Privacy Policy, CallMerlin

Responsible for the processing of personal data: Small Guy B.V., trading as CallMerlin Registered in Breda, the Netherlands (KvK: 70358729) Email: privacy@callmerlin.app

We collect and process the following categories of personal data: a) Account data: name, email address, company name, phone number (optional), language preference, IP address at registration. b) Payment data: billing name, billing address, VAT number. Credit card or bank details are exclusively processed and stored by Stripe, Inc. and are not stored by CallMerlin. c) Usage data: login times, features used, session duration, browser type, operating system, device type. d) Call data: transcripts of Merlin sessions (audio from those sessions is not retained), caller telephone numbers, call duration, time of call, outcome of the call (such as a booked appointment or executed action), and AI-generated summaries. e) Connection data: credentials of Connected Services (API keys, OAuth tokens), stored encrypted (AES-256), and the metadata of actions performed in those services on the User's behalf. f) PIN User data: name and PIN configuration of persons to whom the User grants voice access, and verification phone numbers used for SMS-based two-factor authentication. g) Communication data: correspondence with our support or sales department. h) Caller data: personal data shared by Callers during a conversation with the voice assistant (such as name, contact details and the subject of their request). This data is processed on behalf of the User (the data controller); CallMerlin acts as processor. i) Slack channel data (when the User installs the CallMerlin Slack app): Slack workspace (team) ID, Slack user IDs, display names, email addresses from Slack profiles (scope users:read.email), message text addressed to Merlin, and encrypted Slack bot tokens. Tokens are deleted on disconnect or uninstall. j) OAuth sign-in data (Google or Sign in with Slack): email address, name and profile information from the identity provider, used only to create or authenticate your CallMerlin account. Sign in with Slack uses scopes openid, email and profile only. Sign in with Slack (this login app) does not send user data to an LLM. LLM processing begins only after login when the customer actively uses AI features. k) Temporary recording audio (live meeting recording and Calling with recording in app/desktop): when a PIN user deliberately records, audio is stored temporarily in the EU for speech-to-text and for creating a summary with action items. After successful processing, the raw audio is deleted. Summaries remain in the account (see retention periods). There is no silent recording: for Calling with recording, both parties first hear an announcement before recording starts. Not used for advertising.

We process personal data for the following purposes and on the following legal bases: a) Performance of the contract (Art. 6(1)(b) GDPR): — Creating and managing accounts — Providing the Platform and all features, including handling calls — Processing payments and invoicing — Providing technical support — Executing AI services and actions in Connected Services b) Legitimate interest (Art. 6(1)(f) GDPR): — Security and fraud prevention (including telephony abuse detection) — Improving the Platform and services — Analyzing usage patterns (anonymized where possible) — Direct communication about the Service (no marketing) c) Consent (Art. 6(1)(a) GDPR): — Marketing emails and newsletters (opt-in) — Analytical cookies that are not strictly necessary d) Legal obligation (Art. 6(1)(c) GDPR): — Tax retention obligations for invoice data — Telecommunications regulations applicable to number registration — Cooperation with court orders — Data breach notification obligation

We share personal data with the following categories of recipients: a) Hosting provider: Google Cloud Platform (region europe-west4, Eemshaven, the Netherlands). Processing exclusively within the EU. b) Content Delivery Network: Cloudflare, Inc. (EU configuration). Edge caching for static content; no storage of personal data. c) Payment processor: Stripe, Inc. / Stripe Payments Europe, Ltd. Processing in accordance with PCI-DSS Level 1. d) Telecommunications carriers: for provisioning telephone numbers, routing calls and sending SMS messages (such as 2FA codes). e) AI model provider - xAI, Inc. (Grok): for delivering AI services (speech recognition, language models, chat and voice). Chat messages, voice audio/transcripts, and files shared in conversation may be sent to xAI for inference. We contract with xAI under a data processing agreement with an opt-out for model training on customer data. Customer data is not used for training AI models. In the mobile apps, this sharing only occurs after the user grants explicit in-app permission. f) Email providers: for sending transactional emails (account confirmations, password resets, invoices). g) Connected Services: at the User's instruction, the voice assistant passes data to the Connected Services configured by the User (for example to book an appointment). The User determines which services are connected. h) Website analytics: Google LLC (Google Analytics 4 / Google Tag Manager), Apollo.io (Website Visitors: identify visiting companies) and Hotjar Ltd. (session recordings and heatmaps; data stored in the EU, Ireland), only when the visitor has accepted analytical cookies. We never sell personal data to third parties. We do not provide personal data to third parties for their own marketing purposes. An up-to-date list of sub-processors is available upon request at privacy@callmerlin.app.

5.1. All primary data processing takes place within the European Union, in Google Cloud region europe-west4 (Eemshaven, the Netherlands). 5.2. For certain AI services, telephony services or website analytics (Apollo.io), personal data may be transferred to sub-processors established in the United States. In such cases, the transfer is based on: a) the EU-US Data Privacy Framework (DPF), insofar as the recipient is DPF-certified; or b) Standard Contractual Clauses (SCCs) as established by Commission Implementing Decision (EU) 2021/914; and c) supplementary technical measures, including encryption of data in transit and limitation of processing scope. 5.3. Upon request, CallMerlin will inform the User about the specific safeguards in place for transfers outside the EU.

