Your data is your data.

Telenoa, Danish CVR no. 46373731, is the controller for the processing described in section 3: data about you as a customer and user of Telenoa, about visitors to telenoa.com and about people who contact us.

If you have questions about how we process personal data, or want to exercise your rights, contact us:

• Email: kontakt@telenoa.com
• Phone: +45 31 36 30 16

We have not appointed a data protection officer (DPO). All data protection questions go to kontakt@telenoa.com.

When a business uses Telenoa for its own customers' enquiries, calls and text messages, the business is the controller and Telenoa is its processor. We then only process the data on the business's instructions and under the data processing agreement. We do not use it for our own purposes, and we do not train AI models on it. This covers:

• Enquiries and emails: What customers send through forms, the widget, the API and connected email accounts: name, email, phone number, subject, message, custom fields, attachments, the sender's IP address and the page the form was sent from
• Calls on Noa Voice: The caller's phone number, time and duration, a transcript of the conversation and what Noa noted. The audio is processed while the call is live. It is only stored if the business has switched on “Record calls”. Noa then says so at the start of the call. Our copy is deleted automatically after 30 days. The telephony provider's copy is deleted as soon as our copy is confirmed saved, and at the latest after 30 days
• Text messages: The business can let Telenoa send text messages in its name after a call: after a missed call, to confirm a booking, when a message has been taken, with practical information or with a review request, if the caller said yes to that during the call. We store the number, the text, delivery status and, for reviews, the question and the answer
• Noa remembers contacts: Noa can store short, lasting notes about a contact based on the contact's calls and emails (e.g. name, preferred language or an earlier appointment) so she can take them into account next time. The feature is on by default for new businesses and off for businesses that were customers before 3 October 2026. The business can switch it off and delete the notes, and the notes follow the business's retention period
• Knowledge base and users: The texts and documents the business gives Noa, and the name and email of the business's employees

The terms for that processing are in the data processing agreement.

If you have called or written to a business that uses Telenoa, contact that business to get access to, correct or delete your data. The data comes from you, when you wrote or called. We help the business respond.

For everything described in section 3, Telenoa is itself the controller. This includes your account, login, payment, support and recording of app usage.

Here is each processing activity we are the controller for, with its purpose, legal basis under the GDPR and how long we keep the data.

We get most data from you. Some comes from elsewhere:

• From your company: when an administrator invites a colleague, we get the colleague's name and email
• From Google or Apple: when you log in with them, we get your name and email
• From Stripe: whether a payment went through
• From the Danish business register (CVR): the company's name and address when you enter a CVR number at sign-up
• From our customers: data about their customers and the people who call or write (see section 2)

We never sell personal data and never share it with others for marketing. We use these vendors (processors and sub-processors) to run Telenoa:

The full list with transfer basis and change log is at telenoa.com/en/sub-processors.

AI calls are logged in our own database without content: only feature, model, token count, price, time and whether the call succeeded. We no longer use Langfuse. Error log: our own installation of GlitchTip on the same server. Errors are stored without user, cookies or request content, and email addresses, phone numbers and keys in the error message are replaced before it is stored. Visitor statistics for telenoa.com: our own installation of Umami (statistik.telenoa.com). It sets no cookies and stores no IP addresses. The app only sends two events there, “created” and “paid”, without personal data. When Noa reads your website or your documents into the knowledge base, this is done with Crawl4AI and Docling, which we run ourselves, not at a third party. Operational alerts go to an internal Discord channel. They only contain where in the system the error happened and a scrubbed error message with email addresses, numbers and quoted text removed.

If you connect other systems to Telenoa, e.g. a Gmail or Outlook account, Google Calendar, Google Sheets, a CRM system or a web shop, we send data there because you asked us to. This only happens if you switch the connection on yourselves.

We only disclose data to authorities when the law requires it.

Telenoa's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our server and database are in Germany, the telephony server is in Amsterdam, and files are stored in the EU. Some vendors are US companies, and data may be processed in the US: Resend, OpenRouter (and Google, which it sends the AI calls to), Google Gemini API, Exa, Stripe, Telnyx, Soniox and ElevenLabs. Cloudflare and DigitalOcean are also US companies, but our files and the telephony server are in the EU.

The transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the vendor is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (GDPR Art. 46). Write to kontakt@telenoa.com if you want a copy of the basis for a specific vendor.

We keep data as briefly as possible and as long as necessary:

• Account data: As long as the account exists. When you cancel, we delete the account and its data 60 days after termination. You are notified 14 and 3 days before. If you ask, we delete within 30 days. We do keep what the Bookkeeping Act requires us to keep
• Billing data: 5 years from the end of the financial year (Danish Bookkeeping Act § 10): subscriptions, purchases, minute usage and AI usage. The content of calls and enquiries is not included
• Enquiries: According to the retention period the business chooses (6, 12, 24, 36 or 60 months without activity, or no automatic deletion; new businesses start at 24 months). Open and starred enquiries are not deleted automatically
• Contact notes: Follow the business's retention period, and the business can delete them itself
• Call recordings: Only when recording is switched on. Our copy is deleted automatically after 30 days. The telephony provider's copy is deleted as soon as our copy is confirmed saved, and at the latest after 30 days
• Text message log and text message consents: Deleted automatically after 12 months
• Recordings of app usage: 30 days
• AI usage: 30 days for the per-call count, 400 days for the record without content
• Support cases: 15 days after they are closed
• Support chat conversations: 90 days
• Error log: 30 days
• Log files: Overwritten continuously
• Backups: The database is backed up every night. One copy is kept on our server, and an encrypted copy is sent off the server to Cloudflare R2 in the EU. Encrypted backups, including those off the server, are deleted after 14 days

Here is what we actually do:

• Encryption in transit: All traffic to the app and the website uses HTTPS (TLS 1.2 or 1.3)
• Login: Passwords are only stored as a secure hash (scrypt), never in plain text. Password login always requires a one-time code sent by email
• Email accounts: Passwords and access keys for connected email accounts are encrypted with AES-256-GCM before storage
• Access control: Roles (Administrator and Employee) control who can do what in your company, and each company's data is kept separate
• Network isolation: The database cannot be reached from the internet; only the app on the same server can connect to it. The server is only administered with an SSH key
• AI vendors: AI models we use via OpenRouter are only called through providers without data retention. They neither store nor train on the data (zero data retention). Anthropic (Claude) neither stores nor trains on your data (zero data retention agreement). Google's Gemini API (paid tier) does not train on the data, but may keep it for a short period to detect abuse
• Security breaches: If a personal data breach occurs, we notify you and the Danish Data Protection Agency under GDPR Art. 33 and 34

Telenoa uses AI to sort enquiries, write reply drafts, filter spam, answer in chat and answer the phone. We do not train AI models on your data. AI models we use via OpenRouter are only called through providers without data retention. They neither store nor train on the data (zero data retention). Anthropic (Claude) neither stores nor trains on your data (zero data retention agreement). Google's Gemini API (paid tier) does not train on the data, but may keep it for a short period to detect abuse.

• No decisions with legal effect: We make no decisions based solely on automated processing that have legal effects or similarly significantly affect anyone (GDPR Art. 22)
• Autopilot: A business can choose to let Noa send replies to certain types of enquiries without a human reading them first. That is the business's choice and responsibility
• Noa says she is an AI: On the phone and in chat, Noa always discloses that she is an AI assistant (EU AI Act, Art. 50). At the start of every call she also says that the call is being noted (and recorded, if the business has switched it on). The business cannot remove that disclosure
• Noa can make mistakes: Noa's replies, transcripts and notes may be wrong or incomplete. The business is responsible for checking important information
• Support chat: Replies in the support chat on telenoa.com and in the app are written by Noa, our AI assistant. You can always ask to reach a human

We only use what is needed for things to work:

The full overview is at telenoa.com/en/cookies.

