Privacy Policy
Product: Callpilot Data Controller: Nimuedtm ("the Controller") Version: 1.0 — 2026-06-09 Compliance: EU Regulation 2016/679 (GDPR)
1. Categories of data processed
The Controller processes, as data processor on behalf of the customer company ("Tenant") and as autonomous controller for internal management data:
Personal data of Tenant users (operators / supervisors):
- login credentials (email, password hashed with argon2id)
- display name, role, last login
- TOTP secret (admin only, hashed)
Operational call data (on behalf of the Tenant):
- phone numbers of called / calling leads
- call metadata (timestamp, duration, outcome, operator, campaign)
- audio recordings of calls (Opus codec 32 kbps)
- text transcripts of calls (generated by Qwen3 STT model in a
dedicated container managed by the Controller) - manual notes entered by operators
Desktop client security data:
- derived machine identifier (hash of hardware components,
non-reversible) - cryptographic hash of installed binary - security events (tampering, license heartbeat, errors) - crash reports (anonymous stack traces, opt-in)
2. Legal basis and purposes
- Contract performance (art. 6.1.b GDPR) for operational call
functions, lead management, reporting, billing. - Legitimate interest (art. 6.1.f) for product security: tampering detection, abuse prevention, fraud prevention. - Consent (art. 6.1.a) for opt-in telemetry (crash reports). - Legal obligation (art. 6.1.c) for retention of fiscal documents and data required by authorities.
3. Retention periods
| Category | Retention |
|---|---|
| User account | Contract duration + 12 months |
| Audio recordings | 12 months (configurable per Tenant, max 24) |
| Transcripts | Same retention as recording |
| Call metadata | 24 months |
| Security logs | 24 months |
| Crash reports | 6 months |
| Backups | 90 days rolling |
4. Data recipients
- Tenant (customer company): autonomous controller for own call
operational data; the Controller acts as processor. - Authorized technical personnel of Nimuedtm (least-privilege access, mandatory audit log). - Cloud infrastructure providers where used (with signed DPAs): no extra-EEA transfer without adequate safeguards.
Audio and transcripts are never sent to external LLM providers (e.g. OpenAI, Anthropic, Google): the STT/TTS pipeline is self-hosted on the Controller's infrastructure.
5. Data subject rights
The data subject has the right, at any time, to:
- access their data (art. 15 GDPR)
- request rectification (art. 16) or erasure (art. 17)
- restrict processing (art. 18)
- obtain portability (art. 20)
- object to processing (art. 21)
- lodge a complaint with the supervisory authority.
Requests are addressed to: privacy@nimuedtm.com.
6. Technical and organizational security
- TLS 1.3 for all communications (including audio WebSocket)
- At-rest encryption of recordings in object storage (Minio)
- argon2id hashing for passwords
- License manager with Fernet key bound to machine
- RSA-PSS SHA256 signed self-update
- Anti-tampering with automatic revocation
- PII-redacted logs (numbers, emails, tokens masked)
- Encrypted and replicated backups
7. International transfers
Data is processed on infrastructure located within the European Economic Area (EEA). Any extra-EEA transfer occurs only to countries with an adequacy decision or via Standard Contractual Clauses.
8. Policy changes
Material changes will be notified within the desktop client with a re-acceptance dialog.
Technical draft — legal review recommended before publication.