Privacy statement

1. Who we are

callnorah.com ("we", "us") is a trade name established in the Netherlands and can be reached at info@belnoor.nl. We provide an AI-driven telephone assistant ("Katie") that answers calls, books appointments and sends summaries on behalf of our business customers.

For the calls Katie handles on behalf of your business, you (the customer) are the controller and we are the processor. For your account, billing and marketing communications, we are the controller.

2. What data we process

• Account data: name, email address, phone number, company name, Chamber of Commerce number, billing address.
• Configuration data: opening hours, instructions for Katie, knowledge base content, and the names and phone numbers of regular contacts that you enter yourself.
• Call data: recordings, transcripts, call duration, caller ID and metadata of incoming calls.
• Integration data: OAuth tokens and calendar data (only if you connect a calendar).
• Request data: if you request a demo call or ask Katie to call you back, we store your name, phone number and the time of the request, plus the call that follows.
• Usage and log data: IP address, browser type, pages visited, error messages.
• Source data: when you sign up, we store the channel through which you reached our website (for example a search engine, LinkedIn or a link in an email), any campaign, and the first page you saw. No IP address and no search query. We use this to know which channels bring in customers.
• Payment data: processed by our payment provider Stripe; we only receive the status of your subscription and payments, never your full account or card number.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the service, billing, support.
• Legal obligation (point (c)) — tax record-keeping, fraud prevention.
• Legitimate interest (point (f)) — security, product improvement, limited direct contact with customers, and following up a demo request or callback request you made yourself.
• Consent (point (a)) — marketing emails, optional cookies, calendar connection.

4. Sub-processors

We use carefully selected processors with data processing agreements and (where necessary) standard contractual clauses:

• Our hosting and database provider — hosting, database, server functions and authentication (EU).
• Our provider of speech technology and real-time conversational AI — speech recognition, speech synthesis and conducting the call (EU/US, standard contractual clauses apply).
• Our email provider — sending the summary and appointment confirmation emails (EU region).
• Our telephony provider — routing of incoming and outgoing calls (EU).
• Google — only if you connect a Google Calendar yourself; see section 5.
• Microsoft — only if you connect an Outlook/Microsoft 365 calendar yourself.
• Calendly — only if you connect your Calendly account yourself.
• Stripe — payments and subscriptions (EU/US, standard contractual clauses apply).
• PostHog — visitor statistics for this website (EU); see section 10.
• Meta Platforms — advertising measurement, only after your consent in the cookie notice; see section 10.

The current list of sub-processors, including their names, country of establishment and processing purpose, is available on request at info@belnoor.nl and forms part of the data processing agreement. We inform customers in advance of any changes to this list.

5. Google user data (Google API Services)

If you connect a Google Calendar, callnorah.com asks for access to your calendar via the Google consent screen (scope https://www.googleapis.com/auth/calendar) plus your name and email address (openid, email, profile) to show which account is connected. We use that access exclusively for two visible functions in the product: (1) reading free/busy times so that Katie only offers available times, and (2) creating, rescheduling or cancelling an appointment in the calendar you select.

• We store the OAuth tokens encrypted, plus the selected calendar ID and the appointments Katie has created herself.
• We make no permanent copy of your full calendar and do not use calendar data for advertising, profiling or resale.
• We do not use Google user data to train AI or machine learning models.
• No person at callnorah.com reads your calendar data, except with your explicit consent (for example for support), for security purposes, or where required by law.
• You can disconnect at any time via Settings → Connections or via myaccount.google.com/permissions. When you disconnect, we delete the tokens immediately.

Who we share Google user data with

We share Google user data exclusively with the following three processors, and only to the extent necessary to provide the functions described above:

• Our hosting and database provider — hosting, database and server functions, EU region. This is where our application runs and where your OAuth tokens are stored encrypted, together with the calendar ID you selected and the appointments Katie has created herself (date, time, subject and the caller's contact details).
• Our provider of speech technology and real-time conversational AI — EU/US region (standard contractual clauses). During an active phone call, this provider receives the available time slots from your calendar (free/busy times, without the content of existing appointments) and the details of the appointment just created, rescheduled or cancelled. This is necessary so that Katie can read those times out to the caller and confirm the appointment.
• Our email provider — email delivery, EU region. The details of the appointment made (date, time, subject, location and contact details) appear in the confirmation and summary email sent after the call to you and, where applicable, to the caller.

