Privacy Policy | Aria Calls

Section 1 — Introduction

Dilypse International is committed to protecting the personal data of users of the Aria Calls platform. This Privacy Policy describes the data we collect, why we collect it, and your rights as a user, in accordance with Quebec's Law 25 (Act to modernize legislative provisions respecting the protection of personal information) and the General Data Protection Regulation (GDPR) for users located in the European Union.

Section 2 — Data Controller

Company name: Dilypse International
Address: 2000 R. de l'Eclipse, Suite 800, Brossard, Quebec J4Z 0S2, Canada
Privacy contact: [email protected]

Section 3 — Data Collected

Category	Data	Source
User account	Email, name, role, password (hashed)	Registration / administrator
Calls	Transcriptions, audio recordings, AI summaries, duration, cost	VAPI (automatic)
CRM	Contacts, tags, notes, reminders	User input
Technical	IP address, browser, error logs	Automatic collection
Customer memory	Conversational history per caller	AI (automatic)

Section 4 — Purposes of Processing

Your personal data is processed for the following purposes:

Provision and operation of the Aria Calls service
Sending post-call notifications (email and SMS) to configured recipients
Statistical analysis and dashboards
Improving the service and artificial intelligence
Customer support
Security and fraud prevention

Section 5 — Legal Basis for Processing

Performance of a contract: processing is necessary for the operation of the SaaS service subscribed to by the user
Consent: for marketing communications, where applicable
Legitimate interest: service security, continuous improvement, fraud prevention
Legal obligation: data retention required by law

Section 6 — Sub-processors and Third Parties

To provide the Aria Calls service, we use the following sub-processors:

Sub-processor	Service	Location
VAPI, Inc.	AI voice agents, transcription	United States
Twilio, Inc.	Telephony, SMS	United States
Supabase, Inc.	Database, authentication	Singapore / United States
Amazon Web Services	S3 storage	United States / Canada
Brevo (Sendinblue)	Transactional emails	France
Sentry	Error monitoring	United States
Anthropic (Claude)	Conversational AI	United States

Section 7 — International Transfers

Some of our sub-processors are located outside of Canada, particularly in the United States. These international data transfers are governed by standard contractual clauses or equivalent safeguards, in compliance with Quebec's Law 25 requirements, ensuring an adequate level of protection for your personal data.

Section 8 — Data Retention

Data	Retention Period
User account	Duration of the contract + 1 year after termination
Call recordings (VAPI)	14 days
Call logs (Supabase)	Duration of the contract
Customer memory (S3)	Duration of the contract
Technical logs	90 days

Section 9 — Security

Dilypse International implements the following technical and organizational measures to protect your data:

Encryption of communications via HTTPS/TLS
Authentication via signed JWT tokens
CORS restriction to the production domain
Rate limiting to prevent abuse
Security headers (HSTS, CSP, Permissions-Policy)
Password hashing
Role-based access control (RBAC)

Section 10 — User Rights

In accordance with Quebec's Law 25 and the GDPR (for European Union users), you have the following rights:

Right of access: obtain a copy of your personal data
Right to rectification: correct inaccurate or incomplete data
Right to erasure: request the deletion of your data
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to the processing of your data on legitimate grounds
Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at [email protected]. We commit to responding within 30 days.

Section 11 — Cookies and Local Storage

Aria Calls uses the browser's local storage (localStorage) for the following purposes:

Type	Name / Key	Purpose	Duration
localStorage	sb-*-auth-token	Supabase authentication session	Session
localStorage	aria_locale	Language preference (FR/EN)	Persistent
localStorage	aria_i18n_*	Translation cache	Persistent

No advertising or third-party tracking cookies are used.

Section 12 — Amendments

Dilypse International may update this Privacy Policy at any time. Changes will be published on this page with an updated date. Users will be notified of significant changes via email or a notification in the dashboard.

Section 13 — Contact

For any questions regarding the protection of your personal data, please contact us:

Email: [email protected]
Address: Dilypse International, 2000 R. de l'Eclipse, Suite 800, Brossard, Quebec J4Z 0S2, Canada