Privacy Policy

1. Who We Are

Aftertalk (“Aftertalk”, “we”, “our”, “us”) is a Polish-first call analytics platform that helps phone teams transcribe, analyse, and understand their conversations. Aftertalk is the trading name of Kacper Kądziołka, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in the Central Register and Information on Economic Activity (CEIDG) of the Republic of Poland.

Registered address: ul. Czerwone Maki 31B/21, 30-392 Kraków, Poland
NIP: 6762706032 · REGON: 543141869
Contact: privacy@aftertalk.co

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR/RODO) and applicable Polish law. We have not appointed a Data Protection Officer, as this is not currently required under Article 37 GDPR given the scale of our processing.

2. Our Two Roles: Controller and Processor

Aftertalk acts in two different roles depending on the type of data:

• Controller: for your account, billing, and usage data. This Policy describes how we process that data.
• Processor: for the audio recordings, transcripts, and related content you upload (“Customer Content”). You, or the organisation you represent, remain the controller of that data, and we process it only on your instructions, as described in our Data Processing Agreement (see Section 12).

If you are an individual whose call was recorded by one of our customers and you have a question about that recording, please contact that organisation directly. Aftertalk does not have a direct relationship with you and will assist our customer in responding to your request.

Our customers are responsible for having a lawful basis to record and upload calls, and for providing any notice required by law to the people on those calls.

3. What Data We Collect

Account data

When you register, we collect your email address and a hashed password. We never store plain-text passwords. If you sign in with Google or Microsoft, we receive your email address and your account ID with that provider; we never see the password for those accounts.

When you belong to an organisation, we also process your role and membership in organisations and projects. If someone invites you to an organisation, we store your email address and the role from the invitation in order to send and handle it.

Providing an email address is required to create an account and use the Service; without it we cannot enter into an agreement with you.

Audio recordings and transcripts

You upload audio files (call recordings) to the platform. We process these to generate transcripts, sentiment scores, topic tags, and other analytics. Audio files are stored encrypted and remain associated with your project.

Usage data

We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate, secure, and improve the Service. Where necessary to protect the Service, we may block access from specific IP addresses and retain a record of those blocks for security and abuse prevention.

For security and abuse prevention we also keep an audit log of security-relevant events — such as sign-in attempts and administrative actions taken on an account — recording the event, the IP address and browser (user-agent) involved, and a timestamp. We retain these records for as long as needed for security and to meet our legal obligations.

We also use PostHog, an EU-hosted product analytics service, to understand how the Service is used: which pages are visited, basic device and browser information, and the referring site. When you are signed in, these events are linked to your account (user ID and email address); events from visitors who are not signed in are not linked to any profile. Our analytics runs in cookieless mode and stores no identifiers on your device (see Section 8).

Billing data

Payment processing is handled by Stripe, our third-party payment provider, which acts as merchant of record for paid subscriptions. Stripe collects and processes your payment details directly under its own privacy policy; we store only transaction references and plan information, never full card numbers.

4. How We Use Your Data

We process your data for the following purposes:

• Providing the Service: account creation, authentication, organisation membership and support (Art. 6(1)(b) GDPR, performance of a contract). We transcribe and analyse calls as a processor on the customer's instructions (see Section 2).
• Transactional communications: account activation, billing receipts, and service notices (Art. 6(1)(b) GDPR, performance of a contract).
• Security and service improvement: detecting abuse, monitoring performance, and improving the platform, including through the product analytics described in Section 3 (Art. 6(1)(f) GDPR, our legitimate interest in keeping the Service safe, reliable, and useful).
• Legal obligations: for example, responding to requests from authorities and keeping records required by law (Art. 6(1)(c) GDPR).

We do not sell your personal data, and we do not use recordings, transcripts or other Customer Content to train or improve any AI models or for any purpose of our own.

5. AI-Powered Analysis

We use automatic speech recognition and AI/machine-learning models to generate transcripts, sentiment indicators, topic categorisation, and quality or template scores from Customer Content (“AI Output”).

This is automated processing of conversation content. Aftertalk does not itself make any automated decision that produces legal or similarly significant effects on an identifiable individual. Where AI Output is used to evaluate or make decisions about people (for example, an employee's call performance), that decision is made by our customer, who acts as controller for that purpose.

AI Output is generated probabilistically and may contain errors. See our Terms of Service for important limitations on AI Output.

6. Masking Personal Data & Voice Data

Before a transcript goes to AI analysis, Aftertalk automatically detects personal data in it (e.g. names, phone numbers, PESEL numbers) and replaces it with placeholders. This is pseudonymisation, not anonymisation: the recording and the full transcript are still stored and visible to the customer. The recording reaches the transcription provider unmasked.

