. We handle all data protection matters at the email address above and respond without undue delay, and in any event within one month of receiving a request.

• Platform - the brosbots.com website, the app.brosbots.com application, and the API and voice widget we make available.
• Customer - an entity that has concluded an agreement with us to use the Platform, usually a business.
• User - a natural person using a Customer’s account.
• Caller - a person who talks to a Customer’s voice agent: calls its number or answers an outbound call. A Caller is not our customer and usually has no relationship with us.
• Conversation data - the audio recording, transcript, call metadata (numbers, time, duration, status, cost) and data the Caller provides during the call or that the Customer passes to the agent through the API or an integration.

This is the most important chapter of this document, because it determines whom requests should be addressed to and who is responsible for the lawfulness of a given processing operation.

a) We are the controller of the data whose processing we decide on ourselves: account and User data, billing data, correspondence with us, technical data of visitors to brosbots.com, messages in the Broski chat on the website, and contact details from the demo form. This entire policy applies to that data, including the rights described in chapter 15.

b) We are a processor of Conversation data. The controller of that data is the Customer: the Customer decides whom its agent calls, for what purpose, what it says, whether the call is recorded and how long it is kept. We provide the tool and process that data only to the extent necessary to provide the service and on the Customer’s documented instructions, in accordance with Article 28 GDPR and the data processing agreement (chapter 19).

In practice this means that if you are a Caller and want to exercise your rights regarding a call recording, the right addressee of your request is the business you were talking to, not BrosBots. Chapter 8 describes what we will do if you contact us anyway.

Providing data is voluntary, but account and billing data are necessary to conclude and perform the agreement: without them we cannot create an account or bill for the service.

Recordings and transcripts are among the most sensitive data on the Platform, so we treat them separately:

• Recording is switched on and off by the Customer. The Customer decides whether a recording is made at all and how long it is kept.
• Data is encrypted in transit (TLS 1.3) and at rest (AES-256) and stored on infrastructure located in the European Union.
• Recordings can be accessed only by authorised Users of the Customer’s organisation and - to the minimum extent necessary and at the Customer’s explicit request - by our support team, to diagnose a reported problem. Every such access is logged.
• We do not listen to recordings for marketing purposes, we do not share them with other Customers and we do not sell them to anyone.
• The content of a call passes through the speech recognition, language model and speech synthesis providers listed in chapter 9 - otherwise the agent could not respond.

The Customer’s obligations. The Customer is responsible for the lawfulness of recording and for informing the Caller. This covers in particular the information obligation under Articles 13 and 14 GDPR, the legal basis for the call itself (for direct marketing - consent under Art. 398 of the Polish Electronic Communications Law) and the obligation to disclose that the Caller is interacting with an artificial intelligence system under Article 50 of Regulation 2024/1689 (AI Act). Details are set out in the Terms of Service.

The Platform is not intended for processing special categories of data (Article 9 GDPR), such as health data. Calls in some industries - for example booking at a medical clinic - may nevertheless contain such data. If you plan such a scenario, you are responsible for having an appropriate basis under Article 9(2) GDPR and should contact us before launching the agent to agree additional safeguards in the data processing agreement.

We do not use voice recordings to identify people. We do not perform biometric speaker identification or verification, so a recording as such does not constitute biometric data within the meaning of Article 4(14) GDPR on our side.

If you talked to a voice agent running on our Platform, we process your data only on behalf of the business that deployed that agent.

1. Address requests for access, erasure or objection to that business - it is the controller and only it can decide on them.
2. If you do not know who it is, write to us at kontakt@brosbots.com. We will identify the Customer from the number and date of the call and forward your request to them without undue delay, and tell you where it went.
3. We will not delete a recording at your direct request without the Customer’s instruction, because as a processor we have no right to do so. This is not a refusal to honour your rights, only a pointer to the right addressee.

We use providers who process data on our instructions and are bound by data processing agreements. Their categories are listed below. The named list of subprocessors is part of the data processing agreement with the Customer (chapter 19), available after signing in to the dashboard, and we give notice of changes in accordance with that chapter.

If the Customer uses its own API keys (BYOK), conversation data goes to the provider the Customer has chosen under the terms of the Customer’s own agreement with that provider, and we are not a party to that relationship.

Data may also be disclosed to public authorities where the law requires it. We check every such request for its legal basis and scope, and inform the Customer about it unless the law prohibits this.

We store recordings and account data in the European Union. Some of the providers in chapter 9 are, however, based in the United States and processing may take place there - especially for language models and speech synthesis, where European regions are not always available.

• Transfers take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for providers that have joined it, or
• on the basis of standard contractual clauses (SCCs) together with a transfer impact assessment and additional technical safeguards, in particular encryption.

We provide a copy of the safeguards applied on request. A Customer who wants processing restricted to the EU only should contact us before deployment - not every agent configuration is available in that variant.

• We do not train our own models on Customers’ recordings and transcripts.
• Where the provider allows it, we use modes in which data sent through the API is not used to train its models. Not every speech recognition and synthesis provider offers such a mode in every configuration. We tell Customers how this works for individual providers on request.
• To develop the Platform we use aggregated, statistical data that does not allow a Caller to be identified or the content of a call to be reconstructed.
• If we ever wanted to use call content to train models, that would require the Customer’s separate, explicit consent and a change to this policy - it will not happen through a silent update.

A Customer may, on its own initiative, connect a Google or Microsoft account to the Platform in the Integrations tab of the app.brosbots.com dashboard, so that its voice agent can use the Customer’s calendar or spreadsheet. The connection uses OAuth: we never learn the account password, and the Customer approves the scope of access on Google’s or Microsoft’s consent screen. Where this sign-in option is available, Users can also sign in to the dashboard with a Google account. Integrations are optional - the Platform works without them.

