Privacy Policy

Your privacy is our top priority.

Kahea AI, Lda. (“Kahea.ai”, “we”, “us” or “our”) is a company registered in Portugal that provides SIP voice solutions, interactive voice-response (IVR) platforms and artificial-intelligence (AI) implementations for telecommunications operators and related markets. This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you visit kahea.ai, interact with us, or use our products and services.

Scope

This Policy applies to:

  • Visitors to our public websites and social-media pages;
  • Prospective and existing customers, suppliers and business partners;
  • End-users who interact with Kahea.ai platforms (e.g. callers routed through our SIP or IVR infrastructure) where we act as data controller or data processor on behalf of a telecommunications operator or enterprise.

The Personal Data We Collect

Identity & Contact

  • Name, job title, company, postal address, employer identification, email, phone number

Account Credentials

  • User-IDs, API keys, authentication logs

Call Signalling & Metadata

  • Caller and callee numbers (A- and B-numbers), SIP headers, timestamps, routing information, IP addresses

Audio & Transcripts

  • Voice recordings, real-time speech-to-text output, IVR menu selections

Usage & Device Information

  • Browser/OS type, referring URLs, cookies, performance metrics, diagnostics logs

Marketing Preferences

  • Newsletter opt-in/opt-out status, event attendance

We never request or intentionally collect special categories of personal data (e.g. health, biometric templates unrelated to voice, religious beliefs) unless required by law or expressly provided by you.

How We Obtain Personal Data

  • Directly from you when you complete web forms, request a demo, enter into a contract, place a call, open a support ticket or otherwise communicate with us.
  • Automatically through cookies, server logs, analytics tags and our telephony systems.
  • From third parties such as telecom operators, channel partners, publicly-available sources, or social-media platforms where our content is hosted.

Legal Bases for Processing (GDPR Art. 6)

Contract performance

  • Provision of SIP trunking, IVR hosting, AI voice analytics, customer support

Legitimate interests

  • Securing our network, preventing fraud, improving service quality, B2B marketing to existing customers

Consent

  • Optional cookies, promotional emails, publishing customer testimonials

Legal obligation

  • Retaining call detail records (CDRs) required by telecom regulation, responding to lawful requests

Vital interests

  • Preventing or responding to emergencies impacting life or safety during call routing

Purposes of Processing

We use personal data to:

  • Deliver, configure and maintain SIP/IVR/AI services;
  • Authenticate and authorise users of our portals and APIs;
  • Analyse voice traffic for fraud detection, quality monitoring and capacity planning;
  • Train and fine-tune customer-specific AI models without re-using your content to train models that will be shared with other customers unless you have given explicit, written consent;
  • Provide technical support and incident response;
  • Invoice and collect payments;
  • Send administrative notices, product updates and direct marketing (where permitted);
  • Comply with telecom, tax and data-protection laws.

Sharing & Disclosure

We disclose personal data only when necessary:

  • Service providers offering cloud hosting, colocation, DDoS mitigation, analytics, CRM and billing. All are bound by data-processing agreements.
  • Telecommunications partners (carriers, operators, SIP trunk providers) to connect and terminate calls.
  • Professional advisors (lawyers, auditors, insurers) under confidentiality obligations.
  • Government authorities where required by law or court order.
  • Business transfers if we undergo a merger, acquisition or asset sale.

We never sell personal data. Ever.

International Data Transfers

Kahea.ai stores most data in the European Economic Area (EEA). Where transfers outside the EEA occur—for example, to a US-based cloud provider—we rely on:

  • European Commission Standard Contractual Clauses (SCCs) and accompanying Transfer Impact Assessments (TIAs);
  • Adequacy decisions; or
  • Your explicit, informed consent.

Security Measures

We implement administrative, technical and physical controls aligned with ISO 27001 and ETSI TS 103 097, including:

  • End-to-end TLS/SRTP encryption for voice traffic;
  • At-rest AES-256 encryption for recordings and transcripts;
  • Role-based access control (RBAC) and MFA for all production systems;
  • 24 × 7 monitoring, auditing and incident-response procedures.

No transmission or storage system is guaranteed 100 % secure, but we continuously assess and improve our safeguards.

Data Retention

Unless a different period is required by law or contract:

CDRs & signalling logs

  • 12 months

Audio recordings & transcripts

  • Up to 90 days (extendable per customer request)

Support tickets & emails

  • Duration of contract + 3 years

Marketing lists

  • Until you opt out or 2 years of inactivity

We securely delete or anonymize data after the retention period.

Your Rights (EEA, UK & Similar Jurisdictions)

You may:

  • Request access to your personal data;
  • Correct or update inaccurate data;
  • Request erasure (“right to be forgotten”);
  • Restrict or object to processing;
  • Receive a portable copy of data you provided;
  • Withdraw consent at any time (without affecting prior processing);
  • Lodge a complaint with the Portuguese Data Protection Authority (CNPD) or your local supervisory authority.

To exercise any right, email support@kahea.ai. We will respond within one month as required by GDPR.

Cookies & Similar Technologies

Our website uses:

  • Essential cookies for site functionality and security;
  • Analytics cookies to understand traffic and improve user experience;
  • Preference cookies to remember language or accessibility settings.
  • See our separate Cookie Notice for details and opt-out options.

Children’s Privacy

Kahea.ai services are designed for business customers and are not directed to children under 16. If we learn we have inadvertently collected such data, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical or business developments. When we do, we will revise the “Effective Date” and, where material changes occur, provide prominent notice (e.g. via banner or email).

Contact Us

If you have questions about this Policy or our privacy practices, contact:

Data Protection Officer:

  • OpenTelecom – Consulting for Telecoms, Lda

Email:

Tel.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) or another competent authority.

© 2025 Kahea AI ™ – OpenTelecom – Consulting for Telecoms, Lda. All rights reserved.