Section 1 — Introduction
Dilypse International is committed to protecting the personal data of users of the Aria Calls platform. This Privacy Policy describes the data we collect, why we collect it, and your rights as a user, in accordance with Quebec's Law 25 (Act to modernize legislative provisions respecting the protection of personal information) and the General Data Protection Regulation (GDPR) for users located in the European Union.
Section 2 — Data Controller
- Company name: Dilypse International
- Address: 2000 R. de l'Eclipse, Suite 800, Brossard, Quebec J4Z 0S2, Canada
- Privacy contact: [email protected]
Section 3 — Data Collected
| Category | Data | Source |
|---|---|---|
| User account | Email, name, role, password (hashed) | Registration / administrator |
| Calls | Transcriptions, audio recordings, AI summaries, duration, cost | VAPI (automatic) |
| CRM | Contacts, tags, notes, reminders | User input |
| Technical | IP address, browser, error logs | Automatic collection |
| Customer memory | Conversational history per caller | AI (automatic) |
Section 4 — Purposes of Processing
Your personal data is processed for the following purposes:
- Provision and operation of the Aria Calls service
- Sending post-call notifications (email and SMS) to configured recipients
- Statistical analysis and dashboards
- Improving the service and artificial intelligence
- Customer support
- Security and fraud prevention
Section 5 — Legal Basis for Processing
- Performance of a contract: processing is necessary for the operation of the SaaS service subscribed to by the user
- Consent: for marketing communications, where applicable
- Legitimate interest: service security, continuous improvement, fraud prevention
- Legal obligation: data retention required by law
Section 6 — Sub-processors and Third Parties
To provide the Aria Calls service, we use the following sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| VAPI, Inc. | AI voice agents, transcription | United States |
| Twilio, Inc. | Telephony, SMS | United States |
| Supabase, Inc. | Database, authentication | Singapore / United States |
| Amazon Web Services | S3 storage | United States / Canada |
| Brevo (Sendinblue) | Transactional emails | France |
| Sentry | Error monitoring | United States |
| Anthropic (Claude) | Conversational AI | United States |
Section 7 — International Transfers
Some of our sub-processors are located outside of Canada, particularly in the United States. These international data transfers are governed by standard contractual clauses or equivalent safeguards, in compliance with Quebec's Law 25 requirements, ensuring an adequate level of protection for your personal data.
Section 8 — Data Retention
| Data | Retention Period |
|---|---|
| User account | Duration of the contract + 1 year after termination |
| Call recordings (VAPI) | 14 days |
| Call logs (Supabase) | Duration of the contract |
| Customer memory (S3) | Duration of the contract |
| Technical logs | 90 days |
Section 9 — Security
Dilypse International implements the following technical and organizational measures to protect your data:
- Encryption of communications via HTTPS/TLS
- Authentication via signed JWT tokens
- CORS restriction to the production domain
- Rate limiting to prevent abuse
- Security headers (HSTS, CSP, Permissions-Policy)
- Password hashing
- Role-based access control (RBAC)
Section 10 — User Rights
In accordance with Quebec's Law 25 and the GDPR (for European Union users), you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to the processing of your data on legitimate grounds
- Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing
To exercise your rights, contact us at [email protected]. We commit to responding within 30 days.
Section 11 — Cookies and Local Storage
Aria Calls uses the browser's local storage (localStorage) for the following purposes:
| Type | Name / Key | Purpose | Duration |
|---|---|---|---|
| localStorage | sb-*-auth-token | Supabase authentication session | Session |
| localStorage | aria_locale | Language preference (FR/EN) | Persistent |
| localStorage | aria_i18n_* | Translation cache | Persistent |
No advertising or third-party tracking cookies are used.
Section 12 — Amendments
Dilypse International may update this Privacy Policy at any time. Changes will be published on this page with an updated date. Users will be notified of significant changes via email or a notification in the dashboard.
Section 13 — Contact
For any questions regarding the protection of your personal data, please contact us:
- Email: [email protected]
- Address: Dilypse International, 2000 R. de l'Eclipse, Suite 800, Brossard, Quebec J4Z 0S2, Canada