• Storage. We store the refresh token and the email address of the connected account in the Platform’s database, on servers in the European Union, encrypted at rest. Short-lived access tokens are kept only in server memory. The token is never shown in full - the dashboard displays it only in masked form.
• Calendar and spreadsheet content. We do not make copies of calendars or spreadsheets. We fetch data at the moment the agent needs it, and the calendar events shown in the dashboard when the Customer views them. Whatever is said during a call (for example a proposed time slot) becomes part of the Conversation data and is subject to the retention periods in chapter 13. The pieces needed for a reply pass through the providers described in chapter 9, solely to conduct that call.
• Disconnecting and deletion. The Customer can disconnect the account at any time in the Integrations tab - we then delete the stored token and from that moment have no access to the account. Access can also be revoked directly with the provider: for Google at myaccount.google.com/permissions, for Microsoft at account.live.com/consent. When the agreement ends, we delete the tokens together with the account configuration (chapter 13).
• What we do not do. We do not sell this data, transfer it to data brokers or to third parties for their own purposes, or use it for advertising (including personalised advertising and retargeting), for determining creditworthiness, or to train artificial intelligence models - neither ours nor our providers’.
• Human access. No one on our team reads data from Google or Microsoft accounts unless the Customer explicitly asks for it as part of support, it is necessary for security purposes (for example to investigate abuse), it is required by law, or the data has been aggregated and anonymised for internal operations.

BrosBots’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Customer can shorten the retention period for recordings and transcripts at any time in the privacy settings in the dashboard; older data is then deleted automatically as part of a daily process. The Customer can also request earlier deletion by writing to us. Deletion from backups happens within their normal rotation cycle, which does not exceed 30 days.

End of the agreement. The agreement ends at the end of the paid billing period after the account is deleted in the dashboard (Privacy & data) or after termination. We then close the account: we release the numbers and stop calls, but the dashboard remains available for 30 days so the Customer can download recordings and transcripts. After that period we permanently delete recordings, transcripts, agent configuration, contacts, documents and the accounts of Users who do not belong to another organisation. We keep only the billing data required by tax law, without Users’ contact details.

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Provider API keys supplied by the Customer are encrypted in the database with a separate key and are never returned by the API in plain text.
• Role-based access control and data isolation between organisations.
• Logging of administrative events and access to recordings.
• Backups with retention of up to 30 days and restore tests.
• The principle of least privilege within the team and confidentiality undertakings covering everyone with access to data.

No safeguard gives a one hundred percent guarantee. In the event of a personal data breach we notify the President of the Personal Data Protection Office (UODO) within 72 hours where we are the controller, and where we are the processor we inform the Customer without undue delay so it can fulfil its obligations under Articles 33 and 34 GDPR.

For the data we control, you have the right to:

• access your data and receive a copy of it,
• rectify inaccurate or incomplete data,
• erasure of your data (the “right to be forgotten”),
• restriction of processing,
• portability of data processed on the basis of a contract or consent,
• object to processing based on legitimate interest, including analytics and direct marketing,
• withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal,
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

We accept requests at kontakt@brosbots.com and handle them without undue delay, and within one month at the latest. If needed, we may ask for additional information to identify you - solely so as not to hand your data to an unauthorised person.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

The voice agent conducts the conversation automatically and may, based on it, perform an action set up by the Customer, for example booking an appointment. The configuration and effects of such an action are determined by the Customer as the controller. Sentiment and topic analysis of calls, available in higher plans, is used for statistics and does not lead to automated individual decisions on our side.

The brosbots.com website does not use cookies. In the browser’s session storage (sessionStorage) it saves only what the features you use require: your conversation with the Broski chat, whether you dismissed its invitation, and the page scroll position. This data disappears when you close the tab. Website analytics runs in cookieless mode, which is why we do not show a consent banner. The app.brosbots.com dashboard uses cookies necessary to maintain the session. Without your consent, PostHog product analytics in the dashboard collects only basic statistics and stores nothing on your device; cookies, localStorage data, heatmaps and session recordings are enabled only after you consent in the dashboard banner. You can withdraw consent at any time in the Privacy & data tab. The full list, purposes and retention periods, as well as a switch that turns off website analytics, are in the cookie policy.

The Platform is intended for businesses and is not directed at persons under 16. We do not knowingly collect such persons’ data as controller. If a Caller turns out to be a minor, the obligations relating to their data rest with the Customer as controller.

For Conversation data we use a data processing agreement compliant with Article 28 GDPR, which forms an integral part of the agreement with the Customer. Its text, together with the current list of subprocessors, is available after signing in to the dashboard, and we provide a copy signed by both parties on request. In it we undertake in particular to:

• process data only on the Customer’s documented instructions,
• ensure confidentiality on the part of persons authorised to process data and apply the security measures required by Article 32 GDPR,
• use subprocessors only after informing the Customer in advance, with the right to object within 14 days of the notice,
• assist the Customer in responding to data subject requests and with its obligations under Articles 32-36 GDPR,
• delete or return data after the end of the provision of services, as the Customer decides,
• make available the information necessary to demonstrate compliance and for audits.

We update this policy when the way we process data, the set of providers or the law changes. The date of the last change is shown at the top of the page. We notify Customers of changes material to them in advance, by email or by a message in the dashboard, no later than 14 days before they take effect.

For all matters concerning personal data protection: kontakt@brosbots.com. The rules for using the Platform are set out in the Terms of Service.

This page is an English translation of the Polish Polityka prywatności, published for information purposes only. Only the Polish version is legally binding. In the event of any discrepancy between the two versions, the Polish version prevails.