Privacy policy

The controller of your personal data is IL Goldberg Solutions SIA, a company registered in Latvia with its registered office in Riga (“Call G”, “we”, “us”). Registration number to be published on the imprint at launch.

For any privacy matter, including to exercise your rights, contact our Data Protection contact at privacy@callg.eu or by post at IL Goldberg Solutions SIA, Riga, Latvia. We aim to respond within 30 days.

Call G is a call-screening service, so the data we handle is unusually sensitive. We process:

• Account data — your email address, country, locale, and the phone number(s) you protect (in E.164 format), plus labels you give them (e.g. “Mum’s phone”).
• Call metadata — for each screened call: time, caller number, duration, the screening verdict (connected, message, blocked), an intent category and a scam score.
• Call recordings and transcripts — the assistant’s screening conversation with unknown callers is recorded and transcribed so you can review what happened. Transcripts are the primary record; audio is a time-limited backup.
• Hashed contact indicators — to recognise your saved contacts, numbers are hashed on your device before they reach us. We never receive your address book and do not store readable contact lists.
• Billing data — handled by Stripe; we store a customer reference and plan status, not your full card details.
• Technical data — minimal logs needed to run and secure the service.

We do not create voice biometrics or speaker identification profiles. Scam detection works on what is said, not on who is speaking.

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the screening service you subscribe to, including recording and transcribing screened calls.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention and improving screening accuracy. We have carried out a balancing assessment; you may object at any time.
• Legal obligation (Art. 6(1)(c)) — to meet tax, accounting and lawful requests.
• Consent (Art. 6(1)(a)) — where a specific market requires it for call recording, and for any non-essential cookies. You can withdraw consent at any time.

Callers reaching the assistant are told, in the first sentence, that they are speaking to an AI and that the call is recorded and analysed. We rely on this notice and the legitimate interest of the subscriber in screening unsolicited calls; in markets with stricter all-party consent rules (e.g. Germany) we launch only after a country-specific legal review.

Recordings auto-delete on your plan’s retention schedule — 7 days on Basic, 90 days on Plus and Family, and 365 days on Business. Transcripts and call metadata follow the same schedule by default. You can shorten retention or delete any individual call from your dashboard at any time.

When you delete your account, we erase your call data and recordings and remove personal data from active systems, retaining only what we are legally required to keep (for example, invoices for accounting) for the statutory period. Backups are purged on a rolling cycle.

We use a small number of carefully chosen processors, each under a data processing agreement and, where data may leave the EU, EU Standard Contractual Clauses:

Call recordings and transcripts are stored only on EU infrastructure (Hetzner, Germany / Finland). The transcription and language-model steps process call audio or text transiently to do their job and do not retain it for their own purposes under our agreements.

Recordings are encrypted before they touch storage using per-recording keys (AES-256-GCM envelope encryption). Every access to a recording — including by our own staff — is written to an immutable audit log you can request. Access to production systems is least-privilege and logged. More detail is on our Security & privacy page.

Call G uses an AI assistant to converse with unknown callers. In line with the EU AI Act (Art. 50) and recording-consent rules, the assistant always discloses that it is an AI and that the call is recorded and analysed, at the start of every screened call. It will never claim to be a human, and we do not clone your voice.

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a machine-readable export;
• rectify inaccurate data and complete incomplete data;
• erase your data (“right to be forgotten”);
• restrict or object to processing, including processing based on legitimate interests;
• data portability;
• withdraw consent where processing is based on it, without affecting prior processing.

Export and full erasure are self-service in your dashboard — no support ticket needed. You also have the right to lodge a complaint with your local supervisory authority, or with the Latvian Data State Inspectorate (Datu valsts inspekcija).

Data requests and privacy questions: privacy@callg.eu. We will publish our named Data Protection contact and full company registration details on the imprint at launch.

We may update this policy as the service evolves; we will post the new version here with an updated effective date and, for material changes, notify you by email.