Under the GDPR you have these rights. We reply within one month:

• Right of access (Art. 15): You can get a copy of the data we hold about you
• Right to rectification (Art. 16): You can have incorrect data corrected
• Right to erasure (Art. 17): You can have data deleted when there is no longer a reason to keep it
• Right to restriction (Art. 18): In certain cases you can have the processing restricted
• Right to data portability (Art. 20): You can get your data in a machine-readable format. Administrators can make a full export in the app themselves
• Right to object (Art. 21): You can object to processing based on legitimate interest, e.g. recording of app usage and visitor statistics
• Right to withdraw consent: Applies to processing based on consent (e.g. newsletters). It does not affect processing before you withdrew it

Write to kontakt@telenoa.com to exercise your rights. We may ask you to confirm who you are. If it concerns data we process for one of our customers (section 2), we forward the request to that business.

To create an account and buy a subscription you must give us name, email, company and payment details. This is necessary to enter into and perform the contract, and without it we cannot provide the service. Everything else is voluntary, e.g. the newsletter or writing to us. As a visitor to telenoa.com you do not have to give us anything.

When a business connects its Google account to Telenoa (Gmail, Google Calendar, Google Sheets or Google Business Profile), we only use the data needed for the feature the business has switched on:

• Google Calendar: we read when the calendar is busy (free/busy), show the list of calendars you can write to, and create the appointment Noa books. We do not read the content of your existing appointments and never change or delete them.
• Google Sheets: we write new enquiries and calls as rows in the spreadsheet Telenoa itself created for you. We have no access to your other spreadsheets or files.
• Gmail: we read incoming emails in the inbox you connect so they appear as enquiries in Telenoa, and we send the replies you send from Telenoa – or that you have chosen to let Noa send – from your Gmail address. We never delete, move or change emails in your Gmail. We read your email address to show which account is connected.
• AI processing of emails: the content of an email is processed by our AI sub-processors (see Sub-processors) solely to create drafts, summaries and categories for you. It is never used to train AI models, and people at Telenoa only read it if you ask us for support or the law requires it.
• Google Business Profile: we read your profiles, location addresses, opening hours and reviews so Noa answers with the right opening hours and you can see your reviews in Telenoa. We never create, change or post anything on your profile.
• Data from Google is never shared with third parties, never sold, never used for advertising and never used to train AI models.
• You can disconnect at any time under Connections in Telenoa or in your Google account (myaccount.google.com/permissions). We then stop using the data and delete the stored access keys.

Telenoa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We only use Google user data to provide the features the user has enabled (reading free/busy times and creating the bookings our assistant makes; writing inquiry rows to the spreadsheet Telenoa created; importing incoming Gmail messages as inquiries and sending the replies the business sends from Telenoa; reading Google Business Profile locations, opening hours and reviews). We do not share it, sell it, use it for advertising, or use it to train AI models.

When you sign a document that a business has sent via Telenoa, you use a simple electronic signature under the EU eIDAS Regulation. It is legally valid and has the same binding effect as a handwritten signature for most agreements.

• Consent: By pressing “Sign” you agree to sign electronically and to receive the document electronically
• What we store: Your name, your email or phone number, the time, IP address and browser, and the signed document. We do this as evidence of the signature on behalf of the business that sent the document. The business is the controller and Telenoa is the processor
• Copy: You can always download the signed document from the link, and you can ask the sender for a paper copy
• Withdrawing consent: If you do not want to sign electronically, close the page and contact the sender. A signature that has already been given cannot be withdrawn via Telenoa. Contact the sender about the agreement
• Requirements: An up-to-date browser on a phone or computer, and an email address or phone number where you can receive the link
• Questions: Contact the sender or kontakt@telenoa.com

If you believe our processing of personal data breaks the rules, you can complain to:

• Datatilsynet: Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Phone: +45 33 19 32 00
• Email: dt@datatilsynet.dk
• Website: datatilsynet.dk

We would like to hear from you first, though, so we can try to resolve it.

This version is dated 24 October 2026. We update this policy when we change how we process personal data. The date at the top shows when it was last changed. We notify customers of material changes by email.

• 24 October 2026: Short overview at the top. Clearer about when Telenoa is the controller and when we are your processor. One contact address: kontakt@telenoa.com. New section on version and changes. The English text no longer says the text message log is kept indefinitely; like the Danish text, it now says 12 months. Clarified: backups are deleted after 14 days, also off the server; the telephony provider's copy of recordings is deleted once ours is saved; what AI vendors may keep; no free trial at purchase
• 19 October 2026: Previous version