Privacy Policy

CallTape · Last updated: July 6, 2026

This Privacy Policy explains how CallTape (“CallTape,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects your personal data when you use the CallTape mobile application and related services (the “Service”). CallTape is a call-recording application: you place a call through your carrier, add the CallTape service line, and merge the calls into a three-way conference; the merged call is recorded on our servers and can be transcribed and summarized at your request.

Important — recordings and consent. CallTape records phone calls and processes their audio and transcripts using third-party services, including third-party artificial-intelligence (AI) providers. Recording laws vary by country and, in the United States, by state. In many jurisdictions all parties to a call must consent to being recorded. You are solely responsible for knowing and complying with the recording-consent laws that apply to you and to the other parties on your calls, and for obtaining their consent before recording. See our Terms of Use.

1. Who is responsible for your data (Data Controller)

The data controller responsible for your personal data is Codexia, the operator of the CallTape service. For any privacy question or request, contact us at [email protected] — this is the fastest way to reach the team responsible for your data.

2. Data we collect

Category	Examples	Purpose
Account & identity	Phone number, user ID, authentication tokens	Create and secure your account (phone/SMS login)
Call recordings	Audio of calls you record through the Service	Provide the core recording feature
Transcripts & summaries	Text transcript of recordings, AI-generated summary and action items	Provide transcription and summary features, when you request them
Call metadata	Call time, duration, the name/title you give a recording, processing status	Organize and display your recordings
Subscription data	Purchase history, entitlement status (via RevenueCat / Apple)	Manage your subscription
Device & technical	Push token, device identifiers, crash logs, diagnostics, app usage analytics	Deliver notifications, security, stability, and service improvement

CallTape does not access your device’s address book and does not record audio through your device’s microphone; recording happens on our servers through the merged conference call.

Special-category data. Call content can, by its nature, contain sensitive information (for example about health, beliefs, or other private matters). Where such information is present, we process it only on the basis of your explicit consent, expressed through the recording and transcription actions you actively initiate, and solely to provide the features you request.

3. Legal basis for processing (GDPR)

Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:

Consent (Art. 6(1)(a); Art. 9(2)(a) for special-category data) — for recording calls, transcribing them, generating AI summaries, and sharing call content with our AI sub-processors. Before your first recording, the app asks you to explicitly confirm your recording-consent responsibilities, and we keep a record of the date and text version of that confirmation. Each recording and each transcription happens only when you actively start it. You may withdraw consent at any time by not using these features and by deleting your recordings.
Performance of a contract (Art. 6(1)(b)) — to provide the account, subscription, and app features you sign up for.
Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, and improving reliability, balanced against your rights.

4. How your recordings are processed and shared (sub-processors)

To provide the Service we share personal data with the third-party processors below. Each processes data on our behalf. We do not sell your personal data.

Provider	Role	Data shared
Telnyx	Carrier connectivity (SIP) — carries the merged conference call	Phone numbers, call routing metadata, call audio in transit
Twilio	Provisioning and management of CallTape service phone numbers	Phone numbers, routing metadata
Cloudflare R2	Temporary storage of recordings	Call audio files
Deepgram	Speech-to-text transcription, including speaker separation (AI)	Call audio
Google (Gemini API)	AI summary & action items (AI)	Call transcript text
Google Firebase	Authentication, push notifications, crash reporting, app analytics	Phone number, device/push token, diagnostics, usage data
RevenueCat	Subscription management	User ID, purchase/entitlement data

Third-party AI. Transcription and summaries run only when you request them: call audio is sent to Deepgram only when you start a transcription, and transcript text is sent to Google’s Gemini API only when a summary is generated for you. Under our agreements with these providers, your call content is processed to provide the feature and is not used to train the providers’ AI models. If you do not use these features, your call content is not shared with these AI providers.

5. International data transfers

Our providers may process data in the United States and other countries. Where we transfer personal data outside the EEA, the UK, or Türkiye, we rely on appropriate safeguards such as Standard Contractual Clauses and, for transfers under Turkish law (KVKK), your explicit consent and/or KVKK standard contracts. You may request more information about these safeguards using the contact details above.

6. How long we keep your data (retention)

Call recordings: a recording is deleted from our cloud storage immediately when you download it to your device. Recordings you do not download are deleted automatically after 7 days.
Transcripts, summaries, and call metadata: kept while your account is active so you can access them, and deleted when you delete the recording or your account.
Account data: kept while your account is active. When you request account deletion, your account is deactivated immediately and your account data and associated recordings, transcripts, and metadata are permanently deleted within 30 days.

7. Your rights

Depending on where you live, you have the following rights. To exercise any of them, contact [email protected].

All users

Delete individual recordings in the app at any time.
Delete your entire account and associated data from within the app (Settings → Delete Account). Deletion is completed within 30 days.
Stop using the recording or AI features at any time — they only run when you initiate them.

GDPR (EU/UK)

Access, rectification, erasure, restriction, portability, and objection.
The right to withdraw consent, and to lodge a complaint with your supervisory authority.

KVKK (Türkiye)

Rights under Article 11 of Law No. 6698, including learning whether your data is processed, requesting correction or deletion, and objecting to processing.

CCPA/CPRA (California)

The right to know, delete, correct, and to limit the use of sensitive personal information. We do not sell or “share” personal information for cross-context behavioral advertising.

8. Security

We protect your data with encryption in transit (HTTPS/TLS), access controls, and reputable infrastructure providers. Recording download links are short-lived and access-restricted, and recordings are removed from cloud storage on download or after 7 days. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the relevant authorities of a data breach where required by law.

9. Children’s privacy

The Service is not directed to children under the age required by law in your country (at least 16, or 13 where permitted with appropriate consent). We do not knowingly collect data from children below that age. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date above and, where required, notify you in the app. Continued use of the Service after an update means you accept the revised policy.

11. Contact

Questions or requests: [email protected].