We combine encryption, access controls, clear data retention processes, carefully managed subprocessors, and GDPR-aligned data processing to help businesses use AI in customer interactions with confidence.

Encryption in transit and at rest
Data Processing Agreements under GDPR Article 28
AI providers are contractually prohibited from using customer inputs and outputs for model training

These controls are reflected in Tellyou’s current privacy and security practices.

Security and data protection at Tellyou

Customer conversations may contain personal data. That is why security and data protection are built into how Tellyou processes information.

Under GDPR, Tellyou can have two different roles.

For account holders and visitors to tellyou.ai, Tellyou acts as a data controller.

For end-user conversations processed on behalf of our customers, Tellyou normally acts as a data processor, while the customer remains the data controller.

Processing of end-user chat content is governed by a Data Processing Agreement under GDPR Article 28.

What personal data can Tellyou process?

Depending on how Tellyou is used and which integrations are enabled, the platform may process information such as:

chat messages and conversation history
voice recordings and transcriptions when voice is enabled
names, email addresses and other information voluntarily provided by end users
session IDs, language, page URL and channel metadata
identifiers from connected platforms such as Shopify, Instagram or Messenger
account information for Tellyou users
product usage and diagnostic information

Tellyou may also generate embeddings or vectors used to retrieve relevant information when producing AI-assisted answers.

Is customer data used to train AI models?

Tellyou uses external AI and language model providers to generate responses and, where applicable, voice output.

Prompts and relevant conversation context may be sent to the selected AI provider in order to generate a response.

Tellyou requires contractually that inputs and outputs are not used by these providers to train their models.

This means information is shared with an AI provider for the purpose of delivering the requested functionality, not for training that provider’s models.

Encryption and access control

Tellyou applies technical and organisational security measures appropriate to the risks involved in processing customer data.

These measures include:

encryption in transit using TLS 1.2 or higher
encryption at rest
restricted access controls
least-privilege roles
SSO and MFA for staff
isolated environments
secure secret management
code review
automated dependency monitoring
audit logging
regular backups

No digital system can be completely risk-free, but these measures are designed to reduce unauthorised access and protect the confidentiality and integrity of customer data.

Where is data stored and processed?

Tellyou works with selected subprocessors to deliver the service.

For example, Supabase is used for database, authentication, storage and edge functions, including EU-region infrastructure where configured.

Other providers may process data outside the EU/EEA, primarily in countries such as the United States and the United Kingdom.

Where international transfers occur, Tellyou uses applicable safeguards such as:

adequacy decisions
the EU-U.S. Data Privacy Framework where applicable
EU Standard Contractual Clauses
supplementary security measures
encryption in transit and at rest

Applicable safeguards can be made available on request.

Subprocessors and AI providers

Tellyou uses carefully selected subprocessors to operate the platform and provide connected services.

These may include providers for:

database and infrastructure
AI and language models
voice generation
messaging channels
ecommerce integrations
payment processing
transactional email

Current providers include services such as Supabase, Cloudflare, OpenAI, Anthropic, Google, ElevenLabs, Meta, Shopify and payment providers, depending on which Tellyou functionality a customer uses.

Tellyou uses written agreements with subprocessors that include GDPR Article 28 terms where applicable and Standard Contractual Clauses where required.

Customers are given advance notice of new subprocessors so they can raise objections before activation.

View our current subprocessors →

How long is data retained?

Tellyou retains personal data only for as long as necessary for the purpose for which it was collected.

Default retention periods include:

Account profile and authentication data
For the lifetime of the account plus 90 days after deletion.

Billing and invoice records
7 years, in accordance with Swedish accounting requirements.

Chat transcripts and AI logs
According to the customer’s configuration, with a default retention period of 12 months.

Voice recordings
30 days by default, unless configured otherwise by the customer.

Security and access logs
Up to 12 months.

Backups
Rolling backups with a maximum retention period of 35 days.

When a customer terminates its agreement, end-user chat content is deleted or returned in accordance with the applicable DPA, normally within 30 days.

Data deletion, access and export

Individuals have rights under GDPR regarding their personal data.

Depending on the circumstances, these include the right to:

access personal data
correct inaccurate data
request deletion
restrict or object to processing
receive data in a machine-readable format
withdraw consent
object to direct marketing

End users interacting with a Tellyou-powered agent should normally contact the company operating the agent first. Tellyou assists its customers in responding to applicable data subject requests.

AI and automated responses

Tellyou uses large language models to generate AI-assisted responses.

According to Tellyou’s current Privacy Policy, these responses are advisory and are not intended to produce legal or similarly significant effects for end users within the meaning of GDPR Article 22.

Customers can also configure handover from the AI agent to a human agent when needed.

What happens in the event of a personal data breach?

Tellyou has processes for handling personal data breaches.

Where required under GDPR Article 33, the relevant supervisory authority will be notified within 72 hours.

Where GDPR Article 34 applies, affected individuals or customers will also be informed without undue delay.

Connected channels and integrations

Tellyou can connect to external platforms and channels.

When these integrations are enabled, data is processed only as required to provide the connected functionality.

For example:

Meta / Instagram / Messenger
Message content and platform identifiers may be received through webhooks and processed by the AI agent to generate responses.

Shopify
Customer and order information may be retrieved to answer customer questions. Order data is not retained beyond the relevant conversation window unless needed for support.

Voice agent
When voice functionality is enabled, end users are presented with information and must provide consent before recording begins.

Frequently asked questions

Is Tellyou GDPR compliant?

Tellyou is designed to support GDPR-aligned processing and has processes for data controller and processor roles, Data Processing Agreements, data subject rights, retention, subprocessors and international transfers.

The customer remains responsible for its own GDPR obligations when using Tellyou as part of its customer service operations.

Does Tellyou use customer conversations to train AI models?

Tellyou requires its AI providers contractually not to use customer inputs or outputs for model training. Data sent to an AI provider is used to generate the requested response or functionality.

Is all Tellyou data stored in the EU?

Not necessarily.

Some infrastructure can operate in EU regions, while certain subprocessors may process data outside the EU/EEA.

Where this occurs, Tellyou uses applicable international transfer safeguards such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.

How long does Tellyou store conversations?

Chat transcripts and AI logs have a default retention period of 12 months, but retention can depend on the customer’s configuration.

When a customer terminates its agreement, end-user chat content is normally deleted or returned according to the DPA within 30 days.

How long are voice recordings stored?

Voice recordings are retained for 30 days by default unless the customer configures otherwise.

Can customer data be deleted?

Yes. Tellyou supports deletion and other GDPR data subject rights, subject to applicable legal obligations and the customer’s role as data controller.

Does Tellyou encrypt customer data?

Tellyou states that it uses encryption during transmission using TLS 1.2 or higher and encryption at rest, together with additional access and security controls.

Which AI providers does Tellyou use?

Depending on the functionality and configuration, Tellyou may use providers including OpenAI, Anthropic, Google and ElevenLabs for AI and voice functionality.

Can Tellyou hand over a conversation to a human?

Yes. Customers can configure the AI agent to hand over conversations to a human agent when appropriate.

From Sweden with