This notice explains how Echo Calls handles personal data: the data of people who call a business that uses Echo Calls, of the businesses and staff who use our service, and of visitors to our website. It is written for Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations. It is published in Arabic and English; if the two differ, the Arabic text prevails.
In short
- Every call starts with the assistant saying that the call is with an AI assistant answering for the business.
- If the business you call records its calls, the business tells you that its calls are recorded. The business can listen to the recording, which is deleted automatically 90 days after the call. If it does not record calls, your voice is turned into text as you speak and the audio is not stored.
- The business you called receives a written transcript and a summary of the call. Both are deleted automatically 90 days after the call.
- The business may send details of your call or booking to other tools it uses (such as its calendar, a spreadsheet or its customer system).
- To book, the assistant needs only your name, a phone number, and the service and time you want.
- We do not sell personal data, do not use it for advertising, and do not use your calls to train AI models.
1. Who we are, and who is responsible for your data
Echo Calls gives businesses that take calls and bookings, such as restaurants, salons, clinics and customer-service teams, an AI receptionist that answers their callers through a call link, answers from the business's own information, and books appointments where the business offers them.
- When you call a business: the business is responsible for your data (the controller, under the Law). Echo Calls processes the data on the business's behalf and on its instructions (the processor), under a written data-processing agreement. The business's name is said at the start of the call.
- For the businesses that use Echo Calls, their staff, and visitors to our website: Echo Calls is responsible (the controller).
Contact: support@echocalls.ai · Website: echocalls.ai
2. If you call a business through Echo Calls
2.1 What we collect
- Your voice. During the call it is turned into text as you speak. If the business records its calls, the call's audio, your voice and the assistant's, is also recorded and kept (section 2.7). If it does not, the audio is not stored.
- What is said on the call, as text: the transcript of what you and the assistant said, a summary of the call, and the details the assistant uses to answer you (for example, searches of the business's information).
- The booking details you give: your name, the phone number you want to be reached on, the service, and the day and time; and, if you ask to cancel or move a booking, the details of that request.
- Call details: when the call started and ended, how long it lasted, and its outcome (for example, "booked").
- The call's language: the language the call ended in.
- A request to be called back: if you ask the business to call you back, the request and the number you want to be called on.
- Your booking ticket on the call page: after a booking is made or moved, the call page shows you a ticket for it, which you can add to your calendar or share on WhatsApp yourself; your browser does this, and we do not send the ticket anywhere.
- Technical data: to protect the service from abuse, we count how often each internet connection starts calls, using a coded (hashed) form of your internet address instead of the address itself. Our security systems also see your internet address briefly to limit excessive requests, and record it in security logs if your connection exceeds those limits. The call page keeps your language choice in your browser, and a short "call in progress" marker in that browser tab. It does not use cookies or analytics.
- We do not collect the number of your phone line: a call through a call link is made from your browser.
2.2 If you call a clinic or another business that provides health services
Some businesses that use Echo Calls, such as clinics, provide health services. To book an appointment there, the assistant needs only your name, a phone number, the service and the time. You do not need to tell it about symptoms or medical history. If you choose to, those words become part of the transcript the business can read, and they are deleted with it after 90 days. They are not added to the booking, and they are not included in the booking emails the business receives; those carry only the name of the service booked. The Law treats health information as sensitive data; the business is responsible for having a lawful basis to process it, including any consent the Law requires.
2.3 Why we use it
- To answer your call on the business's behalf: to give you the business's information, and to book, move or cancel an appointment when you ask.
- To let the business see and follow up on your call and your booking. The business receives an email for each new, changed or cancelled booking, with your name and phone number.
- To keep the service secure, prevent abuse, count call minutes for the business's plan, and fix problems.
- To keep a recording of the call for the business, if it records its calls (section 2.7).
- To send details of your call or booking to the tools the business has connected (section 2.8).
We process this data because it is needed to carry out what you ask for on the call (such as a booking), for the business's legitimate interest in answering its calls and keeping an accurate record of them, and to meet legal obligations. A call is recorded only when the business records its calls, and the business tells its callers that its calls are recorded. If you do not want it recorded, you can end the call. The business you called remains responsible for having a lawful basis for its use of your data, including the recording, and for any consent the Law requires.
2.4 Who can see it
- The business you called, in its Echo Calls workspace, including listening to and downloading the call's recording if it was recorded. Each business sees only its own calls and bookings.
- Echo Calls staff, only when needed to run, support or secure the service, under a duty of confidentiality. Our staff open a call recording only to support the business or to deal with a security incident, and each opening is written to our audit log.
