Privacy policy

1. Who we are

This website and the TuniCall service are operated by TuniCall (“we”, “us”). Our company details are listed in the legal notice. You can reach us through our contact form.

This policy explains how personal data is processed when you visit this website, contact us, sign in to TuniCall or use it as a member of a customer’s team, and how the personal data of the people our customers call is handled in the service.

TuniCall is used by organisations in several countries. Depending on where you are, laws such as the EU General Data Protection Regulation (GDPR), the UK GDPR or Tunisian Organic Law No. 2004-63 on the protection of personal data may give you specific rights. We describe them below.

2. Our role: controller or processor

Data protection law distinguishes the “controller”, who decides why and how personal data is processed, from the “processor”, who processes it on the controller’s behalf. TuniCall acts in both roles, depending on the data.

• TuniCall as controller. We decide how data is processed for our website, for answering enquiries, for managing our customer relationships and invoicing, for the security of our service and for our legal obligations. This policy fully applies to that processing.
• TuniCall as processor. When a business (a “customer”) uses TuniCall to handle its calls, the customer decides which people are contacted, for what purpose and through which providers. The customer is the controller of that data. We process it only on the customer’s documented instructions, under our data processing agreement. This covers contact details, consent records, conversations, transcripts, call details, notes and tasks, and the data of the customer’s users in its workspace.

Customers connect their own telephony and AI provider accounts to TuniCall, for example with Twilio, OpenAI, Google, Anthropic, ElevenLabs or Deepgram. Those providers are chosen by the customer, process data under their own agreements with that customer, and are not our sub-processors.

3. Visiting this website

When you visit this website, our servers and network infrastructure process the technical data needed to deliver the pages to you: your IP address, the date and time of the request, the page requested, your browser type and version, the referring page and any error information. We use this data to deliver the website, keep it secure, and investigate faults and abuse.

To protect the sign-in page and the contact form against abuse, our server keeps a temporary count of requests per IP address. These counters are held in memory and expire after a short window of no more than 30 minutes.

We do not use analytics, advertising, tracking pixels or social media plugins. The fonts of this website are served from our own servers, so your visit is not disclosed to a font provider. The website itself sets no cookies. Our cookie policy explains the session cookie used after sign-in and the security check on the contact form.

The legal basis for this processing is our legitimate interest in operating and securing our website.

4. Contact form and enquiries

When you write to us through the contact form, we process your name, your work email address and, if you provide them, your company, your phone number, the topic you choose and your message, together with the date and time of your request. The form contains a hidden field that only automated programs fill in: if it is filled, the request is discarded without being stored. The form is also protected by a Cloudflare Turnstile security check (see “Sign-in and security”).

We use these details to answer your request and follow up on it, for example to arrange a demonstration or prepare a quote. The legal basis is our legitimate interest in answering enquiries and developing our business, or, where you ask us for an offer, the steps taken at your request before entering into a contract.

Please do not include sensitive information in your message. We do not add you to a mailing list. If we ever want to send you marketing communications, we will do so only as the law allows, and you can object at any time.

We keep enquiries for as long as needed to handle your request and any business relationship that follows. If no business relationship follows, we delete them no later than three years after our last exchange.

5. Sign-in and security

To sign in to TuniCall, you use a username and a password. Passwords are stored only as a hash calculated with scrypt and a unique salt, never in readable form.

The sign-in page and the website contact form use Cloudflare Turnstile to tell people apart from automated abuse. When the check is shown, Cloudflare processes technical information about your browser, device and connection. We receive a verification result, and we send Cloudflare only the verification token, not your IP address or the content of the form. Cloudflare processes this information as described in its own privacy information.

After you sign in, a strictly necessary session cookie keeps you signed in. It contains a random token; we store only a hash of that token, with its expiry time. The session ends when you sign out and expires after 12 hours at the latest. Changing your password signs out your other sessions, and an administrator who deactivates your account ends all of your sessions immediately. Sign-in attempts are limited per IP address over a 15-minute window.

Security-relevant actions, such as sign-ins, user and password changes, and changes to agents, campaigns, routing and consent records, are recorded in an audit log with the user, the action and the time.

