Dialora

GDPR overview

The compliance page opens with an explicit claim that Dialora.ai is safe, secure and GDPR-compliant, and backs it with a public checklist whose every line is marked completed: lawful basis, transparency, protection by design, 72-hour breach notification, encryption, internal security policy, impact assessments, processor agreements and the full set of data-subject rights. An accountable person is named, an IT Security Manager reachable at legal@dialora.ai, and a data-request form is offered. A DPA is accepted automatically with the terms and can be signed on request, and a subprocessor list is published. Two gaps stand out: no Article 27 EU representative and no Article 37 data protection officer are designated, and the page still invokes the EU-US Privacy Shield, invalidated in 2020. Standard contractual clauses are cited for international transfers.

Who owns the data?

Dialora states plainly that customers own and control the data they collect, and that any retention period demanded by law or internal policy is set by the customer rather than the vendor. Content you upload stays yours: the terms take only a non-exclusive, royalty-free licence over it, and only for the purpose of running the service. Dialora keeps every right over its own software, trademarks and content. Access to connected Google and GoHighLevel accounts is limited to data you already own, granted after explicit consent and framed by a stated principle of least privilege. Only qualified employees with a specific need, typically a support request, may open a customer account.

Reuse rights

Customers keep the right to reuse what the platform produces. Call logs, transcripts, recordings and extracted fields can be exported in standard, machine-readable formats and pushed into a CRM or any external system through webhooks, Zapier, Make, n8n or custom API calls, without asking Dialora for permission, and deletion is self-service from the dashboard. On its own side Dialora commits, under Article 28, to process personal data only on the customer's instructions and not to pass it to a third party without consent; it states that it does not sell personal information and does not use connected Google or GoHighLevel data for advertising. Nothing on the site says whether that data feeds model training, and no opt-out is documented.

Data retention & training

Hosting summary

Dialora states that its data centres are with Amazon Web Services in the United States, and the privacy policy adds that information may be processed in the United States or in other countries where its servers or service providers sit. For transfers out of the EU the privacy policy cites standard contractual clauses; the compliance page, less reassuringly, still invokes the EU-US Privacy Shield, a framework invalidated in 2020. Enterprise customers are offered global data residency control and, at the far end, SIP trunking or a fully on-premise deployment. Every named subprocessor is a United States company: AWS, Google, Google Analytics, Googleapis, Googlesyndication, Facebook, HubSpot, Deepgram, OpenAI, ElevenLabs and Stripe. Data is encrypted with a strong industry-standard cipher in the primary databases and in backups, and over TLS in transit. Access is restricted to qualified employees with a specific need, typically a support request. The published stack is React.js, Node.js, PostgreSQL and Supabase.