Privacy Policy

1. Data controller identity

The data controller is Digital Leadership SRL, registered at Strada Viorelelor 17A, Dezmir, Cluj County, 407039, Romania, Tax ID (CUI) 38585123, J2017006715126, operating the Linia Directă platform (liniadirecta.ro).

• Contact email: contact@liniadirecta.ro
• Data Protection Officer (DPO): dpo@liniadirecta.ro

2. Categories of data processed

Depending on your relationship with our platform, we process the following categories of data:

2.1 Account data (Clients)

• Email address
• Password (stored encrypted, bcrypt hash)
• Account creation date

2.2 Business data

• Company/location name
• Physical address
• Phone number
• Business hours
• List of specialties/services offered
• Team members (name, specialty/role)

2.3 Phone call data

• Caller's phone number
• Transcripts of conversations with the virtual assistant
• Audio recordings of calls (only if the recording feature is enabled)
• Call duration and date
• Automatically generated call summary

Sensitive data:We do not solicit special category data. Depending on the Client's field of activity, callers may nonetheless volunteer such information during a conversation. Any special category data contained in a transcript is processed solely to deliver the service, on the Client's documented instructions and under our Data Processing Agreement, in our capacity as the Client's processor, never for any other purpose. Callers are advised to share only the information necessary for their request.

2.4 Appointment data

• Caller name
• Phone number
• Appointment date and time
• Requested service
• Appointment status

2.5 Billing data

• Payment data is managed entirely by Stripe. We do not store card details on our servers.
• We only store: Stripe customer ID, active subscription plan, and payment status.

3. Purposes of processing

• Providing the AI virtual receptionist service: answering calls, managing appointments, transferring to reception
• Appointment management: creating, modifying, and cancelling appointments through the virtual assistant
• Billing and payments: processing monthly subscriptions through Stripe
• Service improvement: analysing call logs for quality assurance
• Technical support: diagnosing and resolving reported issues

4. Legal basis for processing

Important note:For data belonging to the Client's callers (calls, appointments), Linia Directă acts as a processor under a Data Processing Agreement (DPA) with the Client, which remains the controller of that data.

Data provision: Account and business data are required for the performance of the contract: without them, the service cannot be provided. Call and appointment data are collected automatically as part of delivering the service.

5. Recipients and sub-processors

Your data may be accessed by the following sub-processors, solely for the purpose of delivering the service:

5.1 Google Calendar integration (optional)

The Client may connect a Google Calendar account to the Linia Directă platform for automatic appointment synchronisation. This integration is optionaland is activated solely at the Client's initiative through OAuth 2.0 authorisation.

Data accessed

The application requests access to only two minimal permission scopes:

• calendar.events: creating, reading, and modifying calendar events (for appointment synchronisation)
• calendar.freebusy: checking availability (to prevent scheduling conflicts)

We do not request access to contacts, email, or any other data from your Google account.

How we use Google Calendar data

• We check calendar availability to prevent scheduling conflicts
• We create new events when the virtual assistant confirms an appointment
• We modify or cancel existing events at the caller's request

Our interaction with Google Calendar is limited to what the scheduling feature requires: we read free/busy time ranges (via the Google Calendar freeBusy API) to find open slots (this is the only data we read from Google Calendar) and we create, reschedule, or cancel the caller's own appointment events in the account's primary calendar. We do not read the content of existing calendar events (titles, participants, or descriptions). Availability derived from Google Calendar (free/busy time ranges) may be processed by our EU-based AI sub-processor solely to communicate available times to the caller and to record the requested appointment, never to train models.

