Your company is the controller of the call data: it decides that calls are recorded, why, and how long they are kept. TidyVox is a processor acting under a data processing agreement, only within the scope you commission.
The sub‑processors we use are listed in the agreement, with a change‑notification rule and a right to object: an EU‑based telecom carrier for numbers and calls, a language‑model provider for summaries and outcomes, which receives only the transcript text and does not train models on it, and hosting in the European Union.
Documents available before the pilot: the data processing agreement template, the sub‑processor list, a description of technical and organizational measures, proposed wording for the recording announcement and the privacy notice for your customers.