Privacy policy

Two different people read this, and they are in different positions.

• You have a Zeryon account. You signed up, you build voice agents, you are billed. We decide what happens to your account data, so for that data we are the controller and section 3 applies to you.
• A Zeryon agent telephoned you. You do not have an account and you did not choose us. The business that called you chose us, gave us your number, and decides what the call is for. For that call they are the controller and we act on their instructions as their processor. Section 4 describes what we hold on their behalf, and section 8 explains why a request about it is usually faster if you send it to them — though we will act on one sent to us.

Where this policy says client it means a business with a Zeryon account. Where it says caller it means a person one of their agents spoke to, in either direction.

Zeryon is operated by company name to be completed on registration, registered in United Kingdom or Sweden — to be completed, registered address to be completed.

Contact for anything in this policy: privacy@ — address to be completed.

It is a short list, and that is deliberate: we ask for the least that lets you sign in and be billed.

• Your email address and a password hash. The password itself is never stored. What is stored is a one-way scrambled copy (a hash), which cannot be turned back into your password.
• Your organisation, and your role in it. Which organisation you belong to, and whether you are an administrator.
• What you build. Your agents, their instructions, your tools, your uploaded knowledge-base documents, your phone configuration, your API key names.
• Keys for services you connect yourself. The models and voices your agents use run on Zeryon’s own accounts, so you do not give us keys for them. If you connect your own tools, the keys you enter for them are stored so that your agents can use them.
• Billing. Your credit balance and the ledger of movements against it. If and when card payment is switched on, the card itself is handled by a card payment processor and never reaches us — we would hold their customer reference and the amount, not the card.
• Records of your use of the service. Server logs recording the IP address you connected from, the pages and API paths you requested, the time, and your browser's user-agent string. Records of account events — creation, password reset — in an append-only audit log. Records of any occasion on which our operators accessed your account (see section 9).

We do not ask for your name, your telephone number, your postal address or your date of birth, and there is nowhere in the product to put them.

Our lawful bases. Your account data is processed to perform our contract with you. Server logs and the audit log are processed under our legitimate interest in running a service that is secure and can be debugged; you can object to that, and section 8 says how.

This data belongs to the business that called you. We hold it for them and do not use it for anything of our own.

• The recording. Both sides of the call are recorded as audio and stored as two separate files — what the agent said and what you said.
• The transcript. The whole conversation as text.
• Whatever the business already knew. If you were called from a contact list, the row for you is held — typically your name and number, and any other column the business chose to upload.
• What the agent worked out during the call. Anything the agent was configured to establish, such as whether you wanted an appointment.
• A short written memory of you. If the business has memory switched on, a few sentences summarising what you discussed, so that a later call can refer to it. This is described in section 5.
• The outcome. What came of the call, whether it needs following up, and any note recorded against it.
• Technical records. The time, the duration, and — if you used a chat widget on a website rather than the telephone — your IP address and your browser's user-agent string.

The lawful basis is the calling business’s, not ours. They decided to call you and they must be able to say why they were allowed to. Our terms require them to have that basis, to have told you the call is recorded, and to comply with the rules on unsolicited calls in your country. We cannot verify that for every call, and it would be dishonest to imply we can.

Some things are stripped out of every summary and every record derived from a call, whatever any client asks for.

Always removed, and no setting can turn them back on: card numbers, card security codes, bank details (sort codes, account numbers and IBANs) and national identity numbers. There is no legitimate reason for this product to keep any of them.

Removed by default: dates of birth.

Deliberately kept: your name, your telephone number, your email address and your postcode. We are not going to pretend otherwise. An agent that cannot say “you mentioned an appointment last time” is a transcript rather than an assistant, and the business that called you already had your number. A client can ask for a stricter setting for their account, and that setting is per client rather than global.

Two limits worth stating plainly. First, this removal applies to the summaries, memories and outcome records derived from a call, and to the text sent to a model provider for summarising — not to the raw recording or the raw transcript, which are stored as they were captured. Second, finding a name in free text is not reliably possible: the rule only catches an explicit introduction such as “my name is —”, and it will miss others. Where the removal process fails for any reason it discards the whole value rather than letting an unchecked one through, and it records how many items of each kind it removed so that a summary which says little can be told apart from a call in which little was said.

Thirty days for anything about a caller, counted from when it was created. It is a setting, and no client has changed it.

Why the call record survives. Deleting it would destroy the evidence for what a client was charged. Everything that identifies a person is removed from it — the contexts, the logs, the links to the recording and transcript — and what is left is an identifier, timestamps, whether the call completed, and how long it lasted.

Three honest exceptions. Server logs, which contain IP addresses and the paths requested, are rotated by size rather than by age: they are overwritten when they grow past a fixed limit, and on a quiet deployment that can be longer than thirty days. The account audit log is append-only and cryptographically chained so that it cannot be altered — this is what makes it trustworthy, and it also means entries recording an account’s creation or a password reset, including the email address, are not deleted. And a copy of the database is taken daily and thirty are retained, so for up to thirty days after something is deleted a copy of it still exists in a backup. We do not restore backups in order to serve deleted data, and each backup ages out on its own schedule.

