Legal

Privacy policy

Last updated 22 October 2026

This policy explains how NordTell, operated from Denmark, handles personal data on this website and in the NordTell platform. It is written in plain words on purpose. If anything here is unclear, ask us through the contact page.

Two roles

For visitors of this website and for the people who create accounts, NordTell, made by Interactive Made ApS (CVR 41133902, Denmark), is the data controller. Write to us at hello@nordtell.com. For the calls your agents handle, the callers' voices, transcripts and the details they share, you are the controller and NordTell is your processor, acting on your instructions and the settings you choose in the platform, under our Data Processing Agreement.

What we collect on this website

  • Server logs: IP address, time, page requested, browser type. Kept briefly for security and to keep the site running.
  • The contact form: the name, email, company and message you send. We use it only to answer you, and it lives in our mailbox.
  • The waiting list: the email address and details you give us. We use them only to write to you about NordTell.
  • The chat bubble: the messages and files you send us, kept with our support records. Your browser keeps a random code, so the conversation carries on from page to page.
  • Partner links: if you arrive through a partner's link (nordtell.com/r/…), a cookie remembers that partner for 90 days, so the right partner is credited if you become a customer.
  • Small browser storage entries that remember your language, your currency, your cookie choice, and that you have seen the opening animation. No advertising cookies.
  • Google Analytics, but only if you choose "Accept all" in the cookie popup: which pages are read, roughly where visitors come from and which buttons are used, so we can see what is useful. Advertising features are switched off, and Google Analytics does not store IP addresses. The legal basis is your consent (GDPR Article 6(1)(a)); you can change your choice at any time under "Cookie settings" at the bottom of every page. Google may process the data outside the EU under the EU-US Data Privacy Framework.

What we collect in the platform

  • Account data: name, email, password (stored hashed), optional two-factor secret, sign-in events.
  • Workspace data: agents, prompts, numbers, leads, campaigns, tools, knowledge documents, settings and the audit log of changes.
  • Call data on your behalf: audio recordings if you enable them, transcripts, summaries, phone numbers, the variables the agent collected, and technical call metadata.
  • Billing data: your package, minutes used and bought, invoices. Stripe collects your card details, billing address and VAT number when you pay; card details never touch our servers.
  • How the app is used: which pages you open and how you move and click, as a screen recording. The text on the screen can be read in it, so we can see what you saw, for example an error message. What you type into fields, secret keys shown on screen and all pictures are hidden in your browser before anything is sent, and page addresses are sent without ids or search words. Payments happen on Stripe's page and are never recorded. A recording is linked to your account by its id number, never your name or e-mail, and nothing is stored in your browser for it. We use it only to find what is hard to use, based on our legitimate interest in improving the app (GDPR Article 6(1)(f)). It is on for every account, whatever you chose in the cookie popup, and you can switch it off at any time under Account settings. Our own team, support visits and agencies' branded apps are never recorded. PostHog keeps the recordings in Frankfurt, Germany.

Where it is stored

The platform, its database and its files run on DigitalOcean servers in Frankfurt, Germany, within the European Union. Every night we make a backup and check that it can be restored. Backups are kept for three nights on the server and for 14 days in separate DigitalOcean storage in Amsterdam, the Netherlands, also in the EU. So something you delete can stay in a backup for up to 14 days before it is gone for good.

Who else processes data

A voice agent uses external AI models and telephone carriers. Which ones is your choice, per agent and per number, and each is named in the platform where you choose it. Depending on your settings, calls may be processed by OpenAI, Anthropic, Google, ElevenLabs, Cartesia, Deepgram, Gladia or Soniox (speech and language models), by Telnyx, Twilio or your own SIP provider (telephony), and by LiveKit (call media). OpenAI also writes the summary of every call and makes knowledge bases searchable. Payments are processed by Stripe, and our emails are sent through Simply.com in Denmark. Recordings of how the app is used are made with PostHog and kept in Frankfurt, Germany. Each acts under its own data processing terms; we list the provider next to the model so that choosing one is an informed decision.

Your data is stored in the EU, but some of these companies process call content, the audio and the text, outside the EU, mainly in the USA. Those transfers rest on the EU-US Data Privacy Framework where the company is certified, with the EU Standard Contractual Clauses as the fallback, or on the Standard Contractual Clauses alone. Our sub-processor page lists every company: what it does, what data it gets, where, and on what basis.

If you sign in with Google, Microsoft, GitHub or Apple, that company handles the sign-in under its own privacy policy.

How long we keep it

  • Calls, recordings, transcripts and leads: until you delete them, or automatically after the number of days you choose under Settings → Audit log → Data retention.
  • Audit log: for as long as the workspace exists.
  • Account data: while your account exists.
  • Invoices and accounting records: five years from the end of the financial year they belong to, as the Danish Bookkeeping Act (§ 12) requires.
  • Backups: up to 14 days, then they are deleted.
  • Recordings of how the app is used: 30 days, then PostHog deletes them.
  • Contact-form messages: until answered and no longer needed.

Your rights

You can see, correct, export and delete your data. Most of it you can do yourself in the platform: delete a call, a lead, a document, or your whole account. For anything else, or if you are a caller who spoke to an agent run by one of our customers, contact us or the business you called and we will help. You can also complain to the Danish Data Protection Agency (Datatilsynet).

Security

Traffic is encrypted with HTTPS. Provider API keys and the carrier credentials you connect are stored encrypted, and passwords only as hashes. Access is by role; two-factor sign-in is available for every account. Every change in a workspace is written to an audit log. Recordings can only be opened through signed links that expire. Our support team can enter your account only while you allow it. Backups are made every night and checked by restoring them. The full list is in the annex of the Data Processing Agreement.

Changes

When this policy changes, the date at the top changes with it, and material changes are announced in the platform.