What we do NOT do with Google Calendar data

• We do not use calendar data to train, develop, or improve generalised or non-personalised artificial intelligence or machine-learning models
• We do not create behavioural profiles based on calendar activity
• We do not display targeted or personalised advertising based on calendar content
• We do not sell calendar data or share it with data brokers
• We do not share calendar data with third parties (other than Google as the service provider, and our EU-based AI sub-processor strictly to deliver the scheduling feature described above)
• We do not use calendar data to determine credit-worthiness or for lending purposes
• We do not store event content on our servers: we access data only in real time, at the moment of checking availability or synchronising appointments
• We do not use calendar data for any purpose other than synchronising the Client's appointments

Disconnection and deletion

The Client may disconnect Google Calendar at any time from the assistant configuration page. Upon disconnection:

• The OAuth token stored in our database for that assistant is permanently deleted, immediately
• The application's access to the Google account is revoked with Google when the account's last connected assistant is disconnected (multiple assistants connected to the same Google account share the same authorization). The Client may also revoke access at any time directly from their Google Account settings (myaccount.google.com/permissions)
• Appointments already created in Google Calendar remain in the Client's calendar (we do not delete them from Google)
• We do not retain any copy of the data accessed from Google Calendar

6. International data transfers

Data processing takes place on infrastructure located in the European Union. Where a provider is a US entity (the case for the transactional email provider, the voice synthesis provider and the real-time communications infrastructure provider), any potential data transfer to the United States is covered by the Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary measures, which ensure an adequate level of data protection.

Data transferred to the email provider is limited to the recipient's email address and the email content. Data sent to the voice synthesis provider is limited to the text spoken by the assistant, which may include data provided by the caller during the conversation (for example, their name or the appointment date, upon confirmation). The real-time communications infrastructure only carries audio streams in transit, ephemeral, with no content storage.

7. Retention periods

8. Your rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: you may request a copy of the personal data we hold about you
• Right to rectification: you may request the correction of inaccurate data
• Right to erasure: you may request the deletion of your personal data ("right to be forgotten")
• Right to data portability: you may request the transfer of your data in a structured format
• Right to object: you may object to processing based on legitimate interest
• Right to restriction of processing: you may request that processing be limited under certain conditions
• Right to withdraw consent: for processing based on consent (analytics/marketing cookies), you may withdraw your consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at dpo@liniadirecta.ro. We will respond within 30 calendar days.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest

9. Artificial intelligence and automated decisions

The Linia Directă virtual assistant uses artificial intelligence (language models, voice synthesis, speech recognition) to manage phone and chat conversations.

9.1 What the AI does

• Understands and responds to questions in Romanian
• Classifies the caller's intent (information, appointment, transfer)
• Creates, modifies, and cancels appointments
• Generates automatic call summaries
• Decides whether to transfer the call to a human operator

9.2 Transparency (pursuant to EU Regulation 2024/1689, AI Act)

At the beginning of each call, the virtual assistant identifies itself as an artificial intelligence-based virtual assistantand notifies the caller that the call is being recorded. The assistant's voice is artificially generated through voice synthesis.

9.3 Right to human intervention (Art. 22 GDPR)

We do not make decisions with legal or similarly significant effects based solely on automated processing. Appointments created by the virtual assistant are subject to review by the Client's staff. At any point during the conversation, the caller may request a transfer to a human operator.

9.4 Limitations

The virtual assistant does not provide medical, legal, or financial advice. AI-generated responses may contain inaccuracies. The Client is responsible for verifying the information communicated to callers.

10. Cookies

The Linia Directă platform uses essential cookies for its operation and, with your consent, analytics and marketing cookies. For full details, please see our Cookie Policy.

You may withdraw your consent at any time via the "Cookie settings" link in the page footer.

11. Data security

We implement appropriate technical and organisational measures to protect personal data:

• Encryption in transit (TLS/HTTPS) for all communications
• Encryption at rest for the database (AES-256)
• Row Level Security (RLS): each client can only access their own data
• Rate limiting on all public endpoints
• Authentication with email verification
• Structured access logs with trace ID
• Automatic database backups

12. Changes to this policy

We reserve the right to update this privacy policy. Any significant changes will be communicated by email to the address associated with your account, at least 15 days before taking effect.

13. Contact

For any questions regarding the processing of personal data:

• Email: dpo@liniadirecta.ro
• General email: contact@liniadirecta.ro
• Controller: Digital Leadership SRL, CUI 38585123, J2017006715126