PolyAI

GDPR overview

GDPR compliance is claimed explicitly rather than implied: the compliance page states that PolyAI complies with the regulation, and lists transparent processing, secure handling of personal and sensitive data, breach prevention, and access and deletion rights. Concrete artefacts back the claim. A Data Processing Agreement is published, the sub-processor list is public on a Vanta trust centre, and clients who register for notifications get at least fifteen days' notice before a sub-processor changes. Transfers rely on adequacy, UK and EU standard contractual clauses and the Approved Addendum, covering the United States, the EEA and the UK; the ICO is named as supervisory authority. Certifications include ISO/IEC 27001, SOC 2 Type II and Cyber Essentials Plus. One gap: no Article 27 EU representative is named anywhere, although the controller is established in the UK.

Who owns the data?

For conversations handled through the service, the enterprise client remains the controller of the personal data and PolyAI acts primarily as a processor on that client's instructions. PolyAI Limited is itself the controller for website and prospect data, and it acts as joint controller with its US affiliate PolyAI Technologies, Inc. for certain platform-usage and conversation data. The published Data Processing Agreement gives clients ninety days after contract expiry to obtain or download a copy of their covered data, after which PolyAI deletes all copies held by it and by its authorised sub-processors. PolyAI also commits publicly never to attempt to re-identify de-identified data.

Reuse rights

Clients keep access to their own conversation data and need no permission to reuse it: recordings, transcripts and metadata are retrievable through the Conversations API, readable in Agent Studio, or synced automatically to the client's own Amazon S3 bucket. PolyAI's own reuse is narrower and conditional. It evaluates and annotates conversations to assess model effectiveness, and extracts voice snippets and conversation turns to improve its assistants, model training included — but only, in its own words, where the client and applicable law permit. The training-data page confirms that datasets are sourced from customers solely to the extent contractually authorised, with personal information redacted beforehand and synthetic data added to broaden coverage. Users without PII access receive redacted recordings.

Data retention & training

Hosting summary

PolyAI runs its infrastructure on AWS. The privacy notice's transfer table names three destinations for personal data — the United States, the European Economic Area and the United Kingdom — with adequacy decisions, UK and EU standard contractual clauses, the Approved Addendum, and the EU-U.S. Data Privacy Framework and its UK extension as safeguards. The developer documentation shows matching regional enterprise clusters, us-1, euw-1 and uk-1, so a workspace can be pinned to a region. Two caveats matter. The DPA is deliberately broader than the privacy notice: it allows PolyAI to process covered data anywhere it or its sub-processors maintain facilities, which makes residency a contractual matter rather than a platform guarantee. And the IP address serving the website resolves to an anycast Amazon node in the United States, which says nothing about where conversations are stored. Clients can sync recordings and transcripts to their own S3 bucket. PolyAI states alignment with UK National Cyber Security Centre guidance and runs regular third-party audits and penetration tests.