Privacy notice

1. Who we are

Dorian Turcu trading as Zevorli is the controller of account, billing, support and website information. Our address is 30 Keats Close, Exmouth, EX8 5SR, United Kingdom. For privacy questions or requests, email contact@zevorli.com.

When a business uses Zevorli to handle its callers and customers, that business normally decides why and how their information is used. It is normally the controller and Zevorli acts as its processor. Callers may also contact the business they called about their information.

2. Information we handle

• Account and workspace information: name, email, authentication records, team role and business profile details.
• Customer and booking information: names, telephone numbers, email addresses, appointment details, enquiries, references and notes supplied during calls or by workspace users.
• Call information: caller and destination numbers, timestamps, duration, status, outcome, transcript, summary and call events. A recording link is retained only when the business enables recording.
• Subscription information: plan, subscription status, billing period and identifiers supplied by our payment provider. We do not store full payment-card details.
• Technical and security information: session data, integration status, service logs, audit history, error details and information needed to prevent abuse.
• Connected-service information: calendar selection and authorisation tokens, telephone configuration, and delivery status for email and SMS messages.

3. How we receive information

We receive information directly from account holders and workspace members, from callers and customers interacting with the receptionist, and from connected providers when they deliver calls, messages, bookings, authentication or billing services.

4. Why we use information and our legal bases

• To create accounts, provide the service, manage subscriptions and respond to support requests where necessary to perform our contract.
• To secure, monitor, troubleshoot and improve Zevorli, prevent abuse and keep appropriate business records where this supports our legitimate interests and does not override individual rights.
• To maintain tax, accounting, regulatory and legal records where we must comply with a legal obligation.
• To process information for a business customer under its documented instructions when Zevorli acts as a processor.
• To retain or use call recordings when the responsible business has enabled recording and established an appropriate legal basis, including consent where required.

5. AI receptionist and automated processing

The receptionist uses artificial intelligence to understand callers, generate replies and decide which configured action to request, such as checking availability or creating a booking. The service may summarise and classify calls. Zevorli does not use this automation to make decisions that have legal or similarly significant effects about individuals. Businesses should review sensitive or important matters and provide access to a human where appropriate.

6. Who receives information

Access is limited to authorised members of the relevant workspace and service providers that need the information to perform their role. The providers used by Zevorli include:

• Supabase for authentication and database infrastructure;
• Vercel for application hosting;
• Vapi and its configured AI and speech providers for voice calls;
• Twilio for telephone and SMS services;
• Google for optional sign-in and connected Google Calendar;
• Resend for email delivery; and
• Stripe and OneLink for checkout, subscriptions and payments.

We may also disclose information where legally required, to protect people or the service, or as part of a business reorganisation subject to appropriate safeguards. We do not sell personal information.

7. International transfers

Some providers may process information outside the United Kingdom. In those cases, we rely on an applicable adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. Contact us to ask for more information about the safeguard used for a relevant transfer.

8. How long information is kept

Each business chooses a transcript retention period between 1 and 365 days. At the end of that period, Zevorli deletes call transcripts and call events and removes stored summaries and recording links. Recording is disabled by default. Providers may apply their own retention periods to information in their systems.

Workspace information is kept while the workspace is active and is deleted when an authorised owner completes workspace deletion, subject to information we must retain for security, dispute resolution, tax, accounting or other legal obligations. Account, support, billing and audit records are kept only for as long as reasonably needed for those purposes.

9. Cookies

Zevorli uses strictly necessary cookies to keep users signed in, protect account sessions and remember the selected workspace. The service does not currently use advertising cookies. Essential cookies cannot be disabled through the site because the signed-in service cannot operate without them; you can remove them using your browser settings.

10. Your choices and rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict personal information, receive a portable copy, or object to its use. Where processing relies on consent, you may withdraw that consent without affecting earlier processing. These rights can have legal exceptions.

You have the right to object to processing based on legitimate interests. Email us and explain what you are objecting to so we can review the request.

Workspace owners can export workspace data from Data & privacy. For account information, or if you are a caller or customer, contact us or the business you dealt with. We may need to verify your identity and coordinate with that business before completing a request.

11. Security

We use access controls, secure production cookies, tenant separation, encryption for connected-calendar credentials, signed webhooks and activity logs to protect information. No online service can guarantee absolute security, so please use a strong password and tell us promptly if you suspect unauthorised access.

12. Complaints and updates

Contact us first so we can try to resolve a privacy concern. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We may update this notice as Zevorli or the law changes. We will post the updated version here and change the date above.