Skip to content
Dialzen
Start free

Privacy Policy

Last updated Oct 20, 2026

Overview

This policy explains what data Dialzen collects, why, who processes it on our behalf and what control you have over it. It covers two groups of people: our customers (the businesses that use Dialzen and their team members) and the people our customers call or who call them. We collect only what is needed to run the service.

Our role and our customers' role

For your account, your workspace and how you use Dialzen, we decide how the data is used, so we are the controller.

For the contacts, call recordings, transcripts and other data about the people a business calls or is called by, the business (our customer) is the controller and decides why and how those people are contacted. We act as a processor on its behalf: we store and process that data only to provide the service the business asked for, following its settings and instructions. If you were called by a business through Dialzen, the business's own privacy notice applies to you, and you should contact the business first. The section "If you received a call" below explains how to reach us too.

Account data

When you create an account we store your name, email address and a securely hashed password, your language preference and your plan. Payments are handled by our payment providers; we receive the payment status and a reference, never your full card number.

Workspaces and team

We store the workspaces you create or join, the members and their roles (owner, admin, editor or viewer), invitations, notification channels (for example an email address, a Slack, Microsoft Teams or Discord webhook address, or a Telegram bot token) and an activity history. API keys are stored as a one-way hash; we can't read them back.

When a workspace asks for outbound calling, we also store the business details provided in the verification (KYC) form and the acceptance of our acceptable use rules, and we keep a record of our review decision.

Agents and knowledge base

We store each agent's settings: its instructions (prompt), first message, voice, language, tools and the fields it should collect after a call. Knowledge-base documents (uploaded files, the text of web pages you add by address, and text you paste) are stored by us and sent to the voice provider so the agent can use them during calls.

Tool settings can include credentials, such as a Cal.com API key, a webhook secret or a connected Google account used to book appointments or add rows to a spreadsheet. They are stored encrypted (AES-256-GCM) and only used to run the tools you configured.

Contacts and consent records

Businesses can add contacts by CSV upload, through the API or by hand: typically a name, phone number, time zone and any custom fields the business chooses. With each contact, a business can store a consent record: the type of consent, its purpose, where and when it was given (source address, date and time, IP address) and a copy of the consent text shown at the time. These records help the business show that it had permission to call.

The business is responsible for having a lawful basis to upload its contacts and to call them.

Calls, recordings and transcripts

AI disclosure. Callers are told at the start of every call that they are speaking with an AI assistant. This message is part of every agent's first message and can't be removed.

For each call we store the phone numbers involved, the time, duration, direction, outcome, cost and the agent and campaign it belongs to. We also store:

  • Transcripts of what was said by the caller and the agent.
  • Recordings, only when recording is turned on for the agent. Recording is optional and set per agent. When it is on, a recording notice is played at the start of the call. Recordings are copied from the voice provider to the storage chosen by the operator of this platform: our own server's disk, S3-compatible object storage (for example Amazon S3 or Cloudflare R2) or Vercel Blob.
  • Post-call analysis: a short summary, the caller's sentiment, whether the call reached its goal, and the details the business asked the agent to collect (for example a preferred appointment time). This analysis is produced by the voice provider or by the AI provider chosen by the operator.

Recordings and transcripts are kept according to each workspace's settings. A workspace can set a retention period, after which recordings and transcripts are deleted automatically; the call's summary and extracted details stay until the business deletes them.

Website voice widget and browser calls

A business can add a "Talk to us" voice button to its own website. Until a visitor clicks it, the widget only loads its public settings (button text, colour and position); it sets no cookies and stores nothing in the visitor's browser. When the visitor starts a call, the browser asks for permission to use the microphone, the visitor is told that they are speaking with an AI assistant (and that the call is recorded, when recording is on), and the audio goes to the voice provider that runs the agent.

Widget calls are stored like phone calls, in the business's workspace: the transcript, the summary, the details collected and, when recording is on, the recording, together with the website the call came from. The widget only works on the websites the business allows. Test calls that team members make from the dashboard in their browser work the same way.

