Call Recording and Transcription Policy
This Policy forms part of the Terms of Service and applies when you use the Services to record calls, or to produce transcripts, summaries or other AI outputs from calls.
1. Your responsibility for consent
1.1 Laws on recording and monitoring calls differ widely by country and, in the US, by state. You decide whether to record or transcribe a call, and you are solely responsible for complying with the laws that apply to every party on the call, wherever they are located.
1.2 Examples of rules you may need to comply with (not a complete list):
- United States: federal law and many states permit recording with the consent of one party, but a number of states, including California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington, require consent from all parties for some or all calls. When parties are in different states, the stricter rule usually applies in practice.
- European Union, UK and other GDPR-style regimes: you must have a lawful basis for recording under data protection law, give clear information to callers, limit recording to what is necessary, and comply with national rules on telecommunications confidentiality and employee monitoring.
- Israel: the Wiretap Law, 5739-1979, generally permits recording by a party to the conversation but prohibits secret interception by a non-party; the Protection of Privacy Law and its regulations also apply to recordings as personal data.
- Sector rules: financial services, healthcare, debt collection and other regulated sectors may impose specific recording, retention or disclosure obligations.
1.3 If in doubt, obtain the consent of all parties. Where the law requires, you must also allow a party to object, and stop recording when they do.
2. Announcements and notices
2.1 You must give callers a clear notice before recording or transcription starts, for example a prompt such as “This call may be recorded and transcribed for quality and training purposes”. Our IVR and call-flow tools let you play announcement prompts; you are responsible for configuring and wording them appropriately, including in the language of the caller.
2.2 Notices must cover AI transcription and summaries where they are used, and any use of call content beyond the call itself.
2.3 For outbound calls, internal calls and calls transferred into a recorded queue, make sure the notice is given to every party, including parties who join later.
2.4 Your privacy notice must describe how recordings and transcripts are used, retained and shared. Resellers must flow these obligations down to their customers under the Reseller and White-Label Terms.
3. Roles under data protection law
3.1 For recordings, transcripts and summaries, you are the controller (or, where you act for your own customers, a processor) and we act as your processor (or sub-processor). We process recordings only on your instructions as set out in the Data Processing Addendum.
3.2 You are responsible for responding to requests from individuals to access, correct or delete their recordings. The console and API let you find, export and delete recordings to help you do so.
4. Storage and security
4.1 Recordings and transcripts are stored in encrypted object storage on our cloud infrastructure provider, in the region associated with your Account where regional storage is available (for example the US or the EU). See the Subprocessors page for providers and locations.
4.2 Access to recordings is limited to authorised users and API keys of your Account and to our personnel who need access to provide support, investigate abuse or comply with law. Our security measures are described on the Security page.
5. Retention and deletion
5.1 By default, recordings are kept for 30 days from the date of the call and then deleted automatically. You can change the retention period per Account or per call flow within the limits shown in the console, including to keep recordings for longer or to delete them sooner.
5.2 Longer retention may incur storage fees. You are responsible for choosing a retention period that complies with the laws and regulations that apply to you, including minimum and maximum retention requirements.
5.3 You may delete individual recordings and transcripts at any time through the console or API. Deleted items are removed from active storage promptly and from backups on their normal expiry cycle.
5.4 On termination of your Account, recordings and transcripts are handled as described in the Terms of Service.
6. AI transcription and summaries
6.1 If you enable transcription, summaries or other AI features, call audio and derived text are processed by third-party AI providers acting as our subprocessors, currently including xAI (Grok). Current providers are listed on the Subprocessors page.
6.2 AI outputs may contain errors, omissions or misattributions. You must review them before relying on them, particularly for legal, medical, financial or employment decisions.
6.3 Our commitments on the use of your content by AI providers, including that it is not used to train their models, are in the AI and MCP Services Addendum.
7. Payment card data and sensitive information
7.1 You must not record, transcribe or store payment card numbers, card security codes (CVV/CVC) or PINs through the Services. The Services are not designed to be a PCI DSS-compliant environment for cardholder data.
7.2 If you take card payments by phone, use a compliant method that keeps card data out of the recording, for example pausing recording during payment, transferring to a PCI-compliant IVR, or DTMF masking provided by a payment provider. You are responsible for configuring this correctly.
7.3 Avoid recording special-category data (such as health data) unless you have a lawful basis and appropriate safeguards. Do not use recordings or transcripts for biometric identification of callers without the consent and safeguards required by law.
8. Lawful access
We may disclose recordings and transcripts only as described in the Law Enforcement Guidelines and the Privacy Policy.
9. Indemnity
You will defend, indemnify and hold harmless sip.io against any claim, fine or loss arising from recordings, transcripts or AI outputs made through your Account, including any claim that a recording was made without required consent or notice.