CallAble
Privacy policy
Private, invitation-only prototype.
In short
- CallAble is a private prototype, by invitation only; you can join the waitlist. Only French numbers can be called.
- We use your information only to prepare and place the calls you ask for.
- Your profile and history stay in your browser. All call records kept on our servers (captions, approvals) will be deleted by 4 November 2026 at the latest.
- We do not record call audio. We do not sell data, show ads or use analytics trackers.
- No call is placed and no personal information is told to the person you call without your approval.
- Some providers are in the United States (section 7).
1. Who is responsible
CallAble, at www.callableai.app, is published in a non-professional capacity by four private individuals, who are joint controllers (Article 26 GDPR): Alex Beverage (alex@beverage.me), Jermiah Jerome (jermiah.jerome96@gmail.com), Sundaravel Selvaraj (svelselvaraj@gmail.com) and Thamimul Ansari (thamimdev4@gmail.com). In this policy, "we" means the four of them.
Alex Beverage is your point of contact for any question about your data: alex@beverage.me. You can also exercise your rights with any of them. No data protection officer has been appointed so far.
CallAble is a private prototype built at the DevDay Exchange Community hackathon (Paris, October 2026), available only to people the team has invited. The service is changing, and this policy will be updated with it.
2. Data, purposes and legal bases
Legal bases refer to Article 6 of Regulation (EU) 2016/679 (GDPR).
| Data | Why | Legal basis |
|---|---|---|
| Account: email address and sign-in details handled by Clerk; a random anonymous identifier created by Supabase and linked to your calls. | Sign you in and keep your calls separate from other users'. | Performance of the contract (Art. 6(1)(b)). |
| Waitlist (if you join it): your email address, held by Clerk. | Tell you when you can have access to CallAble. | Consent (Art. 6(1)(a)), withdrawn by asking us to remove you. |
| Profile you type: name, phone, email, address, preferred language, and whether you are unable to speak on a call. | Prefill your calls. The profile stays in your browser. Before each call you choose, field by field (name, phone, email, address, case reference), what is shared; only what you share is sent to us, and anything you did not share needs your approval during the call. | Performance of the contract. For the statement that you cannot speak: your explicit consent (Art. 9(2)(a)), given call by call. We never infer a disability or a health condition. |
| Call preparation: the number called, the organisation, your goal in your own words, your customer reference, the approved call plan. | Place the call and pursue your goal. | Performance of the contract. |
| Call content: participants' voices, streamed in real time and not recorded; captions and translations of what each side says; approval requests, your decisions and your corrections; the questions the assistant asks you in the app and your typed answers. | Run the call, show captions, ask for your approval, write the summary. | Performance of the contract. The approval log: our legitimate interest in being able to show what you approved (Art. 6(1)(f)). An answer about health, such as whether anyone was injured, is optional: you can decline the question. For your own health, the basis is your explicit consent, given by typing the answer (Art. 9(2)(a)). |
| Express Clearly: the sentence you type, its rewrite, and the approved French text turned into speech. | Offer you a faithful wording that you approve before it is spoken. | Performance of the contract. |
| Connected Google accounts (optional): Gmail, Google Drive, Google Calendar, Google Maps, read-only. | Find, during the call, a fact the agent needs. Before CallAble searches your connected accounts for an answer, it asks you to approve the question, and the answer found is shared for that question only. If you tick, before dialing, the option to share what CallAble finds without asking each time (off by default), ordinary facts are shared during that call without asking again; an identity document number still needs your consent to that specific question, and passwords, card numbers and bank details are never shared. | Consent (Art. 6(1)(a)), withdrawn by disconnecting the account. |
| Location (optional): one position (coordinates, accuracy, time) when you tap to share your location and allow it in your browser. | Look up a place or address useful for that call. No background tracking. The address found is said only with your approval, which you can give when you share your location. | Consent (Art. 6(1)(a)). |
| Technical data: IP address, browser type, timestamps, error logs kept by our hosting providers. | Deliver the service, secure it, fix faults. | Legitimate interest (Art. 6(1)(f)). |
Today only the sample invoice supplied by CallAble can be used as a document; you cannot upload your own documents. Do not enter an identity document number, password, code or bank details in your profile. CallAble never passes on a password, code or bank details; it passes on an identity document number found in your connected accounts only after you consent to that specific question. Avoid describing sensitive information in your goal (health, opinions and so on) that the call does not need. This prototype is for demonstrations: use fictional details where you can.
3. The person you call
During the pilot, CallAble can call only French numbers.
The voice and words of the person who answers are processed in real time to be transcribed and translated. The transcript is part of the call record kept on our servers (section 8) and of the history in your browser.
At the start of the call they are told that an AI assistant is calling with your permission on your behalf, or that an AI interpreter is translating the conversation.
This processing relies on the legitimate interest, yours and ours, in carrying out the call you asked for (Art. 6(1)(f)). They can exercise their rights with us (section 10), including the right to object. We ask them for nothing beyond the answer to your request.
4. What we do not do
- We do not record call audio.
- We do not sell or rent your data, or use it for advertising or marketing.
- We use no analytics, advertising or social media trackers.
- We do not use your data to train AI models. Under their terms, our AI providers do not use data sent through their API to train their models by default.