Everything runs on one machine in a cloud hosting provider’s New Jersey location, in the United States.

This matters and we are not going to bury it. If our company is registered in the United Kingdom or in Sweden, storing personal data in the United States is a restricted international transfer, and it needs a transfer mechanism to be lawful — in practice the UK addendum to the standard contractual clauses, or the EU standard contractual clauses, or a supplier’s certification under the EU–US and UK–US Data Privacy Framework. Putting the servers in a UK or EU region instead would remove the question rather than answer it, and that is a decision we have not yet taken. Ask us where things stand before you rely on it.

These are the other companies that receive data, as configured today:

We choose these suppliers and may change them. A client who connects a provider of their own — their own telephone service, for example — adds that company for their own account, and that is their choice rather than ours. We will publish changes to what is on this list here.

What is not on the list. There is no analytics, no advertising, no session recording, no error-reporting service and no tracking of any kind. We checked this rather than asserting it: every page of the product was loaded in a browser and every web request it made was recorded, and none went to a third party.

The one exception: a test call from your browser. When you talk to one of your agents from the agent editor, your browser connects to our server for the call. Before the audio starts, to find a route through your network, your browser asks Google’s public STUN server (stun.l.google.com) which internet address your connection appears to come from. That request carries your internet address and nothing else — no audio, no words, no account details — and Google’s answer is that address. The call’s audio then goes between your browser and our server. This happens only when you start a test call; no other page contacts anyone but us.

Country flags. The flags beside a telephone number are Twemoji images, copyright Twitter, Inc and other contributors, used under the Creative Commons Attribution 4.0 licence (creativecommons.org/licenses/by/4.0). They are served from this dashboard, like every other part of the page, not fetched from anyone else.

Under UK and EU data protection law you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to it being processed, and ask for it in a portable form.

If an agent called you, ask the business that called you — they are the controller and can act immediately. If you would rather come to us, or you do not know who called you, write to the address in section 2 with the telephone number that was called. We can find everything held about that number and either produce it or delete it. We will tell the client, because it is their data and they may have their own obligation to keep something.

If you have an account, most of your data is visible and editable in the product. Write to us to close the account and have it deleted.

What deletion actually does, so that the promise is the same size as the act: recordings and transcripts are removed from storage; memories, outcomes, CRM records, contact rows, chat sessions and anything sent to the client’s own systems about those calls are deleted; the call records themselves are emptied of everything personal but keep their identifier, timings and duration as billing evidence. Copies in backups age out over the following thirty days. Entries in the append-only audit log are not removed. We check afterwards that nothing is left and can show you the result.

We answer within one month. There is no charge unless a request is excessive or repetitive, and we will say so rather than quietly delaying.

If we get it wrong you can complain to the supervisory authority: in the United Kingdom the Information Commissioner’s Office, and in Sweden Integritetsskyddsmyndigheten. Which of those applies depends on where we are registered — see section 2.

Our operators can open a client’s account in order to support it. Every occasion on which that happens is recorded — who did it, whose account, when, and what they did — and those records are kept. The session is limited in time and cannot be extended silently.

Nobody outside the operators of this deployment has access to the database, the recordings or the transcripts.

Signing in sets a cookie holding your session, and a second cookie recording that you are signed in so the interface can show the right thing. A session lasts thirty days unless you sign out. A third cookie remembers whether you left the sidebar open. Your browser also stores your light or dark theme choice locally.

That is the complete list. There are no analytics or advertising cookies, nothing that follows you between sites, and nothing set by a third party.

• Passwords. Stored only as one-way hashes.
• Our model and voice keys. Encrypted before being written to the database.
• Identifiers for callers. Records derived from a call — memories and CRM entries — do not copy the telephone number. They carry a one-way handle computed from it with a secret unique to this deployment, so the same person can be recognised across their own calls without the number being duplicated across the database. This limits linkage; it is not encryption, and the number does still exist on the call record itself where it is needed.
• Backups. Taken daily, and — since 4 September 2026 — restored into an isolated environment and checked against the original record counts rather than assumed to work.
• Monitoring. The deployment checks itself every five minutes for containers being down, the backup failing, disk filling, certificates expiring, and provider keys being refused.

Two things are not yet where they should be, and you should know before you sign up. The service is currently reached over plain HTTP at an IP address rather than over HTTPS at a domain name, which means traffic between your browser and the service is not encrypted in transit. And the backups are held on the same machine they protect, so a single hardware failure would lose both. Both are being addressed; neither is described here as done.

We also cannot currently confirm from inside the deployment whether the underlying disk is encrypted at rest by the hosting provider. Rather than assume it, we say we do not know.

The agent decides what to say next during a call, which is an automated process. It does not make decisions that have a legal or similarly significant effect on you; what it does is conduct a conversation and record what came of it. A person at the business that called you decides what to do next.

We do not train models on your calls or your account data, and we do not sell either. What our providers do with data sent to them is governed by their own terms, and it is worth reading them.

When this policy changes the date at the top changes with it. If a change materially affects clients — a new sub-processor, a different retention period, a different country — we will tell account holders directly rather than only editing this page.