The legal basis is our legitimate interest, and that of our customers, in protecting accounts and the data held in TuniCall.

6. Users of a customer workspace

If your organisation gives you access to its TuniCall workspace, we process:

• your name, username, role (administrator or agent), password hash, account status and account creation date;
• your presence status (available, away, busy or after-call), whether your browser phone is ready, and the time you were last active;
• the calls you handle (numbers, times, durations, outcomes and notes), the notes and tasks you create, and the actions recorded about you in the audit log.

If you use the browser phone, your browser asks for access to your microphone and connects directly to your organisation’s telephony provider (Twilio) with a short-lived access token valid for one hour. That provider carries the call audio and receives technical data about the connection, such as call quality information, under its agreement with your organisation. TuniCall does not record the audio of calls.

We mainly process this data on behalf of your organisation, as its processor. We act as controller only where we process it for the security of our service and the management of our customer relationship. Your organisation’s own privacy notice also applies. For questions about your workspace data, contact your administrator, or contact us.

7. Business customers and their representatives

When an organisation becomes a TuniCall customer, or discusses becoming one, we process the names, job titles and business contact details of its representatives, our correspondence with them, and the information needed for quotes, orders, contracts, invoicing and payment follow-up.

We use this data to perform our contracts, manage the customer relationship, provide support and meet our accounting and tax obligations. The legal bases are the performance of our contract with the organisation, our legitimate interest in managing our relationship with its representatives, and our legal obligations.

8. People our customers call

This section applies if you received a call from a business that uses TuniCall, or if you called such a business.

The business is responsible for your data. It decides to contact you, is responsible for obtaining any consent the law requires, chooses its providers, and is the controller of your data. TuniCall processes your data on its behalf, as its processor.

Depending on how the business uses TuniCall, the following data may be processed in its workspace:

• your phone number and, if the business has them, your name, company, email address, tags and contact status (for example interested, follow-up or do-not-contact);
• the consent and preference records that the business keeps about you (for calls and marketing, and any request not to be contacted), with their source and date;
• call details, such as the numbers involved, the direction, times, duration, status and outcome of each call, and technical call events;
• the transcript of conversations with an AI agent, meaning the text of what you and the agent said;
• notes, callback tasks and campaign information about you, such as the number of attempts to reach you.

When you speak with an AI agent, your voice is streamed in real time to the speech and AI providers that the business has chosen, so that they can understand you and answer. TuniCall does not store audio recordings of calls. The business’s providers process the data under their own terms with the business. If you call a number that uses TuniCall, your phone number is recorded with the call, and a contact record may be created so that the business can follow up.

9. How to stop calls from a business

You can ask the business that contacted you to stop at any time:

• during a call, say that you do not want to be contacted again, or ask to speak to a person;
• contact the business directly, using the contact details in its own privacy notice or on its website.

The business is responsible for honouring your request, however and through whichever channel you make it. If you cannot identify or reach the business, contact us with the number that called you and the date and time, and we will pass your request on to the business.

10. Purposes and legal bases

The table below summarises the processing for which TuniCall is the controller. For the data we process as a processor, the legal basis is determined by our customer, as controller.

Where we rely on legitimate interest, we have balanced it against your interests and rights, and you can object to the processing (see “Your rights”). Where the law that applies to you requires your consent for a processing activity described here, we will ask for it, and you can withdraw it at any time.

11. How long we keep data

Where data is included in backups, it is deleted as those backups are replaced, and stays protected until then.

12. Who we share data with

We do not sell personal data and we do not share it for advertising. We share it only with:

• Service providers acting for us, under contracts that require them to protect the data and use it only for us: our hosting provider, which hosts the website, the service and its database; Cloudflare, for the Turnstile security check; and the providers of the email and office tools we use to communicate with you.
• Providers chosen by our customers, when a customer instructs TuniCall to use them: for example the telephony carrier that carries a call, and the speech and AI providers that process the audio and text of a conversation with an AI agent. These providers act under the customer’s own agreements.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Authorities and courts, when the law requires it, or when necessary to establish or defend legal claims or protect the rights and safety of people. Where a request concerns a customer’s data, we refer it to the customer whenever the law allows.
• A successor, if our business or part of it is merged, sold or transferred, in which case this policy continues to apply to your data.