- The tools the business has connected, only for what each connection needs (section 2.8).
- Public authorities, where the law requires it.
2.5 How long we keep it
| Data | Kept |
|---|---|
| Call recording (if the business records its calls) | Deleted automatically 90 days after the call, and earlier if the business deletes the call or stops using Echo Calls. If the business does not record its calls, no audio is stored at all |
| Transcript, summary, written call analysis, booking change requests, and requests to be called back | Deleted automatically 90 days after the call |
| Call details without what was said (time, length, outcome and its labels, minutes) | While the business uses Echo Calls |
| Bookings (name, phone, service, time) | As the business's appointment records, while it uses Echo Calls; we erase a booking earlier when the business asks |
| The log of what was sent to the tools the business connected (the kind of event, when, and whether it arrived; not the content) | 30 days |
| Coded records of booking checks a caller makes by themselves (a code derived from the phone number, not the number itself) | While the business uses Echo Calls, to apply limits and to let changes be undone |
| Counters linked to the coded internet address | From one minute to about one hour |
| Answers from the business's own system when the assistant looks something up during a call (only the fields the business chose to use) | Up to 15 minutes in our cache, then deleted automatically |
| Security logs (the internet address of a connection that exceeded request limits) | Overwritten automatically as newer technical logs replace them |
| Encrypted backups | Data deleted from the service can remain inside our encrypted backups until those backups are deleted: we keep daily and monthly backups for up to about six months, and the last five backups taken before each kind of maintenance until newer ones replace them. Call recordings are not copied into these backups |
When a business stops using Echo Calls, its data is deleted as set out in our agreement with it.
2.6 Children
Echo Calls is not designed for children. If you call for a child, for example to book their appointment, you should be the child's parent or legal guardian, and share only what the booking needs.
2.7 Call recordings
- When a call is recorded: each business that uses Echo Calls chooses whether its calls are recorded. When it records them, the business tells its callers that its calls are recorded (section 2.3). When it does not, no audio of the call is kept.
- What is recorded: the audio of the whole call, your voice and the assistant's, as one recording. Our own call server makes it; no other company records the call.
- Why: so the business can listen back to its calls: to check what was said, follow up a request or a booking, settle a disagreement about the call, and check the assistant's work. We use a recording only to provide the service to the business, and to look into a problem with a call when the business asks us to.
- Where it is kept: in a private storage space set to the European Union, where everything stored is encrypted. It is not public: a recording can be played only through a link our server makes for one request, which stops working within 5 minutes.
- Who can listen: the signed-in users of the business you called, who can also download it. Echo Calls staff open a recording only when needed to support the business or to deal with a security incident, and each opening is written to our audit log.
- How long: deleted automatically 90 days after the call, like the transcript, and earlier if the business deletes the call or stops using Echo Calls. Recordings are not copied into our backups. A copy the business downloads is the business's own copy, which it must keep securely and delete when it no longer needs it.
- Your choices: if you do not want your call recorded, you can end the call and contact the business another way. You can ask the business, or us, for a copy of the recording of your call or for its deletion (section 6).
- We do not use recordings to train AI models, and we do not use them to recognise you by your voice.
2.8 Tools the business connects
A business can connect Echo Calls to tools it already uses. Details of your call or booking then reach those tools too, on the business's instructions. The business chooses each tool, and the tool handles your data under the business's own arrangements with it. What each connection receives:
- The business's calendar (Google Calendar): your booking (the service and the time, and the name and phone number on the booking) is written into the business's own calendar, and we read that calendar's busy times so the assistant offers only free times. No invitation is sent to you.
- A spreadsheet (Google Sheets): a row for each booking and each call, with the name and phone number on the booking and, if the business chooses, the call summary. Never the transcript.
- The business's customer system (such as HubSpot or Zoho CRM): a contact with your name and phone number, a note of the call, your booking as a meeting or event, and, if the business chooses, the call summary.
- Addresses the business gives us (webhooks), and tools such as Zapier, Make or n8n: a message when a call ends, when its summary is ready, and when a booking is made, moved or cancelled. It can include your name, phone number and the call summary if the business chooses. It never includes the transcript, or the reason for a booking.
- The business's own systems, through our API: with a key the business creates, its systems can read its calls, their transcripts and its bookings, and make, move or cancel bookings, as its users can in the workspace.
