aillo.

Privacy Policy

Last updated: 9 October 2026 · English / Français / Türkçe

This Privacy Policy explains how Kodless.ai ("Aillo", "we", "us") collects, uses, shares and protects personal information when businesses use the Aillo AI receptionist service (the "Service") and when people call a business that uses it. It is written to meet Québec's Act respecting the protection of personal information in the private sector (Law 25), Canada's PIPEDA, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, Türkiye's Personal Data Protection Law No. 6698 (KVKK), and applicable US state privacy laws.

1. Who we are and our role

Kodless.ai, Montréal, Québec, Canada (a sole proprietorship of Özge Savasci, Québec enterprise number 2282178096), operates the Service.

  • For account holders (businesses, agencies and their users), we decide how their personal information is used. We are the organization responsible for it under Law 25 and PIPEDA, the controller under the GDPR and UK GDPR, and the data controller (veri sorumlusu) under the KVKK.
  • For people who call a business that uses Aillo, the business decides why its calls are handled and is responsible for that information. We act on its instructions as its service provider — a processor under the GDPR and UK GDPR, a data processor (veri işleyen) under the KVKK. Our Data Processing Addendum sets out those commitments. See section 9.

2. Privacy Officer and contact

The person responsible for the protection of personal information is Özge Savasci, Owner. For any question, request or complaint about privacy, write to [email protected].

3. Information we collect

From account holders

  • Account details — name, email, password (stored only as a secure hash), role, and for agencies their company details.
  • Business configuration — business name, sector, language, time zone, opening hours, services and prices, staff names, forwarding numbers, greeting and the knowledge you give your assistant.
  • Number verification documents — for local numbers in France, the United Kingdom, Germany and Türkiye, the identity and address documents and details the telecom regulator requires. They are sent directly to our telecom provider Telnyx for its regulatory check; Aillo does not keep a copy, only the status of the check and when you accepted the process.
  • Billing — plan, balance, usage and invoices. Card payments are handled by Stripe; we never see or store your full card number.
  • Calendar connection (optional) — if you connect Google Calendar or Microsoft Outlook, an encrypted access token and the busy times and events needed to avoid double bookings.
  • Support and in-app assistant — messages you send us and questions you ask the dashboard help assistant.
  • Technical and security data — sign-in records, IP address, browser and device information, and logs needed to run and secure the Service.

From callers (on behalf of the business they call)

  • The caller's phone number and the date, time, length and outcome of the call.
  • Call audio is processed in real time and is not recorded or stored. A written transcript of the conversation is kept so the business can follow up.
  • What the caller chooses to share: name, callback number, appointment request, message, and any other detail they mention. Callers should not share sensitive information (such as health details) unless the business needs it to serve them.

4. How we use information and our legal bases

  • To provide the Service — answer calls, book appointments, take messages, notify the business, forward calls, run the dashboard and agency tools. Legal basis (GDPR/UK GDPR/KVKK): performance of a contract.
  • To bill and prevent abuse — process payments and usage, detect fraud, enforce limits. Contract; legitimate interests; legal obligation for tax and accounting records.
  • To keep the Service secure and reliable — monitoring, troubleshooting, incident response. Legitimate interests.
  • To communicate with you — service, security and billing notices, and support. Contract; legitimate interests.
  • To meet legal obligations — tax, telecom regulatory checks, responding to lawful requests. Legal obligation.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use the content of calls for advertising or to train our own AI models. Where the law requires consent (for example for optional features), we ask for it and you can withdraw it at any time.

5. AI, automated processing and callers' notice

The Service uses artificial intelligence to understand callers and respond. At the start of each call the assistant tells the caller that it is the business's virtual (AI) assistant and that the call is transcribed, and it never claims to be a human. If a caller describes an emergency, the assistant tells them to hang up and call the local emergency number.

The assistant books appointments and takes messages within the rules the business set. It does not make decisions that produce legal or similarly significant effects on a person based solely on automated processing. If you believe a decision about you was automated, contact us: you may ask to be told the personal information and the main factors used, have it corrected, and have a person review it.

6. Who we share information with

We share personal information only with service providers that process it for us, under written agreements that require them to protect it and use it only to provide their service:

  • Supabase — database and authentication (data hosted in Canada).
  • Railway — application hosting (United States) and voice service (European Union).
  • Cloudflare — network delivery and security (global network).
  • Telnyx — phone numbers, call connectivity and number verification (United States).
  • Google (Gemini) — real-time speech understanding and response during calls (United States).
  • OpenAI — the help assistant in the dashboard and on our website (United States).
  • Stripe — payments (United States and other countries).
  • Resend — transactional email (United States).
  • Google Calendar / Microsoft Outlook — only if you connect them.

