Privacy Policy

1. Who we are

This policy explains how MEGA PROMOTING S.R.L. processes personal data through the site kallina.info, the Kallina AI platform (app.kallina.info) and Kallina AI voice agents.

• Operator: MEGA PROMOTING S.R.L., Republic of Moldova
• IDNO: 1019600021765
• E-mail, including for data protection: contact@kallina.info
• Phone: +373 61 066 888

For persons in the European Union, we apply Regulation (EU) 2016/679 (GDPR). As we are registered in the Republic of Moldova, we also apply Law no. 195/2024 on the protection of personal data.

2. Two different roles

2.1. We are the controller for the data of website visitors, people who request a demo or write to us, and customers who create an account in Kallina AI.

2.2. We are the processor for the data in the calls that Kallina AI agents carry out on behalf of our customers. In this case, the controller is the company using the agent (for example, the shop or clinic you are calling). We process this data only on its instructions, on the basis of a data processing agreement (DPA). Requests regarding this data should first be addressed to that company; if you write to us, we will forward them to the company.

3. What data we process

3.1. From website forms (demo, contact): name, company, telephone number, e-mail address, request description, the page from which the form was submitted, the page on which you entered the site, the website host from which you came, the anonymised prefix of the IP address and, if you came from a campaign, the campaign tags.

3.2. From the Kallina AI account: name, email, phone, billing details, agent settings, dashboard access logs.

3.3. From the agents’ calls and conversations:

• the phone number of the caller or the person called;
• the audio recording of the conversation;
• the transcript of the conversation;
• the summary, the tone of the conversation and the extracted fields (for example name, address, appointment time, outcome);
• technical call data: date, time, duration, status, proof that the recording notice was spoken.

3.4. From the voice button on the site: sound captured by the microphone during the conversation, transcript and technical session data. The microphone is used only after you allow it in the browser and only for as long as the conversation lasts.

3.5. Technical site data: IP address, browser type, pages accessed, in server logs. What the site stores in the browser is described in the Cookie Policy.

3.6. Optional Google Sheets connection

The Google Sheets connection in Kallina AI is separate from signing in to the Kallina AI account. You start it from the integration page and authorise access in the Google screen. You can use the platform without this connection.

Access and use: we request Google Sheets permission to read and modify spreadsheets and permission for the Google account email address, used to identify the connection. The Google Sheets permission applies to spreadsheets accessible to the authorised account, not just to a single table. In Kallina AI, you enter the table link, choose the sheet, range and columns for the configured operations. We do not request permission to list Google Drive files for this integration.

We use this data for the functions you configure: reading the table structure and values, importing contacts, synchronising lists, and writing call results into the chosen columns. The Google Sheets flows you configure can create spreadsheets and can add, update, delete rows or clear ranges. We do not request access to Gmail content through the Google Sheets integration.

Stored data: Google email address, table identifier, sheet name, column mapping and integration settings; imported contacts, including name, phone, email, location and language; OAuth tokens needed for access and connection renewal; technical connection and operation events. When contacts are imported, non-empty values in columns A–Z of the imported rows are also kept as additional data, including columns that are not mapped to a standard field. The tokens are stored encrypted on the server and are used by server functions for requests to Google. We do not publish the tokens in the table or in the integration interface.

Transfer: read and write requests are sent to the Google Sheets API. The contacts you import enter your workspace. If you use them in a campaign or a flow, the data needed for that action may reach the voice providers, AI model providers, or the integrations activated by you, described in sections 6 and 7. The OAuth authorisation does not on its own activate a campaign and does not automatically send the contact list to another client.

Retention and disconnection: the tokens are kept as long as the connection is active. Disconnecting from the Google Sheets page deletes the OAuth connection and its tokens from the active Kallina AI database. This action does not delete the table in Google, already imported contacts, integration configurations or call history. Imported data is kept for use of the service; its deletion is requested under section 10. There is currently no separate automatic deletion period for data imported from Sheets.

Disconnecting from Kallina AI does not automatically revoke the authorisation in the Google account. You can separately withdraw access from Google Account connections. Deleting the connection from the active database does not mean immediate removal from backups; for a full deletion request, write to contact@kallina.info.

