Privacy policy

1. Purpose

This policy explains how AYWA collects, uses, retains and protects personal data when its website, platform, voice agents and AYWA Companion for LinkedIn extension are used.

2. Controller and roles

RTLS TechLab (AYWA), 166-168 Avenue Georges Clemenceau, 92000 Nanterre, France, controls processing relating to accounts, the website, billing, support and service security. For data that a customer processes through calls and campaigns, the customer determines the purposes and AYWA generally acts as processor under the applicable agreement. Contact: team@aywa.ai.

3. Data categories

• Identity and business contact details: name, email, phone, company and role.
• Account and access data: technical identifiers, roles, sessions, IP address and security logs.
• Usage data: agent configurations, campaigns, tools, documents, actions and statistics.
• Call data: numbers, metadata, transcripts, recordings, summaries and outcomes when these features are enabled.
• Commercial and payment data: plan, usage, invoices, payment status and Stripe identifiers; AYWA does not store full card numbers.

4. LinkedIn extension

When the user activates the extension, it may process visible context from LinkedIn pages opened voluntarily, the URL, displayed excerpts, local settings and a temporary AYWA session token. It does not request the LinkedIn password. Captured data supports Sales Research, enrichment, scoring, review and conversion into a prospect.

5. Purposes and legal bases

• Contract performance: provide accounts, agents, calls, tools, support and billing.
• Legitimate interests: secure, prevent fraud, diagnose and improve the service, subject to individual rights.
• Consent: non-essential cookies, optional communications and processing that requires it.
• Legal obligation: accounting, tax and regulatory duties and responses to competent authorities.

6. Recipients and processors

Data is accessible to authorised AYWA personnel, authorised tenant members and necessary providers: hosting and authentication, private voice runtime, configured AI and telephony providers, email, monitoring and payments. Each provider accesses only data needed for its task under the applicable agreement and configuration.

• Hosting and data: Vercel delivers the web interface and processes technical request metadata. Hostinger hosts AYWA servers and its private voice runtime. Supabase provides authentication, the database and application file storage.
• Conversation and speech: OpenAI processes instructions, relevant context, responses and audio; it may also analyze calls when that feature is enabled. ElevenLabs or Cartesia synthesize replies according to the configured voice. Deepgram provides transcription or synthesis when selected.
• Preparation and research: Anthropic may generate agent instructions or act as a fallback during preparation. LLMLayer processes requested searches, sources and summaries through its APIs and selected OpenAI or Groq models. Jina Reader may extract a supplied website’s content as a fallback for web import. These services do not receive Google OAuth credentials.
• Email: Resend delivers platform transactional emails, including notifications and invitations when selected as the delivery method. It processes sender, recipients, content, any attachments and delivery status. Email sent through the Gmail or Microsoft connector uses the connected account and its provider.
• Telephony and messaging: Telnyx, or the customer’s connected carrier, carries calls and SMS according to the service used, with the necessary numbers, metadata and content. WhatsApp (Meta) handles messages and channel metadata when WhatsApp is enabled.
• Billing and support: Stripe processes payments, subscriptions, billing details and data needed for billed usage. Microsoft 365 hosts the AYWA team’s email for correspondence you send to us. These uses do not grant access to your connected Google account.
• Customer-selected connections: Google, Microsoft and connected business services such as Salesforce, HubSpot, Zendesk or Atera receive the data required for authorized actions. Their activation and recipients depend on your connections and rules; connecting one service does not activate all others.

7. Location and transfers

The control plane uses, in particular, a European data region. Depending on providers selected for AI, telephony, email, payments or monitoring, some data may be processed outside the EEA. Such transfers rely on applicable safeguards, including adequacy decisions, the Data Privacy Framework or standard contractual clauses.

8. Retention

Retention depends on data type, the agreement, tenant retention settings and legal duties. Call artefacts follow the configured period where available; accounting records follow statutory periods; security logs are retained for a proportionate period. Data is deleted or anonymised after the applicable period, subject to backups and evidentiary duties.

9. Rights

Subject to legal conditions, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent. Send the request to team@aywa.ai and identify the relevant account. Proportionate identity verification may be required. You may complain to the CNIL or your competent supervisory authority.

10. Security

AYWA applies risk-appropriate measures: tenant and role access control, encrypted communications, secret protection, logs, request limiting, backups and incident procedures. No measure eliminates all risk; customers must also protect accounts, keys and infrastructure.