For agency clients, the managing agency can see and manage its clients' configuration, calls and messages. We may also disclose information when required by law, to protect rights and safety, or as part of a merger or sale of the business under equivalent protection.

7. International transfers

Personal information may be processed outside the province, state or country where it was collected, including in Canada, the European Union and the United States. Before a transfer outside Québec we assess, as Law 25 requires, whether the information will receive adequate protection. Transfers of personal data from the European Economic Area and the United Kingdom rely on the adequacy decision for Canada, the EU–US Data Privacy Framework and its UK extension where the recipient is certified, or the European Commission's Standard Contractual Clauses and the UK Addendum. Transfers from Türkiye are made in line with Article 9 of the KVKK, using the standard contracts it provides or another lawful mechanism. You can ask us for more information about these safeguards.

8. Retention

We keep personal information only as long as needed for the purposes above or required by law. An automatic clean-up applies these maximum periods:

  • Call audio — not stored.
  • Call transcripts — erased 90 days after the call. The call record itself (date, time, length, caller number, outcome, cost) is kept for billing and accounting.
  • Messages — deleted 12 months after they were taken, once read. An unread message stays until the business deletes it.
  • Appointments — the customer's name, phone number and notes are removed 24 months after the appointment; the booking is kept without them.
  • Account, business and billing data — while the account is active, then only as long as legal, accounting and tax obligations require.
  • Number verification — Aillo keeps only the status; Telnyx keeps the documents as the telecom regulator requires.

Businesses can delete a call, a message or an appointment from their dashboard at any time; deletion is immediate and permanent. To close an account and erase its data, write to [email protected].

9. Callers: how to exercise your rights

If you called a business that uses Aillo, that business is responsible for your information. Please contact it first to access, correct or delete your information; we help it respond. You can also write to [email protected] and tell us which business you called and your phone number: we will forward your request to the business and act on its instructions.

10. Your rights

Depending on where you live, and subject to legal limits, you have the following rights:

Québec and Canada (Law 25, PIPEDA)

  • access your personal information and be told how it is used and shared;
  • have it corrected if it is inaccurate, incomplete or ambiguous;
  • withdraw consent, and ask us to stop disseminating it or to de-index it where the law allows;
  • receive computerized information you provided in a structured, commonly used technological format (portability).

If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

European Union and United Kingdom (GDPR, UK GDPR)

  • access, rectification and erasure;
  • restriction of processing and data portability;
  • to object to processing based on legitimate interests, and to direct marketing at any time;
  • to withdraw consent at any time, without affecting earlier processing.

You can complain to the supervisory authority where you live or work — for example the CNIL in France, your federal or state data protection authority in Germany, or the Information Commissioner's Office in the United Kingdom.

Türkiye (KVKK, Article 11)

You may learn whether your personal data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad it is transferred to; request correction, deletion or destruction and that these be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing. Send your application to [email protected]; we answer free of charge within 30 days. If your application is refused or unanswered, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

United States

Residents of US states with consumer privacy laws may have rights to know, access, correct, delete and obtain a copy of their personal information, and to opt out of its sale, sharing for targeted advertising or profiling. We do not sell or share personal information for those purposes. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you can appeal a refusal by replying to our answer.

To exercise any right, write to [email protected]. We may need to verify your identity, and we answer within 30 days (one month under the GDPR), unless the law allows an extension, in which case we tell you why.

11. Security and incidents

We use technical and organizational measures suited to the sensitivity of the information: encryption in transit, hashed passwords, encrypted calendar tokens, strict access controls, isolation so that each business sees only its own data, and logging. We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned; where we act as a processor, we inform the business without undue delay so that it can meet its own notification duties (for example within 72 hours under the GDPR).

12. Cookies

We use only the cookies and browser storage strictly necessary to sign you in, keep your session secure and remember preferences such as your theme. We do not use advertising, analytics or third-party tracking cookies, so no consent banner is needed.

13. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 14 (16 in some countries) except as a caller's message may contain it.

14. Changes

We may update this Policy. We will tell account holders about material changes by email or in the Service before they take effect, and update the date above.

15. Contact

Özge Savasci, Owner — Kodless.ai, Montréal, Québec, Canada — [email protected].