Opt-outs and do-not-call lists

When someone asks not to be called again, during a call or in any other way, the number is added to the workspace's do-not-call list and is skipped by every future campaign. Businesses can also upload their own do-not-call lists, and we keep a platform-wide list for numbers that asked us directly.

An opt-out is kept even after the workspace or the contact is deleted, so that the number isn't called again. We keep only what is needed for that: the phone number, the date and where the opt-out came from.

If you received a call

If a business called you through Dialzen and you don't want to be called again:

  • Say so during the call (for example "please don't call me again"). The agent is instructed to accept the request and end the call, and the number is added to that business's do-not-call list.
  • Contact the business that called you. The agent gives the business's name at the start of the call.
  • Or write to us at support@example.com with your phone number. We will add it to our platform-wide do-not-call list, so no business on Dialzen calls it, and we will pass any other request (for example access to or deletion of a recording) to the business concerned.

Sub-processors

We don't sell data and don't share it with advertisers. We share only what is needed with the services that help us run Dialzen. The operator of this platform chooses which of them are used:

  • Voice provider (ElevenLabs and/or Retell AI), which runs the live call: it receives the agent's settings and knowledge base, the audio of the call and the phone numbers, and returns the transcript, recording and analysis.
  • Telephony carriers (for example Twilio, SIP trunk providers or Exotel), which connect the calls to the phone network.
  • AI provider (an OpenAI-compatible API or Anthropic), used for the prompt assistant and, when the voice provider doesn't provide it, for the post-call analysis of transcripts.
  • Payment providers (Stripe, PayPal or Razorpay) for plans and credits.
  • Email provider for account emails and notifications.
  • Hosting, database and media storage providers that store the data, recordings and documents.
  • Calendar and spreadsheet services (Cal.com, Google Calendar, Google Sheets) and webhooks that a business connects as agent tools; they receive the details the agent sends them, such as a booking.
  • Notification destinations that a business configures (email, Slack, Microsoft Teams, Discord, Telegram or its own webhook), which receive the alerts and call results it asked for.

How long we keep data

  • Account and workspace data: while the account exists.
  • Recordings and transcripts: according to the workspace's retention setting, or until the business deletes them or the workspace. Summaries and extracted details stay until the business deletes them or the workspace.
  • Contacts and consent records: until the business deletes them or the workspace. Businesses may need to keep consent records for several years to prove consent; they decide how long.
  • Opt-outs: kept even after deletion, as described above.
  • Audit log (consent checks, do-not-call checks, dial times, disclosures and opt-outs): append-only, so the business can show how each call was made. It is kept after a workspace is deleted, so that complaints about calls made through Dialzen can still be answered.

When you delete your account or a workspace, its data is deleted, except opt-outs, the audit log and what we must keep by law (for example invoices).

Security

Passwords are hashed, connections are encrypted, provider keys and tool credentials are stored encrypted with AES-256-GCM, API keys are stored as hashes and access to our servers is restricted. Webhooks from voice providers are checked with a signature before they are accepted. No system is perfectly secure, but we work hard to protect your data.

Your rights

Customers can see and change their details at any time from their account page, export calls and contacts as CSV and ask us to delete their account. People who were called by a business can ask that business, or us at support@example.com, to stop calling them, and to access or delete their data; we will pass requests about a business's calls to that business. Depending on where you live you may have further rights (for example under the GDPR, including the right to object to direct marketing at any time); contact us to use them.

Cookies

We only use cookies that are needed for the service to work:

  • tz_session keeps you signed in (up to 30 days).
  • tz_lang remembers the language you chose (1 year).
  • dz_ws remembers the workspace you used last (1 year).
  • dz_oauth is a short-lived security value (protection against cross-site request forgery) while you connect a Google account for the calendar or spreadsheet tools. It expires after 15 minutes.

Your choice in the cookie notice is saved in your browser's local storage as dz-cookie-consent, and your light or dark theme choice as tz-theme. Local storage is not a cookie and is never sent to our server. The website voice widget sets no cookies at all. We don't use advertising or third-party tracking cookies.

Changes

We may update this policy. For important changes we will let customers know by email.

Contact

For privacy questions, or to be added to our do-not-call list, contact us at support@example.com.