Privacy and your data
This page is a summary. What binds is the wording of the Personal Data Processing Policy and the terms of service.
Handing the data over, erasing a profile, and how long things are kept.
Who the controller is
If you order the service yourself as a consumer, we are the controller (Netlion s.r.o.) and calling rests on the called person's consent.
If an organisation calls you — a surgery, a social service or a company with a partner agreement — that organisation is the controller and you exercise your rights with them.
The legal basis
Calling and recording rest on the called person's consent under Art. 6(1)(a) GDPR. Where the questions concern health, also under Art. 9(2)(a).
Consent is given by confirming the code in the message and can be withdrawn at any time — during a call or at info@querybeam.eu. Withdrawal has no consequences for the called person and needs no justification.
How long things are kept
The periods are enforced by an automated job, not by somebody's memory.
Why it is arranged this way
The more detailed a record, the more sensitive it is and the shorter it is needed. So the long-term evidential load is carried by the smallest layer: one sentence beside the value, instead of keeping the called person's voice for years.
The downside is not glossed over: the quotation is the longest-kept record of the called person's own words. It outlives the transcript and the recording by years. That is why releasing it is recorded, and why it is not on the way past in the list — it has to be asked for.
Freely readable is only whether a quotation exists. That is a fact about how the call went, not part of what was said, and the list needs it to tell "they said something that could not be read" apart from "the question was never reached".
In more detail in the Personal Data Processing Policy.
Where the data travels
The call transcript does not leave the European Union. We do not sell data. The full list is in the list of sub-processors.
When the called person exercises their rights
You handle both yourself, on the profile under Edit profile:
The detail, including the "keep the recorded values" switch and when to turn it on, is on Editing and deleting.
The called person also has the right to complain to the supervisory authority in the state where they live — in the Czech Republic, the Office for Personal Data Protection.
Security
Encrypted disk and transmission, access separated at record level, mandatory two-factor authentication for administrators, daily encrypted backups.
We hold neither ISO 27001 nor SOC 2, and we write that down where we would not have to. The detail is in the Data Security Declaration.
Artificial intelligence
The service uses an artificial intelligence system. The assistant states in the first sentence of every call that it is automated — Article 50 of Regulation (EU) 2024/1689 requires it and it cannot be switched off.
Neither speech recognition nor extracting an answer is error-free. That is why a quotation is stored with every value.