We do not intentionally ask for special categories of data (health, religion, biometric data for identification). If a caller says them in the conversation, they end up in the recording and transcript; our customer sets in the scenario whether the agent may ask for them.

4. Why and on what basis

• Response to a demo or contact request (the data from 3.1): pre-contractual measures at the person’s request.
• Providing the platform and the account (3.2): performance of the contract.
• Billing and accounting records (3.2): legal obligation.
• Operation of agents for clients (3.3, 3.4): the client-operator’s instructions, on the basis chosen by them.
• Platform security and abuse prevention (3.2, 3.5): legitimate interest.
• Kallina AI news messages (email): consent, which you can withdraw at any time.

5. Call recording

From 9 September 2026, on calls that pass through our telephony server, before recording starts an announcement is played that the call is being recorded, in Romanian, Russian or both. We keep, for each call, proof that the announcement was played. Customers who connect Kallina AI agents through their own telephony are responsible for informing callers on that route.

6. Who we share data with

We do not sell personal data. We share it only with:

• providers who help us operate the service (the list in section 7), on a contractual basis; the request submitted through the website forms also reaches, as an internal notification, Telegram;
• to our client, for data from its agent’s calls, including in the CRM it has connected (for example amoCRM/Kommo, Bitrix24, Zoho, Altegio, Odoo, Google Sheets, Syrve);
• to the authorities, when we are required by law.

7. Sub-processors

• OVHcloud: server hosting (database, panel, telephony).
• ElevenLabs: speech recognition, voice synthesis, conversation session.
• Google (Gemini): language model and post-call analysis.
• Infobip: sending SMS messages.
• Microsoft 365: e-mail.
• Telegram: internal notification of requests received through the website forms. It receives the name, contact details and the text of the request submitted through the form.

The updated list is on the Security and Data page.

8. International transfers

Transfers to states of the European Economic Area are not international transfers within the meaning of Law no. 195/2024 (art. 44 para. 2). For providers outside the EEA, including in the USA, we use the standard contractual clauses adopted by the European Commission (art. 46 para. 2 lit. c). Certifications declared by providers (for example Data Privacy Framework) we treat as additional safeguards, not as a basis for transfer.

9. How long we keep data

• Demo requests and contact messages: 24 months from receipt, unless they become a contractual relationship. The term is applied automatically by the log in which the requests are written.
• Account data: for the duration of the contract.
• Billing documents: the period required by accounting and tax legislation.
• Audio recordings, transcriptions and call summaries: the term established in the contract with the client using the agent. Today, deletion at this term is not automatic: we do it at the request of the client-controller or the data subject, written to the contact address. We are working on scheduled deletion and will update this section when it runs.

At the end of the term, the data are deleted or anonymised.

10. Your rights

You have the right:

• to find out whether we are processing your data and to receive a copy (access);
• to request the correction of incorrect data (rectification);
• to request the deletion of data (erasure);
• to request restriction of processing;
• to receive the data in a structured format and transmit them to another controller (portability);
• to object to processing based on legitimate interest;
• to withdraw your consent at any time, without affecting the processing carried out until then;
• not to be subject to a decision based solely on automated processing that significantly affects you.

Write to contact@kallina.info. We respond within no more than one month from receipt of the request. The term may be extended by a further two months for complex or numerous requests; we will notify you within the first month. We may request information to confirm your identity.

For data from an agent’s calls, the request can be handled fastest by the company using the agent. If you write to us, we will forward it to that company.

11. Complaints

You can lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (datepersonale.md). If you are in the European Union, you may also contact the data protection authority in your state.

12. Security

We use encrypted connections (HTTPS/TLS), access to data limited to the people who need it, server-issued voice sessions and servers managed by us. The measures are described on the Security and Data page. If a security incident affects your data and poses a risk, we notify the authority within 72 hours and, where applicable, the affected persons.

13. Minors

Kallina AI is a service for companies. We do not address the website and platform to persons under 18.

14. Changes

When we change this policy, we change the date above. Customers with an account are notified by e-mail about important changes.

15. Contact

MEGA PROMOTING S.R.L. · IDNO 1019600021765 · contact@kallina.info · +373 61 066 888