- Look-ups in the business's own system: if the business sets one up, the assistant can look something up for you during the call (for example, the status of an order). We send what you give for it (such as an order number) to the business's system, and the assistant tells you only what comes back. We do not store what was sent. Of the answer, we keep only the fields the business chose to use, in our cache for at most 15 minutes, and then they are deleted automatically.
The business's administrators switch on each connection, and can switch it off at any time. We send each tool only what its connection needs, over encrypted connections, and keep a log of what was sent and whether it arrived for 30 days, without the content.
3. If your business uses Echo Calls
3.1 What we collect
- Account: your email address and password (we never see your password), or your Google name and email if you sign in with Google; your name; and your phone number, if you give it.
- Business: the business name, city and working language; the version of our terms and of this notice you accepted, and when; and how you signed in.
- What you put into the service: business information, services, opening hours, the documents you upload (we keep the text extracted from them, not the original file), bookings, and your settings.
- Use and billing: your plan and its add-ons, the call minutes used, the max overage per month (which your admins raise or lower), the usage alerts we send to your workspace admins, and records of decisions on your account by our staff and your admins (such as activation, a change to the recording setting, or our staff setting your account to no overage maximum), kept for accountability.
- Tools you connect: what your workspace admins connect: the connected account's name and its access tokens (stored encrypted), webhook addresses and their secrets (encrypted), API keys (we keep only a coded form), and the settings of lookups in your own system (any login for it encrypted). When you connect Google Calendar or Google Sheets, we use the access you grant only to read and write the calendar or sheet you chose, for your bookings and calls; we do not use Google data for advertising or to train AI models, and no one reads it except as needed for support, security or the law.
- Security: a security check runs when you sign up and sign in. Your sign-in is kept in your browser's local storage; we do not use cookies.
3.2 Why we use it
To create and secure your account, review and activate your business, provide and support the service, answer your callers from your information, send you service emails (booking notifications, usage alerts and account decisions), run the tools you connect, invoice you, and meet legal obligations. We process it to perform our contract with your business, for our legitimate interest in running a secure service, and to comply with the law. We do not send marketing messages without your consent.
3.3 How long we keep it
While your business uses Echo Calls. If we decide not to activate a business, its data is deleted 30 days after the decision, except the record of the decision itself. When you stop using Echo Calls, we delete your data as set out in the terms of service, keeping only what the law requires us to keep (such as billing records).
4. If you visit our website or write to us
Our website uses no cookies, analytics or tracking, and loads nothing from other companies. It remembers your language choice in your own browser. The contact form has two buttons: one opens WhatsApp and the other opens your own email app, each with your details written in a message; it sends nothing to us by itself. When you message us on WhatsApp or by email, we use your message and your number or address to reply and to arrange a demo, and keep them for as long as that needs. WhatsApp handles its messages under its own terms.
5. How we protect data
- Encrypted connections (TLS) for the website, the console, call links, email and recording storage; an encrypted server disk; encrypted backups.
- Only Echo Calls administrators can reach the servers, with secure key sign-in; staff accounts with administrator rights need two-step verification.
- Each business can see only its own data.
- We keep personal details out of our technical logs: phone numbers are masked, and what callers say is not written to logs. The one exception is the internet address of a connection that exceeds our request limits, which security logs record.
- Call recordings are kept in a private storage space in the European Union, encrypted at rest, reachable only through short-lived links our server makes for each request, which stop working within 5 minutes; each time our staff open a recording is logged. If a business turns recording off, no audio of its calls is captured.
6. Your rights
Under the Law you have the right to: know what personal data about you is held, see it and get a copy; withdraw your consent where processing relies on it; have your data corrected, edited, completed, updated or erased; limit processing to a specific purpose; be told of any breach of your data; and object to processing that conflicts with your fundamental rights and freedoms. These rights cover call recordings too: you can ask for a copy of the recording of your call, or for its deletion.
How to use your rights: email support@echocalls.ai. If your request is about a call you made to a business, you can also contact that business directly; we will work with it, because it decides about its callers' data. To protect you, we may ask for details that confirm the request is yours (such as the business's name, the day and time of the call, and the name and phone number on the booking). We, or the business, reply within six working days.
If you are not satisfied with our reply, you can complain to Egypt's Personal Data Protection Center.
7. Data breaches
If a breach affects your personal data, we tell the business concerned straight away; the Personal Data Protection Center is notified within 72 hours, and you are told what happened and what has been done, as the Law requires.
8. Changes to this notice
We publish any new version on this page with a new version number and date. If a change materially affects business accounts, we tell those businesses in advance and ask them to accept the new version.
9. Contact
Echo Calls · support@echocalls.ai · echocalls.ai