11. Cookies and analytics

Necessary cookies support authentication, security and preferences. Consent-based analytics and marketing tools load only after approval. Choices can be changed through the banner or available settings.

On aywa.ai, Google Analytics measures page visits and discovery steps (industry selection, demo, signup clicks) only after your consent. We do not send business names, form contents or conversations. Campaign identifiers are limited to codes without personal data. Analytics cookies expire within 6 months; you can withdraw consent in the footer’s Privacy preferences. Google advertising features and session recording are disabled.

12. Changes and contact

This policy may change to reflect the service or the law. Material changes are communicated by an appropriate channel. Questions and requests: team@aywa.ai; post: RTLS TechLab (AYWA), 166-168 Avenue Georges Clemenceau, 92000 Nanterre, France.

Contact enquiries from aywa.ai

When you submit the contact form, AYWA receives the contact details, company, industry, needs, message and source you provide. We store this information in our HubSpot CRM to review your enquiry and contact you about it, based on your consent. Optional fields can be left blank. If you separately allow measurement, we keep the first observed source, entry page without query parameters, first industry interest and a recognised AYWA campaign code for 24 hours. When you submit, these details and the context date are linked to the enquiry in HubSpot. The fields describe the last measured enquiry; a later enquiry without measurement does not update them. They are clues, not independently verified attribution or proof of your company’s industry. No advertising IDs or free-text campaign names are sent. Withdrawing permission deletes the browser context and stops future transfers; it does not retroactively delete data already in the CRM. This form does not subscribe you to marketing communications or send your browsing history or demo conversations. To access or correct your data, request deletion or withdraw your consent, email team@aywa.ai.

Support for new AYWA accounts

From 28 September 2026, new AYWA accounts with a verified email address may be recorded in our HubSpot CRM so our team can organise onboarding support. The information used includes your name, email address, account ID, company and industry when known, and the dates your account was verified, your first call took place and your first subscription was paid. If you allow measurement on the site, the source, public campaign and ad codes, and the first industry page viewed may also be linked to your account. This context is kept in an AYWA cookie for 24 hours; the signup categories are then retained in the CRM, without full URLs, search terms, individual advertising identifiers or click IDs. A page viewed does not determine your company’s actual industry. You can stop future transmissions in the privacy preferences and request deletion of information already linked to your account by email. We do not send billed amounts, the contact details of people called, recordings or call transcripts to HubSpot as part of this process. This does not subscribe you to marketing communications. For questions or requests about this data, contact team@aywa.ai.

Measuring the journey between aywa.ai and app.aywa.ai

With your permission for measurement, AYWA uses the same Google Analytics property to connect discovery on the website with use of the application. A pseudonymous Analytics identifier and public campaign and ad codes help us understand where signups come from. Our server confirms verified signup, agent creation, the first completed call and the first paid subscription. No email address, phone number, call content or amount is sent to Google Analytics for these steps. You can withdraw permission in the application’s privacy preferences; visits and steps that do not allow measurement are excluded.

Browser demo recap

The public demonstration runs in your browser. Near the end of the conversation, the agent may offer help creating your agent. An SMS recap may also be offered when this service is available. These choices are independent and optional: you can decline and keep the recap on screen without providing contact details. If you accept verbally, your phone number and optional first name are prepared for review on screen. Without a booking during the conversation, SMS and follow-up require confirmation in this form. If you verbally confirm an appointment with the AYWA team, its time and your callback number, it is booked in the Support calendar and recorded in HubSpot without another click. An SMS after that conversation still requires your explicit request. You can correct the number and select or remove the request for help. After confirmation, your number, optional first name, stated need, selected industry, recap and sending outcome are followed in HubSpot; a request for help creates a task for our team. This does not subscribe you to marketing communications. Business actions presented during the demo are simulated and no audio recording is requested. AYWA and the AI providers needed for the conversation and recap process the exchanges. If you create an account using the provided link, linking it to the demo requires an authenticated AYWA session and a verified email address; a shared phone number is not enough. Unconfirmed local proposals are deleted no later than seven days after they expire. Completed and synchronised requests leave our technical ledger after thirty days; unresolved requests have a ninety-day limit. These periods do not automatically delete HubSpot records. To access or correct your data, withdraw consent or request deletion, email team@aywa.ai.