The list of our sub-processors for customer data is in the data processing agreement.

13. International transfers

Our service providers, and the providers chosen by our customers, may process personal data in countries other than yours, including countries whose laws may not offer the same level of protection.

When we transfer personal data internationally, we rely on safeguards recognised by the applicable law, such as an adequacy decision, the standard contractual clauses approved by the European Commission or their UK equivalent, or, where Tunisian law applies, the conditions and authorisations it requires.

Transfers to providers that a customer connects to TuniCall, such as AI providers located outside the customer’s country, are made on that customer’s instructions and under its responsibility. You can ask us for information about the safeguards we use.

14. How we protect data

We use technical and organisational measures appropriate to the risks, including:

• encryption of stored provider credentials with AES-256-GCM, which are never sent back to the browser;
• passwords hashed with scrypt and a unique salt;
• HTTPS with HTTP Strict Transport Security in production;
• session cookies that are HTTP-only, secure and same-site strict, expiring after 12 hours;
• administrator and agent roles, immediate end of sessions when a user is deactivated, rate limiting and bot protection on sign-in;
• verification of provider signatures on incoming webhooks, and one-time tokens for live audio sessions;
• an audit log of security-relevant actions, and access to systems limited to authorised people who need it.

No system is completely secure. If a personal data breach occurs, we will act to limit its effects and notify those concerned as the law requires. More details are on our security page.

15. Your rights

Depending on the law that applies to you, you may have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict the processing of your data;
• object to processing based on our legitimate interest, and object at any time to processing for direct marketing;
• receive the data you provided in a structured, machine-readable format and have it transmitted to another organisation (data portability);
• withdraw any consent you have given, without affecting processing that took place before;
• not be subject to a decision based solely on automated processing that significantly affects you, where the law grants this right.

To exercise your rights, contact us through our contact form. We may ask for information to confirm your identity. We answer within one month, which can be extended by two further months for complex requests as the law allows, or within the time set by the law that applies to you. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If your request concerns data that we process on behalf of a customer, for example because a business called you, we will forward it to that business and help it respond, as only the business can decide on it.

16. Automated decisions and AI

TuniCall does not itself make decisions about individuals that produce legal effects or similarly significant effects.

Our customers can configure AI agents that hold conversations by phone and take limited actions, such as saving a note, updating a contact status, creating a callback task or handing the conversation to a person. Each customer decides how it uses AI agents and is responsible for informing the people it contacts and for providing human review where the law requires it.

We do not use personal data processed for our customers to train AI models. The AI providers chosen by a customer process data under their own terms with that customer.

17. Complaints

If you have a concern about how your data is handled, please contact us first through our contact form, and we will try to resolve it.

You also have the right to lodge a complaint with a data protection authority: in the European Union and the EEA, the authority of the country where you live or work or where the alleged infringement took place; in the United Kingdom, the Information Commissioner’s Office (ICO); in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP); elsewhere, the authority competent where you live.

18. Children

This website and the TuniCall service are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect children’s personal data through the website. If you believe a child has sent us personal data, contact us and we will delete it.

Our customers must not use TuniCall to target children, and must obtain any parental consent and apply any additional safeguards the law requires before contacting a minor.

19. Self-hosted installations

Some organisations run TuniCall on their own servers. In that case, the organisation controls the installation and the data it contains, and its own privacy notice applies. We do not receive that data, unless the organisation gives us access for support, in which case we act only on its instructions.

20. Changes to this policy

We may update this policy as our services and the law evolve. The “last updated” date at the top of this page shows the current version. If we make significant changes, we will inform our customers by email or in the service before they take effect.

21. Data protection contact

Questions about this policy or about your personal data are handled by the team that operates TuniCall, through the contact details given in “Who we are”. If we appoint a data protection officer, or a representative in another country, we will publish their contact details on this page.