We apply the following retention periods: a) Account data: retained for as long as the account is active. After termination, personal data is deleted within 30 days, unless a legal retention obligation applies. b) Invoice data: retained for 7 years after the fiscal year in which the invoice was issued, in accordance with Dutch fiscal retention requirements (Art. 52 AWR). c) Call transcripts and AI summaries: retained for a maximum of 90 days after the call, unless the User configures a different retention period. Audio from Merlin sessions is not retained. For live meeting recording and Calling with recording: call or live recording → temporary EU storage → speech-to-text → summary/action items → raw audio is deleted after successful processing. d) Connection credentials: deleted immediately when the User revokes the connection, and in any event within 30 days after account termination. e) Access logs and security logs: retained for a maximum of 12 months. f) Caller data (processed as processor): retained in accordance with the User's (data controller's) instructions and deleted within 30 days after account termination.

7.1. The marketing website (callmerlin.app) uses: a) Strictly necessary cookies: for authentication, session integrity, and language settings. No consent required. b) Cookieless analytics: Umami Cloud measures page views and anonymised usage statistics without cookies and without personal data. No consent required. c) Analytical cookies: for measuring website usage via Google Analytics 4 (loaded through Google Tag Manager), for identifying visiting companies via Apollo.io Website Visitors, and for session recordings and heatmaps via Hotjar. Only placed after explicit consent (opt-in) via the cookie banner. 7.2. The dashboard uses strictly necessary cookies for authentication and session management. Optionally, only after explicit consent via the cookie banner, Hotjar loads for session recordings and heatmaps of dashboard navigation. Sensitive dashboard content (such as calls, PIN data and account names) is masked in recordings. 7.3. The embeddable voice widget does not place tracking cookies on the User's website. The User is responsible for informing their website visitors in accordance with the ePrivacy Directive. 7.4. The User may manage cookie preferences via the cookie banner or browser settings.

Under the GDPR, every data subject has the following rights: a) Right of access (Art. 15 GDPR): the right to know whether and which personal data is being processed. b) Right to rectification (Art. 16 GDPR): the right to have inaccurate or incomplete data corrected. c) Right to erasure / right to be forgotten (Art. 17 GDPR): the right to request deletion of personal data, insofar as no legal retention obligation applies. d) Right to restriction of processing (Art. 18 GDPR): the right to restrict processing in certain circumstances. e) Right to data portability (Art. 20 GDPR): the right to receive personal data in a structured, commonly used, and machine-readable format. f) Right to object (Art. 21 GDPR): the right to object to processing based on legitimate interest. g) Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing prior to withdrawal. h) Right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): as the supervisory authority in the Netherlands. Website: https://autoriteitpersoonsgegevens.nl Requests may be submitted to privacy@callmerlin.app. We respond within 7 days. For complex requests, this period may be extended by up to 60 days, of which we will inform the data subject within the first 7 days. Callers whose data is processed on behalf of a User (our customer) should primarily address their request to that User, who is the data controller. We will assist the User in handling such requests.

CallMerlin has implemented appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage: a) Encryption: TLS 1.3 for data in transit; AES-256 for data at rest, including credentials of Connected Services. b) Access control: Role-Based Access Control (RBAC), least-privilege principle, two-factor authentication for admin accounts, PIN verification for voice access. c) Data isolation: multi-tenant architecture with strict separation per account. d) Monitoring: real-time logging and alerting on unusual access patterns and telephony abuse. e) Backups: daily automated backups with encrypted storage. f) Incident response: documented incident response plan with data breach procedure. g) Awareness training: periodic staff training on data protection.

The Platform is not directed at persons under 16 years of age. We do not knowingly collect personal data from children. If we discover that personal data from a child has been collected without parental or guardian consent, we will delete that data as soon as possible.

11.1. When a User connects Google services (for example Calendar, Docs, Sheets, Contacts or Gmail send) via OAuth, CallMerlin accesses Google Workspace user data only to provide the user-facing features the User requests through voice or chat. 11.2. Limited Use compliance statement: The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. 11.3. CallMerlin does not use, transfer or sell Google Workspace user data (including raw, aggregated or derived data) to create, train or improve foundational or generalized AI/ML models. 11.4. Where Google Workspace data is processed by a third-party AI provider for inference (to understand the User's request and execute tools), that processing is limited to the user-directed feature. Providers are contracted such that customer API data is not used for model training without explicit permission. 11.5. Users can revoke Google access at any time via CallMerlin Connections and via https://myaccount.google.com/permissions.

12.1. CallMerlin may amend this Privacy Policy from time to time. Changes will be announced at least 30 days in advance by email to the registered email address. 12.2. The current version of the Privacy Policy is always available at callmerlin.app/en/legal/privacy. 12.3. Continued use of the Platform after the effective date of the amended Privacy Policy constitutes acceptance.

For questions about this Privacy Policy or to exercise your rights: Small Guy B.V. (CallMerlin) Email: privacy@callmerlin.app We respond within 7 days. You may also lodge a complaint with the Dutch Data Protection Authority: https://autoriteitpersoonsgegevens.nl