Klientel app privacy policy

Who handles your data

The service is run by Martin Valovič, sole trader registered in Slovakia (trade register of the District Office Malacky no. 120-31700, IČO 57928487), Krátka ulica 353/2, 900 51 Zohor, Slovakia. For anything about your data, email martin@klientel.cz.

Klientel is the controller for the data of app users, meaning business owners and their staff. It is also the controller for billing, security records and the data of visitors to klientel.co.uk, including demo requests.

For the data of your business's customers (calls, contacts, jobs, photos and messages) your business is the controller and Klientel is the processor. We handle that data only on your instructions and under the data processing agreement your business signs together with our terms.

What we handle

Depending on how you use the service, this includes the following.

• Account. Name, email, phone number, role in the business, language and technical sign-in data.
• Device. The push notification token from Apple or Google, the device type and the app version.
• Your business's customers. Name, phone, email, address, notes, photos and job history that you add to the app or that come from a call or a link sent by the assistant.
• Calls. The caller's number, the time and length of the call, the audio recording, the transcript and the summary.
• Bookings and messages. Proposed and confirmed bookings and a log of the texts and emails sent, including review requests.
• Billing. Name, business, company number, billing address, email, phone and payment history. You enter your card directly with Stripe and we never see its number.
• Operating records. Who did what in the account and when, for security.
• Support. The messages you send us.

The app does not track you and has no advertising or analytics tools.

Why we use it

We only use data for these purposes.

• Running your account and the service, which means signing in, showing calls, bookings and customers and sending notifications and messages. The legal basis is performing our contract (UK GDPR Article 6(1)(b)).
• Support and keeping in touch with you about the service. The legal basis is also performing our contract. We do not send marketing emails to app users.
• Security, protection against misuse and improving the service. The legal basis is our legitimate interest in running the service safely and reliably (UK GDPR Article 6(1)(f)).
• Invoices and accounting. The legal basis is a legal obligation (UK GDPR Article 6(1)(c)).
• Review requests after a finished job. They are on by default and the business can switch them off in the app. The customer gets a text or an email after a finished job, at most once in 90 days, whatever they thought of the job. The business is the controller. It relies on its legitimate interest in contacting its existing customers (in the UK regulation 22(3) of PECR, the soft opt-in, in the Czech Republic section 7(3) of Act 480/2004, in Slovakia section 116(15) of Act 452/2021). Czech and Slovak messages are marked as commercial messages and every message names the sender, the business. An email ends with the business name and, if the business has filled them in, its company number and address. Every message says how to stop further messages. A text from a Czech or UK number can be answered with STOP, with a one-way Slovak text the customer calls the business and an email can be replied to.
• Recording calls with the assistant. The business the customer calls decides on recording. It relies on its legitimate interest in an accurate record of what the customer ordered (UK GDPR Article 6(1)(f)). Klientel makes the recording on its behalf as a processor.
• Who tells the caller. At the start of every call the assistant says it is the business's AI assistant and that the call is recorded. The business also explains recording in its own privacy notice.

Who else sees it

We use providers the service cannot run without. We never sell your data. The list is below.

Providers

A recipient that is not our processor

The job address is looked up and drive times between jobs are worked out by Mapy.com, which is run by Seznam.cz, a.s. (Czech Republic). Seznam.cz receives the address the caller says and the coordinates of jobs. Under section 7 of its API terms it is the controller of that data in its own right and not our processor. It does not receive the data in a third country.

Transfers outside the UK and EU

The service's data is stored in the EU (Supabase in Frankfurt). Addresses and drive times are worked out by Seznam.cz in the Czech Republic. UK law treats the EU as adequate, so data can go there without extra safeguards. Some providers process data in the USA or elsewhere outside the UK and EU. These are the safeguards for each.

• Twilio, Resend, Netlify, Google and Stripe are certified under the UK Extension to the EU-U.S. Data Privacy Framework.
• Eleven Labs Inc. is certified under the EU-U.S. Data Privacy Framework, including its UK Extension. We checked its status on dataprivacyframework.gov on 1 November 2026. Its data processing agreement also includes the EU standard contractual clauses with the UK Addendum.
• Apple serves the EEA and the UK through Apple Distribution International Ltd (Ireland). Its transfers rely on standard contractual clauses. Apple is not on the Data Privacy Framework.
• The contracting company for Supabase is Supabase Pte. Ltd. (Singapore), which is also the importer under the standard contractual clauses. Our data is stored in Frankfurt (eu-central-1). Access by its support staff and providers outside the UK and EU relies on the clauses (modules 2 and 3) and the UK Addendum under its data processing agreement, version of 1 August 2026. Supabase is not on the Data Privacy Framework.
• We send email through Resend. Sending, the account and the log of sent emails are all in the USA.
• Telegram is only an optional channel. It is run by Telegram Messenger Inc. outside the EEA and its policy names no country. By that policy it stores EEA and UK data in the Netherlands and covers its group companies in the British Virgin Islands and Dubai with standard contractual clauses. It offers bot developers no data processing agreement or standard clauses. We send it only notices to the owner and message previews for setting the service up. A notice goes to a chat the business chose and carries the customer's full name, phone number and address. Message previews for Klientel have phone numbers and email addresses masked while the name and address stay visible. A business can switch Telegram off at any time by emailing martin@klientel.cz.

How long we keep it

• Account and business data stay for as long as the account exists.
• The audio recording of a call and the ElevenLabs record of the call with its full transcript are deleted 30 days after the call.
• The call summary (what the customer needed, the address, the agreed time and the outcome) and the call transcript are saved to the customer in the app straight after the call. They stay there until the business deletes the customer or closes its account.
• Email notices carry the call summary. They stay in the business's mailbox under its control and Klientel cannot delete them.
• Photos a customer sends through the assistant's link are deleted 90 days after upload.
• A deleted customer disappears from the app at once. After 30 days we delete them for good with their calls, notes, photos and messages.
• When you delete your account, your sign-in ends at once. If you are the only owner of a business, the business account with its customers, calls, recordings and photos is permanently deleted after 30 days.
• Database backups are kept for 7 days. Deleted data leaves them no later than 7 days after the permanent deletion.
• Invoices and accounting records are kept for 10 years, as section 35 of the Slovak Accounting Act (No. 431/2002 Coll.) requires.
• Security records (who did what in the account and when) cannot be edited and stay after an account is deleted. They mostly hold internal identifiers, the type of action and the time. We keep them for 12 months and then delete them.

Your rights

You have the right to see your data, to have it corrected or erased, to restrict its use and to take a copy in a portable form. You can object to processing based on our legitimate interest. Where processing relies on consent, you can withdraw it at any time.

Email martin@klientel.cz. We reply within one month. You can delete your account yourself in the app under Settings or on the Delete your account page.

If you are a customer of a business that uses Klientel, that business is the controller of your data. Contact it first. We will help it deal with your request. If you write to us, we pass your request on to the business.

You can complain to the Information Commissioner's Office (ico.org.uk). Our lead supervisory authority in the EU is the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk), because Klientel is registered in Slovakia.

Changes

When we change this text we will publish the new version on this page.