Phone demonstrations

When you ask AYWA to call you, we use the phone number, country and business name you enter to run your demonstration. Cloudflare Turnstile protects this flow against automated requests. The suggested country comes from a local database: your IP address is not sent to a geolocation service. Your number, demo date, selected industry and outcome are centralised in our HubSpot CRM. If you then request help, we also add the email you provide and your request. Asking for a demo call does not subscribe you to marketing communications. No audio recording is requested for this demo. Bookings, messages and other business actions presented by the agent are simulated. If you continue to an AYWA account using the provided button, linking it to the demo requires an authenticated session and a verified email address; a shared phone number or an entered email is not sufficient. Your browser stores only a temporary receipt, without your phone number or email, to recover the call after a reload and avoid duplicates. Completed local technical requests are deleted after 30 days once CRM synchronisation is confirmed. To access or correct your data, or request deletion, email team@aywa.ai.

WhatsApp demonstrations and conversations

If you choose the WhatsApp demo when available, the suggested country comes from our local IP geolocation database; you can change it. Your entered number prepares a demonstration link and is not sufficient to create a commercial record or identify you. You send the prepared message yourself in WhatsApp. Meta then provides the sender number, message and events needed for the conversation and call. AYWA and the necessary AI providers process these exchanges to answer you. The demo outcome and context are followed in HubSpot. An explicit request for an advisor creates a task assigned to our team; details added to that request stay with it. A human takeover suspends automatic replies. After-call messages respect Meta’s service window; the conversation does not automatically subscribe you to marketing communications. Business actions in the demo are simulated. Linking the demo to a signup requires a verified AYWA identity; a shared phone number is not enough. To stop automatic replies, write STOP. To access or correct your data, or request deletion, contact team@aywa.ai.

13. Google connections

You choose which functions to connect. AYWA requests the permissions needed for each function. OAuth credentials are managed server-side; conversational and speech engines do not receive them or unrestricted access to your Google account.

• Google Calendar: calendar selection, availability calculation, and creation, rescheduling and cancellation of requested appointments. Slots returned to the agent do not contain the names, titles or attendees of existing busy events. Details of the requested appointment are stored in AYWA and synchronized with the selected calendar.
• Gmail: sending requested messages with their recipient, subject, content and attachments. This send flow does not read the inbox. An automation requiring email reading requests separate authorization for that function.
• Google Contacts: preview and import of the contacts you select into the AYWA directory, without modifying Google Contacts. Selected fields may include name, email, phone, company, role, department and notes. Imported contacts can subsequently support authorized directory searches and call routing in your workspace and, depending on the speech engine, recognition of spoken names.

14. Recipients of Google data

Data needed for enabled functions is processed by RTLS TechLab, authorized workspace members and the providers below according to the configured workflow. A speech provider receives the data needed for its task, not general access to the Google account.

• Google executes authorized Gmail, Calendar and Contacts operations. Supabase stores required application data, including imported contacts and appointments. Hostinger hosts their processing by AYWA servers. Vercel delivers the interface and processes technical metadata for its requests.
• OpenAI processes the conversation and audio. Context may include limited tool results, such as a proposed slot, an operation status or contact details needed for directory lookup. Post-call analysis may process the transcript when enabled.
• ElevenLabs, Cartesia, OpenAI or Deepgram, depending on the selected voice and configured fallbacks, convert reply text to audio. That text may announce a Google function’s result. In workflows using separate Deepgram transcription, Deepgram processes audio and configured recognition hints, including directory names. Not every provider receives every call.
• Resend receives the contact details and content needed when a notification or invitation from this workflow is sent by the platform using Resend. Email sent directly through the Gmail connector uses Google. The recipient receives the information included in the message you request.
• Telnyx or the connected carrier carries call audio and enabled SMS; WhatsApp (Meta) carries enabled WhatsApp messages. Appointment or request information is transmitted through these services as part of the relevant call or message. Transfer and notification recipients are determined by your rules.
• The preparation services described in section 6 process content you submit for that function. If you reuse imported information there, that function’s recipients may also process it.

15. Limited Use and Google access controls

AYWA’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Raw, aggregated, anonymized or derived Google data is not sold, used or transferred to create, train or improve generalized or foundational AI models. Processing is limited to authorized functions with applicable no-training safeguards. These safeguards are separate from technical and security retention.

You can disconnect an account in Resources → Connections and revoke access in your Google account. Revocation prevents subsequent access; it does not automatically delete previously imported contacts or AYWA history. You can manage these records in your workspace or request deletion at team@aywa.ai, subject to applicable retention obligations.

Google policy: https://developers.google.com/terms/api-services-user-data-policy