Privacy policy

Threll.ai AS, Org. no. 935 054 702 (“we”, “our”, or “us”), is the controller for the personal data described in this Privacy Policy: data about the users of our AI-powered telephony and workflow automation platform (the “Services”), about our customers’ contact persons, and about visitors to threll.ai. This Privacy Policy explains how we collect, use, disclose, and safeguard that data.

When our customers use the Services to make and answer calls, we process the callers’ and contacts’ personal data on the customer’s behalf, as a processor under our Data Processing Agreement (DPA). The customer is the controller for that data. If you have spoken with a threll, please see the privacy notice of the business you were in contact with, and direct any requests to them.

01Information We Collect

• Account Information: When you register, we collect your name, email address, phone number, job title, your company’s name and organization number, and authentication credentials (via our auth providers).
• Billing Information: Billing contact, invoice address and payment history. Card details are handled by our payment provider, Stripe, and are not stored by us.
• Usage & Telemetry Data: Technical logs, IP addresses, device information, which pages you use in the web application, API usage metrics, and workflow execution logs, to monitor system performance and security and to understand how the platform is used.
• Website and Support Data: Pages visited on threll.ai, and messages you send us through the chat on our website or by email.
• Integration Credentials: Encrypted tokens and keys for third-party services you choose to connect (e.g., HubSpot, Shopify).

02How We Use Your Information

• Service Provision: To create and operate your account, provide the Services and support, and manage your workspace.
• Billing and Accounting: To invoice you, process payments and keep accounting records.
• Communication: To send you transactional emails, alerts, and updates regarding your account or the Services, and, if you have not opted out, news about our products.
• Improvement & Analysis: To understand how users interact with our platform and website, using usage data and statistics. We do not use call recordings or transcripts for this.
• Security & Compliance: To detect and prevent fraud, abuse, or security incidents.

03Legal Basis for Processing

Under the GDPR, we process your data based on:

• Contractual Necessity (Article 6(1)(b)): To provide the Services under our Terms of Service, including your account, support and billing.
• Legal Obligation (Article 6(1)(c)): To keep accounting records as required by the Norwegian Bookkeeping Act (bokføringsloven).
• Legitimate Interests (Article 6(1)(f)): For security, for analysing and improving the platform and our website, for communicating with our customers’ contact persons, and for sending product news to existing customers.
• Consent (Article 6(1)(a)): Where the law requires it, for example for marketing to persons who are not customers.

04Service Providers

We use the following service providers. They process data on our behalf and are contractually bound to protect it:

• Cloud Infrastructure & Database: Amazon Web Services (Sweden), including email delivery through Amazon SES, and Supabase (Sweden).
• Web Hosting: Vercel (Sweden/USA) hosts our website and web application, and provides privacy-friendly statistics for both.
• Payments: Stripe (Ireland/USA) for card payments and subscriptions.
• Customer Support, Newsletters and Usage Statistics: Munin (Netherlands) for the chat on our website, customer support by email, newsletters, and statistics on how our website and web application are used. When you sign in, Munin receives your user ID and email address, so that your use is linked to you.

The service providers we use to process call data on behalf of our customers are listed in Appendix B of the DPA. We may also disclose data where required by law.

05International Data Transfers

Some of our service providers (Amazon Web Services, Vercel and Stripe) are established in, or have parent companies in, the United States. Transfers to them are based on the EU-US Data Privacy Framework (DPF) or the EU Standard Contractual Clauses (SCCs). Supabase, which hosts our database in Stockholm, contracts through a company in Singapore; transfers to it are based on the SCCs.

06Data Retention

We keep personal data only as long as necessary for the purposes above:

• Active Accounts: Account information is kept while your account is active.
• Account Termination: When an account is closed, its data is deleted or anonymized within 14 days.
• Accounting Records: Invoices and other accounting records are kept for 5 years after the end of the financial year, as required by the Bookkeeping Act.
• Backups: Encrypted disaster recovery backups are retained for up to 30 days before being overwritten.

07Your Rights

You have the right to:

• Access, correct, or request deletion of your personal data.
• Restrict or object to specific processing activities, including our use of your data for marketing.
• Request a copy of your data in a structured format (Data Portability).
• Withdraw consent at any time where processing is based on consent.

To exercise these rights, please contact us at hello@threll.ai.

You also have the right to lodge a complaint with a data protection authority, such as the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live or work.

08Security

We implement technical and organizational measures including encryption at rest (database and storage), encryption in transit (TLS 1.2+), access controls, and regular security reviews to protect your data.

09Contact Us

If you have questions about this Privacy Policy or our Data Processing Agreement (DPA), please contact: