Your customer's data is yours.

Kresa answers phones and replies to chats for businesses. The conversations we handle on your behalf are your data — not training fodder, not a marketing asset. This page explains what we hold, why, where it goes, and what we have not built yet.

The short version

• Kresa answers calls and chats on behalf of the businesses that hire us. For those conversations we are a processor — the business decides what happens to the data.
• For your own Kresa account — name, email, billing, team — we are the controller, and this policy governs it directly.
• Your data is stored in Canada (Google Cloud, Toronto). Some processing — speech recognition, speech synthesis, AI models, telephony, email — happens in the United States. The sub-processor table below says exactly which and why.
• We do not train shared AI models on your conversations, and we do not sell or share personal information for advertising.
• Live call audio is not stored. It is streamed for real-time transcription and discarded. The text transcript is kept, and after-hours voicemail is recorded where a business has turned voicemail on.
• If you are a caller or website visitor, the business you contacted controls your data. Contact them first; we will help them respond.

What we never do

• No advertising cookies, and no third-party analytics in the product.
• No selling or sharing of personal information.
• No training of shared AI models on your conversations.
• No profiling of callers for anything beyond answering their call.

Who we are

Kresa is a product of Prism Cloud Consulting Inc., a Canadian software company. Questions about this policy, and any request to access, correct, export or delete data, go to hello@kresa.ai.

The two roles we play — read this first

Almost every question about this policy resolves once you know which column you are in.

If you are a caller or a website visitor, nearly everything about you sits in the right-hand column. We hold it and protect it, but we act on the business's instructions.

Account data — what we collect as controller

We run no third-party analytics and no advertising trackers in the product or on this website. If that ever changes, this section changes with it and a consent banner ships at the same time.

Conversation data — processed for a business

AI training. We do not use conversation data to train or fine-tune any model, ours or a vendor's.

Calls, recording and transcription

This is the part most worth reading closely, because it is the part where the law differs most between the places our customers operate.

• A live call is transcribed, not recorded. Audio streams to a speech-recognition provider and is discarded as it is processed. What persists is the text.
• The transcript is retained with the call record, so the business can see what its agent said and what its customer asked.
• Voicemail is different: it is recorded audio. Where a business has set after-hours calls to take a message, callers are told before the recording starts.
• Callers are told they are speaking with an automated assistant at the start of the call, before the agent engages, and told that the conversation is transcribed.

Automated processing

Large language models decide what the agent says, and whether to transfer a call, book an appointment or escalate to a person. These decisions are operational, not evaluative — we do not score, rank or profile anyone, and we make no decisions about credit, employment, insurance or legal rights.

Kresa always leaves a human route: any caller or visitor can ask for a person, and the agent escalates.

Sub-processors

These are the companies that process data for us. The applies to column matters: a chat-only customer can see at a glance that the telephony and speech vendors never touch their data.

We will give at least 30 days' notice before adding or replacing a sub-processor that handles conversation data, by email to workspace owners.

Where data lives, and what leaves Canada

Stored data is in Google Cloud's Toronto region. Processed data leaves Canada: speech, AI, telephony, email and payments are all US providers, and there is currently no Canadian-region option for them that would let the product work as described.

Transfers out of the EEA and UK rely on Standard Contractual Clauses and the UK Addendum, together with our sub-processors' own transfer mechanisms.

Cookies and local storage

The embedded chat widget sets no cookies. It keeps a conversation id in sessionStorage, which the browser clears when the tab closes. There is no cross-site tracking.

We set no non-essential cookies, so we show no consent banner. If we ever add analytics, a compliant banner ships with it.

How long we keep things

Two things do have firm periods today:

• Billing records are kept for seven years, because tax and corporate law requires it.
• Records of accepting these documents are kept indefinitely and survive account deletion — they are the proof of what you agreed to and when.

Your rights

If you are a Kresa customer

Email hello@kresa.ai to access, correct, export or delete your data. We verify your identity first and respond within 30 days — we apply the strictest deadline we are subject to, globally, rather than varying it by where you are.

If you called or chatted with a business that uses Kresa

Contact that business first. They decide what happens to your data; we hold it for them and act on their instructions. If you contact us we will identify the business and help it respond, but we cannot delete or disclose its records on our own initiative.

Rights by region

Canada (PIPEDA). Access, correction, withdrawal of consent subject to legal and contractual limits, an explanation of our purposes, and the right to challenge our compliance. Complaints go to the Office of the Privacy Commissioner of Canada.

Québec (Law 25). Additionally: information about automated decisions and the right to have a person review them, data portability in a structured technological format, de-indexing in defined circumstances, and notice when information is communicated outside Québec. Complaints go to the Commission d'accès à l'information.

EEA and United Kingdom (GDPR). Access, rectification, erasure, restriction, portability, objection — including to processing based on legitimate interests — and the right not to be subject to solely automated decisions with legal or similarly significant effect. Complaints go to your national supervisory authority or the UK ICO.

California (CCPA/CPRA). The right to know, delete and correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and have not in the preceding 12 months. Where we act for a business we are a service provider and process only on that business's documented instructions. We will not discriminate against you for exercising these rights.

Security

TLS 1.2 or better in transit, AES-256 at rest. Every read and write is scoped to a single tenant. API keys are stored only as SHA-256 hashes; widget keys are locked to specific origins; secrets live in Google Secret Manager rather than in configuration.

Kresa staff can access your workspace only under a grant you issue, in a scoped session, with every request written to an audit log you can read. You can end a session at any time.

If something goes wrong

We notify affected customers without undue delay, and regulators as required — the Office of the Privacy Commissioner where a breach creates a real risk of significant harm, the Commission d'accès à l'information for Québec, and EU or UK authorities within 72 hours where the GDPR applies.

We keep a register of confidentiality incidents — including those we assess as not reportable, and why — for five years.

Children

Kresa is sold to businesses and is not directed at children. If a child's information reaches us through a customer's phone line or chat widget, that customer is responsible for it under applicable law and should tell us so we can help delete it.

Changes to this policy

We post changes here with a new version and effective date, and keep prior versions available. If a change materially affects how we handle conversation data we will email workspace owners at least 30 days before it takes effect — a silent "last updated" bump is not sufficient notice and we do not treat it as one.