Privacy Policy.

Which services does this policy cover?

This policy covers all Heedify services and applications:

• Heedify Microsoft Teams applications (Contact Center, Attendant Console, Agent Console)
• Heedify AI Receptionist, our AI voice agent that answers calls in Microsoft Teams Phone
• Heedify admin portal, including reporting
• Heedify website (https://www.heedify.io)

Our role: controller or processor

Heedify is the data controller for the data of people who visit our website, contact us, and for the account data of our customers' users.

Heedify is a data processor (Article 28 GDPR) for the data processed inside our services on behalf of our customers, in particular call data, recordings, transcriptions and the data handled by the Heedify AI Receptionist. In that case our customer (the organisation using Heedify) is the data controller and decides how the service is configured. A Data Processing Agreement (DPA) is available to every customer.

If you called an organisation that uses Heedify and want to exercise your rights, you can contact that organisation directly or write to us, and we will help them answer you.

What information we collect and where it comes from

Identity and access in the apps

When an Office 365 administrator signs up for Heedify, they consent to the Microsoft Graph permissions of the Heedify app. Heedify relies entirely on Microsoft Entra ID (formerly Azure Active Directory) for identity management. We never access, collect or store passwords. The user data we use comes from Microsoft Entra ID and Microsoft 365:

• First and last name
• Email address
• Language
• Phone number
• Presence and, where the customer enables it, calendar availability, used to route calls to the right person

Call center and telephony data

When our customers use Heedify for their calls, we process data about the people who call them and the employees who answer:

• Caller phone number and call metadata (date, time, duration, queue, routing outcome)
• Audio recordings and transcriptions of conversations, only when explicitly enabled by the customer
• Notes and messages entered by employees

Heedify AI Receptionist

When a customer turns on the Heedify AI Receptionist, the AI agent answers calls, understands the caller's request and transfers the call, or a structured message, to the right person in Microsoft Teams. To do this it processes:

• The caller's voice, in real time, so the agent can understand and reply
• The transcription of the conversation
• The detected language of the caller
• What the caller says about themselves and their request: name, company, reason for calling, message, and any other information they choose to share
• The handover card sent to the employee in Microsoft Teams (caller name, number, intent, summary)
• The routing decision taken by the agent and the call metadata

This data comes from the caller themselves, during the call, and from our customer's Microsoft 365 directory (for the names, presence and availability of the people calls can be routed to). The caller's voice is not used to identify them: we do not create voiceprints.

Website interactions

When you browse our website, your browser shares information such as its version and your operating system. We record it, along with the pages you visit, load times and the referring website, for statistics such as conversion rates. These analytics are linked to your IP address. Google Analytics and LinkedIn tracking code are used for this, only after your consent through the cookie banner. When you fill in a form, we receive the data you enter (name, company, email, phone, message).

Information we do not collect

We do not collect special categories of data such as racial or ethnic origin, religion, sexual orientation, health or biometric data. Callers may still mention such information spontaneously during a call; it is then processed only as part of the call and never analysed for those characteristics.

Artificial intelligence in Heedify

Some Heedify features use artificial intelligence: the Heedify AI Receptionist, and, when enabled, transcription, call summaries and call classification in the contact center. Here is how we use it.

• Technology. Our AI features run on Microsoft Azure OpenAI Service (GPT Realtime models), deployed through Azure AI Foundry in the Sweden Central region, in the European Union. Azure AI Foundry content filters and our own safeguards (scope limits, instructions and checks on what the agent can say and do) are applied to every conversation.
• No training on your data. Calls, transcriptions and messages are never used to train AI models, neither by Heedify nor by Microsoft. Microsoft does not share them with OpenAI.
• Abuse monitoring. As part of Azure OpenAI Service, Microsoft may temporarily store prompts and responses, within the same geography, for up to 30 days, only to detect and prevent abuse of the service.
• Transparency. The Heedify AI Receptionist tells callers at the start of the call that they are speaking with an AI agent. The caller can ask to speak with a person at any time.
• Customer control. AI features are optional. They are turned on and configured by the customer's administrator, who can turn them off at any time; calls are then handled by the usual Teams routing and by people.
• Automated decisions and profiling. The AI agent decides where to route a call and what message to pass on. It does not take decisions that have a legal or similarly significant effect on the caller, and it does not build profiles of callers. A person can always take over the conversation.

AI can make mistakes. Answers and summaries produced by the agent are designed to help employees, who remain in charge of what happens next.

