Updated: 2026-10-27
Privacy policy
Reponzo is an AI phone receptionist for businesses (restaurants, salons, gyms) in France and Canada. This policy explains what data we process, why, and your rights.
1. Who is responsible
For business owner accounts (sign-up, billing), Reponzo, published by Menhaj Safi (sole proprietor), is the controller.
For the data of people who call a business (name, number, order, appointment), the business is the controller and Reponzo acts as its processor, on its instructions. The data processing agreement (DPA) is published on the site.
2. Data we process
Business owners: name, email, password (stored hashed with scrypt, never in plain text), business details (address, hours, menu, services), billing data handled by Stripe (we never see your card number).
Callers: phone number, first name given during the call, order or appointment details, call length and a short automatic summary.
Calls are not recorded by default. Speech is transcribed in real time so the conversation can happen.
Prospects who fill in our form: name, business, phone, email, city.
3. Purposes and legal bases
Providing the service (performance of the contract): answering calls, saving orders and bookings, sending SMS confirmations.
Billing the subscription and tracking call minutes (contract, legal obligations).
Securing the service and preventing abuse (legitimate interest).
In Canada, we handle personal information with the consent of the individuals concerned under PIPEDA and Quebec's Law 25; businesses tell their customers that calls are handled by a virtual assistant.
4. Service providers
Vapi (call orchestration), ElevenLabs or Cartesia (voice), Deepgram (transcription), Anthropic (language model), Twilio (telephony and SMS), Stripe (payments), Supabase (database), our web host.
Some providers are located outside the European Union and Canada, notably in the United States. Transfers rely on the European Commission's standard contractual clauses or equivalent safeguards.
5. Retention
Call logs and summaries: 12 months.
Orders and bookings: 24 months, or less if the business asks.
Business accounts: for the subscription, then deleted within 90 days of closure, except accounting records (10 years for invoices in France).
Prospects: 3 years after the last contact.
6. Your rights
You can request access, correction, deletion, restriction and portability of your data and object to some processing (GDPR). In Canada, you can access and correct your personal information (PIPEDA, Law 25).
Write to the contact address shown on the site. We answer within 30 days. Our person in charge of the protection of personal information (Law 25) is Menhaj Safi, reachable at the same address.
You can also contact the CNIL (France), the Office of the Privacy Commissioner of Canada or Quebec's Commission d'accès à l'information.
If you called a business, contact that business first, as it controls your data; we help it respond.
8. Security
Encrypted connections (HTTPS), hashed passwords, data access limited to the owning business, secrets kept out of the code, call logs without audio recordings.