How Ringroxy handles personal data

Who is responsible?

NXT Vizion AB, reg. no. 559575-0141, Sweden, provides the Ringroxy platform. The business customer is controller for caller data and Ringroxy processes it on the customer's documented instructions. NXT Vizion AB is controller for its own account, contract, billing, and security data.

What data is processed?

• Voice recordings – Audio from phone calls handled by the AI agent.
• Transcriptions – Text versions of the call audio.
• AI summaries – Automated call summaries and extracted action items.
• Phone numbers – Caller and business phone numbers.
• Metadata – Call timestamps, duration, and routing information.
• Account data – Name, email, company information you provide during registration.

Why is data processed?

Data is processed solely to provide the Ringroxy service: answering calls, making bookings, generating summaries, and sending notifications. We do not sell personal data or use it for unrelated purposes.

Where is data stored?

Our primary application and database storage is configured in the EU/EEA. Telecoms, AI, payment, and error-monitoring providers may process data globally or from countries outside the EU/EEA. Where a restricted transfer occurs, we use a valid transfer mechanism, normally the EU Standard Contractual Clauses, and supplementary safeguards where required.

If Gemini Live transcription is enabled, live call audio is sent to Google Cloud's global Vertex AI endpoint. A global endpoint does not provide regional isolation. Session resumption is disabled and we do not instruct Google to use customer data for model training. Limited provider-side technical caching or security logging is governed by the provider terms and our agreement with that provider.

How long is data kept?

• Voice recordings: 30 days
• Raw transcriptions: 7 days
• Redacted transcriptions: 90 days
• AI summaries and call metadata: 12 months

You may choose shorter retention periods at any time.

Your rights

Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, objection, and portability, and may complain to a supervisory authority. Callers should first contact the business they called; we assist that customer with the request. Customers may contact ••••@••••••.com.

Sub-processors

Ringroxy uses trusted sub-processors (cloud hosting, telecom, AI model providers) required to deliver the service. A full list is available in the DPA.

Data breach notification

If a personal data breach occurs, we will notify you without undue delay and assist you in meeting your notification obligations to the relevant supervisory authority within 72 hours.