Aftertalk analyses the content of transcribed conversations (e.g. topics, sentiment, quality scores). We do not create voiceprints, perform voice or speaker biometric identification, or otherwise process voice as biometric data for the purpose of uniquely identifying any individual within the meaning of Article 9 GDPR.

Default speaker labels used in transcripts (e.g. “Speaker 1”, “Konsultant”) are not biometric identifiers. Customers can configure their own labels, including assigning the names of specific individuals; that configuration and its legal basis form part of Customer Content, for which the customer is responsible as controller (see Section 2).

7. International Data Transfers

Some of our sub-processors may be located outside the European Economic Area (EEA), including in the United States. Where this is the case, we rely on one of the following safeguards required by Chapter V GDPR:

• the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), for recipients certified under that framework; or
• the European Commission's Standard Contractual Clauses (Art. 46 GDPR), together with appropriate supplementary measures, for other recipients.

Masking personal data (Section 6) limits the data sent for AI analysis; recordings reach the transcription provider unmasked. The transfer mechanism for each provider, including those for which we are the controller (e.g. analytics, Google or Microsoft sign-in), is listed on the Sub-processors page. You can request more information about the safeguards that apply to a specific transfer by emailing privacy@aftertalk.co.

8. Cookies

We use a small number of cookies that are necessary for the Service to operate or remember settings you choose:

• at and rt, authentication tokens that keep you signed in.
• NEXT_LOCALE and NEXT_TZ: your preferred language and time zone.
• atLastOrg, atLastProject and atLastPath: the organisation, project and page you used last, to take you back there after signing in or from the docs.
• sidebarCollapsed: whether the sidebar is collapsed.

We also keep the date range you picked on dashboards in browser storage (localStorage). It contains no personal data and is not used for tracking.

These cookies are exempt from consent requirements under Polish law (Art. 399(3) of the Law on Electronic Communications), as they are necessary to provide a service you have explicitly requested. We do not currently use analytics, advertising, or marketing cookies. If this changes, we will ask for your consent before setting any such cookies.

Our product analytics (see Section 3) sets no cookies and stores no identifiers on your device, including in browser storage.

9. Data Retention

• Recordings, transcripts and analyses (Customer Content): until the customer deletes the call, or until the data is returned or deleted at the end of the relationship under Section 10 of the Data Processing Agreement. Deleting a call removes its recording, transcript and analyses at once.
• Account data: until the account is closed (Terms, Section 11), and then for the limitation period of any claims.
• Billing data: Stripe issues and keeps invoices as the merchant of record; we keep transaction references and plan history for as long as the account exists.
• Database backups: 7 days; data deleted from our systems is gone from backups within that time.

10. Your Rights

Under GDPR/RODO, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• request erasure (“right to be forgotten”);
• request restriction of processing;
• receive your data in a portable, machine-readable format; and
• lodge a complaint with the Polish data protection authority (Urząd Ochrony Danych Osobowych, “UODO”).

Right to object: you can object at any time to processing of your data based on our legitimate interest (Art. 21 GDPR), including product analytics. We will then stop processing it for that purpose unless we show compelling legitimate grounds that override your interests, or need it to establish or defend legal claims.

To exercise any of these rights regarding your account data, email privacy@aftertalk.co. We will respond within 30 days. If your request relates to a call recorded by one of our customers, please contact that organisation directly. We will assist them in responding to you.

11. Data Security & Sub-processors

All data is transmitted over HTTPS. Audio files and transcripts are encrypted at rest. We apply access controls so that only authorised personnel can access your project data, and we conduct regular security reviews.

We use a limited number of sub-processors to operate the Service, such as cloud hosting, speech-to-text and AI analysis, email delivery, product analytics, and payment processing. Each sub-processor is contractually bound to process data only on our instructions, to apply appropriate security measures, and to comply with GDPR. The current list of sub-processors, including their location and transfer safeguard, is published on the Sub-processors page.

12. Data Processing Agreement

For Customer Content that contains personal data, we act as a processor on your behalf under a Data Processing Agreement (DPA) that reflects the requirements of Article 28(3) GDPR, including the scope and purpose of processing, confidentiality, security measures, sub-processing, and assistance with data-subject requests and deletion on termination. The DPA is published on the Data Processing Agreement page; for a copy signed by both parties, email privacy@aftertalk.co.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by email or an in-app banner at least 30 days before they take effect.

14. Contact

Questions about this policy or how we handle your data? Email privacy@aftertalk.co.