Privacy Policy

1. Controller and Contact

The controller responsible for processing your personal data is Nairon GmbH, Rothausstrasse 1, 8280 Kreuzlingen, Switzerland (UID: CHE-308.568.524) ("Nairon", "we", "us", or "our").

For any privacy questions or to exercise your rights, contact us at [email protected].

This Privacy Policy applies to our website and to our AI voice and customer communication services, and is aligned with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Personal Data We Process

Account and contact data: name, email, phone number, company, role, and login credentials.

Billing data: plan, billing address, tax identifiers, and payment metadata (card details are handled by our payment providers, not stored by us).

Usage and technical data: log data, IP address, device and browser information, feature usage, and diagnostic data.

Communication and voice data: call audio is processed only transiently in real time to generate a transcript and is not retained; we keep transcripts, conversation logs, and related metadata processed when you or your end customers use our voice agents.

Support and marketing data: messages you send us, support tickets, and communication preferences.

3. How and Why We Use Personal Data

To provide, operate, secure, and support the Services, including delivering AI voice agents and dashboards.

To process payments, manage subscriptions, and prevent fraud and abuse.

To improve and develop our Services, including quality assurance and aggregated analytics.

To communicate with you about your account, service changes, and — where permitted — relevant offers.

To comply with legal obligations and to establish, exercise, or defend legal claims.

4. Voice and Call Data

When our voice agents handle calls on your behalf, we process call audio, transcripts, and metadata as a processor acting on the instructions of our business customer (the controller for those calls).

We do not retain the underlying call audio. Audio is processed only momentarily to produce a transcript and is then discarded; only the transcript and related metadata are stored.

We do not make transcripts or call data available to any third party outside the use explicitly permitted by, and on the instructions of, the relevant business customer, except where required by law. Where a customer connects third-party integrations (for example, a CRM, helpdesk, or webhook endpoint), transcripts and related data may be shared with those integrations as part of that permitted use and at the customer’s direction.

Our business customers are responsible for providing any required notices and obtaining any required consents (for example, for call recording) before using the Services to interact with their end customers.

5. Legal Bases for Processing

Where the GDPR applies, we rely on: performance of a contract (Art. 6(1)(b)); our legitimate interests in operating, securing, and improving the Services (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)); and your consent where required (Art. 6(1)(a)).

Under the Swiss FADP, we process personal data where it is justified by the performance of a contract, an overriding legitimate interest, a legal obligation, or your consent.

Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

6. Sharing and Processors

We share personal data with trusted service providers (sub-processors) who host, secure, and support our Services — such as cloud infrastructure, telephony carriers, AI model providers, payment processors, and analytics tools — under data processing agreements.

We do not sell personal data. We do not disclose call transcripts or conversation data to third parties outside the use explicitly permitted by the relevant business customer — which includes any third-party integrations the customer chooses to connect. We may disclose personal data when required by law, to enforce our agreements, or to protect the rights, safety, and integrity of our users and Services.

7. International Data Transfers

We are based in Switzerland and may transfer personal data to recipients in the EU/EEA and other countries.

Where data is transferred to a country without an adequacy decision, we apply appropriate safeguards, such as the EU Standard Contractual Clauses (with the Swiss addendum where relevant) and additional technical and organizational measures.

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, to provide the Services, and to comply with legal, accounting, or reporting obligations.

Retention periods depend on the type of data and the nature of our relationship. We do not retain raw call audio; only transcripts and related metadata are retained, according to the configuration and instructions of the relevant business customer.

9. Your Rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability.

Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU/EEA, your local data protection authority.

10. Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you without a lawful basis and appropriate safeguards.

Our voice agents generate conversational responses but do not make such decisions about you on our own behalf.

11. Cookies

We use cookies and similar technologies on our website as described in our Cookie Notice.

You can manage cookies through your browser settings and any consent tools we provide.

12. Security

We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration.

No system is completely secure, but we continuously review and improve our controls and monitoring.

13. Children

Our Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes.

When updates are material, we will provide notice through our website or Services and update the "Last updated" date below.

15. Contact

Nairon GmbH, Rothausstrasse 1, 8280 Kreuzlingen, Switzerland — [email protected].