Purposes of processing

We process personal data to:

• Authenticate users and manage access
• Provide the service and support
• Answer, qualify and route calls, including with the Heedify AI Receptionist when enabled
• Record, transcribe and analyse calls when the customer requests it
• Monitor and improve the performance and security of the product
• Measure website usage and conversions
• Comply with legal and regulatory obligations

Legal bases for processing

We rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): providing our services to our customers and their users
• Legitimate interests (Art. 6(1)(f)): improving and securing our services, and, for our customers, answering and routing incoming calls efficiently, including with AI
• Consent (Art. 6(1)(a)): analytics cookies, and call recording where local law requires the caller's consent
• Legal obligation (Art. 6(1)(c)): complying with legal requirements

For call data, the customer, as data controller, chooses the legal basis that applies to its own processing and informs its callers accordingly.

Sharing of personal data

We do not sell personal data. We share it only with:

• Subprocessors: Microsoft (Azure hosting, Azure OpenAI Service and Azure AI Foundry, Microsoft Teams and Microsoft Graph) for the services; Google Analytics and LinkedIn for the website
• Our customers' administrators, when the service is provided under a business contract
• Authorities, only when required by law

All subprocessors are bound by data processing agreements with confidentiality and data protection obligations. The up to date list of subprocessors is included in our DPA and available on request.

Where your data is hosted and international transfers

Customer data processed by our services, including AI processing, is hosted in Microsoft Azure datacenters in the European Union (European Economic Area). The Heedify AI Receptionist uses the Azure Sweden Central region. Customers outside Europe can ask for hosting in another region; in that case the region is set out in their contract.

Our website analytics providers (Google, LinkedIn) may process data in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses (Article 46 GDPR). Our agreements with Microsoft also include the Standard Contractual Clauses.

How long we keep data

• Account and usage data is kept for up to 365 days, unless otherwise agreed in the contract.
• Call recordings, transcriptions and AI Receptionist conversation data (transcripts, handover cards, messages) are kept according to the customer's configuration, and typically no longer than 6 months.
• Data temporarily held by Microsoft for Azure OpenAI abuse monitoring is deleted after at most 30 days.
• After a contract ends, customer data stays available for 90 days, then it is deleted.
• Website analytics data is kept according to the retention settings of each tool.

Your rights

Heedify applies the same rights to everyone, wherever they are. These are the rights granted by the European General Data Protection Regulation (GDPR), within the limits of applicable law:

• Right to be informed. You have the right to clear information about how your data is used. This policy is how we inform you.
• Right of access. You can obtain a copy of the personal data we hold about you, and information about how it is used, shared, stored and secured.
• Right to rectification. You can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"). You can ask us to delete your data, and by extension to have our subprocessors delete it, within the limits set by law. Deleting some data can stop our applications from working; in that case it may mean closing your account.
• Right to restriction of processing. You can ask us to limit how your data is used.
• Right to data portability. You can receive your data in a structured format and have it sent to another party.
• Right to object. You can object to processing based on our legitimate interests, and at any time to direct marketing.
• Rights related to automated decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. As explained above, our AI agent does not take such decisions, and you can always ask to speak to a person.
• Right to withdraw consent at any time, where processing is based on consent.

To exercise your rights, write to privacy@heedify.io. Some rights can also be exercised directly in the product or through the unsubscribe link in our emails. We answer every request within one month. For call data processed on behalf of a customer, we pass your request on to that customer and help them answer it.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection authority, in particular in the country where you live or work. In France, the authority is:

CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Phone: +33 1 53 73 22 22
Website: https://www.cnil.fr

To find the authority in another EU country, see the list of the European Data Protection Board members.

How we secure your data

Heedify is certified ISO/IEC 27001:2022. Security is built in from code to network to daily operations.

• Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256, including database backups, recordings and transcriptions.
• Development follows secure coding practices such as the OWASP guidelines, with code review, dependency audits and security alerts.
• Access to customer data is limited to authorised staff, on a need to know basis.

Changes and questions

We may update this policy to comply with regulations or reflect new practices. When we make a significant change, we tell our customers and publish it here, with a new update date.

Questions about this policy? Write to privacy@heedify.io.

Identity and contact details

Data controller:
Heedify EURL (formerly Ocircle EURL)
R.C.S Paris 835 168 741
10 rue de la Paix, 75002 Paris, France
Email: privacy@heedify.io

Data Protection Officer (DPO):
You can contact our DPO directly at dpo@heedify.io.