Privacy policy

Who is responsible

ASPHERE SAS, 2 bis rue Georges Wodli, 57250 Moyeuvre-Grande, France, SIREN 907 876 957, is the controller for processing related to the website, contact requests and customer accounts.

For the calls made or received by a customer's agents (recordings, transcripts, numbers called, appointments), the customer is the controller and ASPHERE SAS acts as a processor, on the customer's instructions, within the meaning of Article 28 of the GDPR. If you were called by a CallGPT agent, please send your requests first to the company that called you; we will pass on those we receive.

Contact form

• Data: name, email address, company, phone (optional), message, as well as the page the message is sent from and where the visit came from (referring site or campaign).
• Purpose: to reply to your request and handle the commercial follow-up that results from it. The page and the origin are used to know which pages of the site are useful.
• Legal basis: pre-contractual measures taken at your request, and legitimate interest in following up the requests received.
• Retention: three years from the last exchange, then deletion.
• Recipients: the publication director of ASPHERE SAS, the only recipient of requests sent from this site; the form is hosted by Heroku and notification is sent by email through Google. Requests coming from CallGPT are not entered in a CRM.

Customer account and use of the service

• Account data: name, email address, password (stored in irreversibly encrypted form), company, role of team members, plan subscribed, credit balance and consumption.
• ASphere account: your CallGPT account is an ASphere account, shared by the services published by ASPHERE SAS; the same address and the same password give access to it. Your identity, your plan, your credit balance, your purchases and the history of debits are kept by ASphere's accounts platform. For each connected device, CallGPT keeps, encrypted, the ASphere sign-in token that lets it display your billing and start your payments; it is erased when you log out, when the session ends or with your account.
• Multiple accounts: at sign-up and at login, your IP address is sent to ASphere's accounts platform, which keeps only an irreversible fingerprint of it, to detect accounts opened in series in order to obtain the free credits several times. Legal basis: legitimate interest in preventing fraud. The fingerprint is erased after twelve months.
• Sign-in with Google: if you use it, ASphere's accounts platform receives from Google your name, your email address, your profile picture and a verified account identifier.
• Payment: handled by Stripe. We neither receive nor keep your card number; ASphere's accounts platform keeps the Stripe customer identifier, the subscription status and your credit purchases.
• Integrations: if you connect Google Agenda or Calendly, we keep the authorisations needed to read your availability and create the appointments made by your agents. You can disconnect them at any time.
• Legal basis: performance of the contract (terms of sale and use); legal obligations for invoicing.
• Retention: for the whole life of the account, then deletion within three months of its closure, except accounting documents kept for ten years (Article L123-22 of the French Commercial Code).

Calls handled by the agents

• Data: number of the caller or of the person called, audio recording of the call, transcript, summary and analysis (reason, outcome, qualification answers), messages, appointments, text messages sent, imported contact lists and the opt-out list.
• AI processing: during the call, the voice is sent in real time to OpenAI, which understands it and produces the agent's replies. This processing takes place outside the European Union.
• Hosting: recordings and transcripts are stored on CallGPT's voice server, in France with Scaleway, and can be viewed in the customer's dashboard.
• Retention: the audio of calls is deleted automatically 30 days after the call; transcripts, summaries and analyses are kept for the life of the account. The opt-out list is kept as long as the account exists, so that people who refused are no longer called.
• Information of individuals: the agent announces that it is an AI at the start of the call. It is up to the customer to inform their contacts of the recording and of the purpose of the calls.

Audience measurement

The website, the sign-up pages and the dashboard load OpenPanel, an audience measurement tool that we host ourselves with Scaleway. It places no cookie and no storage in your browser. It records the pages viewed, the referring site, the country and city inferred from your connection, the type of device and browser, and clicks on the main links and buttons, to know which pages are useful. Automated browsers are not measured. No data is sold or shared for advertising purposes. Legal basis: our legitimate interest in measuring the site's traffic. You can object at any time, on this browser:

Sign-in with Google

The sign-up and login pages offer a “Continue with Google” button. It leads to Google's sign-in through ASphere's accounts platform; no Google script is loaded on the site. If you use it, Google sends your name and email address to create or open your account. Legal basis: performance of the contract you ask to enter into (creating or opening your account).

Cookies and browser storage

• Objection to audience measurement (local storage callgpt-mesure-refusee): remembers your objection, if you express one. Necessary, no consent required.
• Dashboard session (cookies cg_session, cg_org and cg_vu): keeps you signed in to your account as long as you come back at least once every 90 days; cg_vu limits its renewal to once a day. Necessary, no consent required, set only after login.
• Return from Google sign-in (cookies cg_g_etat, cg_g_suite, cg_g_entreprise, cg_g_invitation and cg_g_offre): for ten minutes at most, they remember the page to reopen, the plan chosen on the pricing page and a single-use code that links the return from Google to the sign-in started in this browser. Necessary, no consent required, erased on return.
• Language choice (cookie cg_lang): remembers the language version you chose. Necessary for this feature, no consent required.

No cookie or storage is used for advertising or for tracking from one site to another: the site therefore shows no consent banner.

Processors

We use the following providers, bound by contract and subject to confidentiality and security obligations.

Transfers outside the European Union are governed by the European Commission's standard contractual clauses or, for certified companies, by the EU-US Data Privacy Framework.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent and to set directives on what happens to your data after your death.

To exercise them, write to us through the contact form, stating your request. We reply within one month. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Security

Exchanges are encrypted (HTTPS), passwords are never stored in clear, access to recordings is restricted to members of the customer account, and technical access is limited to the people who need it.

Changes

This policy is updated whenever a processing operation changes, for example when a tool or a provider is added. The date of the last update is shown at the top of the page.