5. Artificial intelligence and decisions
AI models hold the phone conversation, translate, rewrite, prepare the call plan and write the summary. They propose; you decide. Every call, every number, every piece of personal information disclosed and every commitment requested needs your approval, enforced by our code rather than by the model. You give it case by case during the call; approval to share your personal information can also be given in advance for one call, through the options offered before dialing. CallAble refuses to pay, to accept contractual terms, or to pass on passwords and bank details, even with your approval.
No decision that has legal effects for you, or similarly significantly affects you, is based solely on automated processing (Art. 22 GDPR).
6. Recipients and processors
Your data is available only to the members of our team who need it, and to the providers below, who act on our behalf (processors under Article 28 GDPR). The organisation you call receives what you allowed it to hear.
| Provider | Role | Where data is processed |
|---|---|---|
| Vercel Inc. | Hosts the website | Global network; company based in the United States |
| Fly.io, Inc. | Servers for the API and the audio relay | Paris, France; company based in the United States |
| Supabase Pte. Ltd. | Database and anonymous identifier | Ireland (European Union) |
| Clerk, Inc. | Sign-in screen, accounts and waitlist | United States |
| LiveKit, Inc. | Real-time audio rooms | Global network; the processing region is not guaranteed |
| Twilio Inc. | Connection to the telephone network | United States and global network |
| OpenAI | Voice agent, translation, rewriting, call plan, summary, lookups in your connected Google accounts | United States; lookups in your connected Google accounts use a service whose data is processed in the United States only |
| ElevenLabs | French voice for the text you approved | United States |
| Composio | Connection to your Google accounts, read-only | United States |
When you connect a Google account, Google remains the controller of that account's data. CallAble's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We may disclose data to authorities where the law requires it.
7. Transfers outside the European Union
Several providers are based in, or process data in, the United States. Where the recipient is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023. Otherwise it relies on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). You can obtain a copy of these safeguards by writing to us.
8. How long we keep data
| Data | Period |
|---|---|
| Profile and history in your browser | Until you delete them (Personal information, History, or by clearing the site's data). |
| Sign-in account, call records on our servers (status, masked number, captions, approval requests and decisions), the approval log and the anonymous identifier | Until the end of the pilot, and at the latest until 4 November 2026. You can ask for deletion sooner. |
| Waitlist email address | Until we invite you or you ask us to remove it, and at most 12 months after you joined. |
| Facts found in your Google accounts, shared location | Your coordinates and the facts found stay in the call's memory and are erased when the call ends. A fact shown to you in an approval request, or said during the call, becomes part of the call records and is kept with them. |
| Connection to a Google account | Until you disconnect it in Connections. |
| Call audio | Never recorded by CallAble. |
| Technical logs at our hosting providers | According to their periods, at most 30 days. |
| Data processed by OpenAI | Up to 30 days for abuse monitoring, under OpenAI's terms. The service used for lookups in your connected Google accounts does not offer zero retention. |
| Call detail records at Twilio (numbers, time, duration) | According to Twilio's legal obligations. |
9. Security
Traffic between your browser and our services is encrypted (HTTPS, WebRTC). The telephone part of the call uses the public telephone network, like any ordinary call. Each user can read only their own records. Provider keys stay on our servers and are never sent to your browser or to AI models. The number called is masked in our database. A fact that needs your approval reaches the voice agent only once approved, during the call or in advance.
10. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 GDPR), the right to withdraw your consent at any time, and the right to set instructions for what happens to your data after your death (Article 85 of French law no. 78-17 of 6 January 1978, "Informatique et Libertés").
- In the app: export or delete your history, clear your profile, disconnect a Google account.
- By email: alex@beverage.me, for anything else, including deleting the records kept on our servers.
We answer within one month. For a complex request this can be extended by two months; we will then tell you within the first month, with the reasons. If we have reasonable doubts about your identity, we may ask you for additional information.
You can lodge a complaint with the French data protection authority (CNIL): online at cnil.fr/fr/plaintes, or by post:
CNIL, Service des plaintes3 place de Fontenoy
75007 Paris, France
11. Cookies and browser storage
CallAble uses only cookies and other trackers, such as browser storage, that are strictly necessary for the service or for a feature you ask for. They are exempt from consent (Article 82 of the "Informatique et Libertés" law), which is why no banner is shown.
| Name | Set by | Purpose |
|---|---|---|
Session cookies, such as __session and __client_uat | Clerk | Keep you signed in. |
sb-…-auth-token (local storage) | Supabase | The anonymous identifier that links your calls to your browser. |
callable.workspace.v1 (local storage) | CallAble | Your profile, history and follow-ups, on this device only. |
callable.captionSize, callable.solidSurfaces, callable.sidebarCollapsed (local storage) | CallAble | Your display preferences: caption size, opaque surfaces, sidebar. |
callable.authView (session storage) | CallAble | Remembers whether you were on the sign-in or sign-up form, until you close the tab. |
The sign-in screen loads Clerk's code from Clerk's servers, which therefore receive your IP address.
12. Minors
CallAble is for adults only. We do not knowingly collect data about minors.
13. Changes
We will tell you about any significant change in the app before it takes effect. The update date is at the top of this page.