We name these parties here by function and region. The names of the providers involved are available on request at info@belnoor.nl and are listed in the data processing agreement.

We do not share Google user data with anyone else. We do not sell this data and do not pass it on to advertisers, advertising networks, data brokers, information resellers or parties that use it to train AI or machine learning models. We do not use Google user data ourselves for advertising, profiling or model training either. Disclosure to other parties only takes place where required by law, or with your explicit prior consent.

Google user data and AI models

The content of your calendar never goes to a language model. When Katie checks during a call whether there is room, our server reads your calendar and calculates the free time slots itself. Only those free time slots — a start time and a description such as “Tuesday at 10:00” — are passed to the language model. Titles, attendees, descriptions, locations and the details of your existing appointments are not sent along: the model gets to see when you are free, not what fills your busy time.

The only place where the titles of your appointments are retrieved is your own calendar overview in the portal. That data goes directly to your screen and does not end up in a call, a prompt, a transcript or a model.

Apart from the voice assistant, we use language models for two things that have nothing to do with your calendar: summarising public information from a company website during onboarding, and a spoken daily overview. That daily overview receives only counts — how many calls, how many callback notes, how many appointments — and not a single line from your calendar.

We do not retain Google user data to develop, improve or train AI or machine learning models — neither our own nor general models. We also make no copy of your calendar. What we do retain is limited to: (1) the encrypted OAuth tokens, (2) the calendar ID you selected, and (3) the identifiers and metadata of the appointments Katie has created herself (appointment ID, date, time, subject, location and the contact details the caller provided), so that those appointments can be rescheduled or cancelled later. In addition, we retain the transcript and summary of a call; if an appointment time was mentioned in the call, it will therefore appear there. Transcripts are automatically deleted after 90 days (see section 6). The audio recording itself is held by our speech provider and remains stored there until you ask for it to be deleted. None of this is used for model training.

Limited Use: The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

6. Retention periods

• Transcripts and summaries in our own systems: 90 days, then automatically deleted.
• Call recordings: these are held by our speech provider and are not deleted automatically, so that a call can still be listened back to later in case of a complaint or a misunderstanding about what was agreed. If you want them removed sooner, or want nothing to be recorded at all, we will arrange that on request — per call or for your whole account.
• Account data: as long as you have an active subscription + 12 months.
• Billing data: 7 years (tax record-keeping obligation).
• Log data: up to 12 months.

7. Security

Encryption in transit (TLS 1.2+) and at rest, role-based access, multi-tenant separation via row-level security, audit logging, and periodic security reviews. Data centres within the EU wherever possible.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. Send a request to info@belnoor.nl; we will respond within 30 days. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Calls with Katie

Callers are informed at the start of the call that they are speaking with an AI assistant and that the call is being recorded. Processing of those recordings takes place under your responsibility as our customer; we provide the tools.

10. Cookies

We use functional cookies to remember your session and anonymised analytical cookies to improve the website. Our own visitor statistics store no IP address and no personal data: only a temporary session number, the page visited, the referring domain and the type of device. We do not measure automated visitors (search engine bots, link previews). Tracking for marketing only takes place after explicit consent.

If you give consent in the cookie notice, we measure our advertising via Meta Platforms: with the Meta pixel in your browser and with the Conversions API from our server. This shows us which advertisement led to a request or sign-up. Meta may process data outside the EU for this purpose. Contact details are only sent to Meta in hashed form. If you choose "No thanks", this does not happen.

For visitor statistics we use PostHog, hosted in the EU. Without consent, PostHog measures without cookies, without storing anything in your browser and without session recordings. If you give consent, PostHog also uses cookies and records sessions (how the page is used, without what you type into forms), so that we can see which advertisement led to which visit and where the site can be improved.

11. Changes

We may amend this statement. We will announce material changes by email or in the portal at least 30 days in advance.

12. Contact

callnorah.com · info@belnoor.nl
See also our Terms and Conditions.