CallCrewAI

GDPR overview

The GDPR position is contractual rather than advertised. The Terms commit both parties to the data protection laws that apply to them, including the EU and UK GDPR, and set out a full processor clause: processing on documented instructions only, encryption in transit and at rest, confidentiality obligations on staff, breach notification within 72 hours, and deletion or return of personal data when the contract ends. A Data Processing Addendum is available to customers on request. Thirteen subprocessors are named one by one with their role, and the publisher undertakes to give reasonable notice before adding or replacing one. Cross-border transfers rely on the EU Standard Contractual Clauses, the UK IDTA or an adequacy decision. Crewlabs Ltd is established in Ireland, so no Article 27 representative is required or named.

Who owns the data?

The Terms are unambiguous: the customer owns all Customer Data, including both the inputs to and the outputs from the AI features, which covers call recordings, transcripts, summaries and structured notes. Under a company account the customer is the data controller and Crewlabs Ltd acts only as a processor, working on documented instructions. Anyone who calls a business using CallCrewAI is told that the business, not CallCrewAI, controls their data and is the right party to contact. The publisher keeps ownership of the platform itself - software, models, designs and branding - and grants no rights over it beyond use of the service.

Reuse rights

The customer can reuse its own data freely: it owns the recordings, transcripts, summaries and notes, can export them in a common machine-readable format on request, and can disconnect any integration at any time. No permission from the publisher is needed. What Crewlabs Ltd may do is narrower and worth reading. It uses Customer Data to run and support the service, to display the dashboards the customer asks for, to guard against fraud and abuse and to meet legal obligations. It rules out training or fine-tuning AI models on identifiable Customer Data, rules out advertising use, and states that Google user data is never used to train general models. In exchange it reserves the right to use de-identified and aggregated data to develop, secure and improve its services and models, provided nothing identifies a customer or an individual. Customer names and logos may be shown as references, but any named case study or quoted testimonial needs prior written approval and can be withdrawn by email.

Data retention & training

Hosting summary

No hosting country or region is declared. Neither the privacy policy nor the Terms name a jurisdiction, and there is no security or trust page - the URL returns a genuine 404. The closest statement is a transfer clause: some subprocessors process data in other countries, for example in the United States, and cross-border transfers rely on the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or an adequacy decision, with additional measures where appropriate. That is a transfer mechanism, not a hosting declaration. What is disclosed is who the infrastructure providers are. Thirteen subprocessors are named one by one with their role, including Google Cloud - with Firebase and Google Maps Platform - for hosting, database, authentication and storage, and Amazon Web Services for website hosting. Security measures are described in general terms: encryption in transit and at rest, access control on a least-privilege basis, confidentiality obligations on staff, and monitoring and auditing. Buyers with a data-residency requirement will have to ask for the answer in writing.