Privacy without the small print.

1. Scope and roles

YouRing is a business communications platform. For customer accounts, the customer organisation determines the purposes for processing contacts, users, calls, recordings, notes and other operational data. In that context, the customer will normally act as controller and YouRing as processor under the contract and documented instructions.

For the website, sales enquiries, billing, platform security and administration of the contractual relationship, the YouRing entity identified in the applicable proposal or agreement acts as controller. This policy complements, but does not replace, each customer's data processing agreement.

2. Data we process

The app does not request location, camera, photo library or personal address-book access. It does not use advertising SDKs, build advertising profiles or track people across third-party apps or websites.

• Account and professional data: name, email, role, organisation, permissions, extension and internal identifiers.
• Business contact data: name, telephone number, tags, notes and context supplied by the customer or created during operations.
• Call data: source and destination, dates, duration, queue, journey, outcome, technical events and, when enabled by the customer, a recording.
• AI data when enabled: audio needed to perform the feature, temporary transcript, summary, intent, outcome and task or callback context.
• App and device data: installation identifier, model/platform, version, sessions, notification tokens, phone registration state and diagnostics.
• Technical and security data: IP address, date and time, requests, failures, authentication events and logs needed to prevent abuse and investigate incidents.
• Information voluntarily sent for support, demonstrations, rights requests or contract management.

3. How data is obtained

We receive data directly from the user, the customer organisation, customer-configured integrations, telephony infrastructure during a call and the device when the app communicates with our services. The microphone is used only when needed to make or receive calls. Notifications are optional and support operational alerts and incoming calls.

4. Purposes and legal grounds

• Provide the platform, authenticate users, route calls and maintain operational continuity — performance of the contract and customer instructions.
• Keep history, recordings, notes and outcomes when configured — the legal ground determined by the customer controller.
• Prevent fraud, protect accounts, diagnose faults and maintain availability — legitimate interests and information security.
• Answer requests and manage contracts, billing and support — contract, pre-contract steps and legal obligations.
• Run AI capabilities enabled by the customer — customer instructions and the ground it determines; consent where the law or scenario requires it.
• Meet legal duties, valid orders and defend rights — legal obligation or legitimate interests.

5. Providers and recipients

We share only what is needed to provide and protect the service. Recipients may include Hetzner for infrastructure, Cloudflare R2 for recording storage, telecommunications carriers, Apple Push Notification service or Firebase Cloud Messaging when notifications are enabled, and OpenAI when the customer enables AI capabilities. We may also use advisers bound by confidentiality or respond to an authority where legally required.

We do not sell personal data or share it for behavioural advertising. Providers are contractually bound and required to protect data appropriately for the service they perform.

6. Where data is hosted and processed

The application, primary database and dedicated telephony infrastructure are hosted on Hetzner servers in Finland, within the European Union. Customer-enabled recordings are stored in Cloudflare R2 with a Western Europe location preference. This location preference is not, by itself, a guaranteed Cloudflare jurisdictional restriction.

Some global providers — particularly telecommunications, notifications and AI — may process data outside the European Economic Area. Where this occurs, we apply the contractual mechanism and safeguards required by the GDPR. Strict residency requirements, including jurisdictional restrictions or regional AI processing, must be agreed and confirmed before the relevant capability is enabled.

7. Retention and deletion

The customer defines the periods for its operational data — including history, contacts and recordings — according to purpose, legal basis and sector duties. YouRing applies that configuration and the customer's documented instructions. Strictly necessary technical data has its own limited periods.

The Data Retention page sets out the criteria, current technical limits and deletion process. Data may be kept longer only where required by law, a valid order, litigation or a security obligation.

8. How we protect data

No system is risk-free. We maintain technical and organisational measures proportionate to the nature of the data and review them as the platform evolves.

• Logical customer separation and dedicated telephony infrastructure for each operational tenant.
• Role-based permissions, least privilege and revocation of sessions and credentials.
• HTTPS/TLS for apps and APIs; SIP over TLS in the mobile app; protected secrets and credentials on servers and in secure device storage.
• Versioned releases, automated tests, availability checks, monitoring, backups and audit events.
• Data minimisation and scheduled deletion of transient information.

9. Rights and choices

You may request access, correction, deletion, restriction, portability or objection, and withdraw consent without affecting earlier processing. For business accounts, requests should normally be addressed first to the organisation managing the account. You may also contact YouRing; we will route and support the customer controller where applicable.

You may complain to Portugal's National Data Protection Commission (CNPD) or your local supervisory authority. See Privacy Choices to start a request or request account deletion.

10. Cookies and local storage

The public website does not use advertising cookies or behavioural tracking tools. The authenticated platform uses only cookies, tokens and local storage required for security, sessions, preferences and app operation.

11. Children

YouRing is intended for professional use by people authorised by an organisation. It is not directed to children and we do not knowingly collect children's data through the app.

12. Changes and contact

We will update this policy when practices, features, providers or legal requirements change. The date above identifies the current version. Questions and requests can be sent to contacto@youring.ai. Do not email passwords, authentication codes or sensitive recordings.