Recordings, Transcripts, Data: What Actually Happens to Your Calls

A call handled by a modern service leaves five traces: the caller's number, timestamps, the audio recording, the written transcript, and the summary you read. Each is a personal datum — possibly a name, an address, sometimes a medical or financial reason. The total is more sensitive than each of the parts.

The point that changes everything: even delegated, the processing remains your responsibility toward your clients. The provider executes; you answer. That's no reason to flee automation — it's a reason to pick a provider that makes control easy: visibility, export, deletion. The rest of this article is the matching questionnaire.

When a call is recorded or transcribed, an honest announcement at the start is the standard of care: one short, understandable sentence, no jargon — "this call is handled by our answering system to direct you." It protects the caller, it protects the business, and it avoids conversations discovered after the fact.

The consent that counts is the provable kind: a timestamped announcement in the call log, an honored SMS STOP keyword, a documented trail. A serious provider produces this proof automatically and shows it to you — a provider who "handles that generally" handles nothing at all.

The retention question has a binary answer: either the provider knows, or it doesn't. "We keep as long as necessary" isn't an answer — it's the absence of a policy. Serious answers look like: recordings deleted after a defined period, transcripts kept longer for your business history, deletion on request within an announced delay.

Your departing right is the departure test: full export of your data before leaving the service, verified deletion after. A provider holding your recordings hostage after a cancellation has told you, too late, what it thought of your data. Verify this point on the way in, not on the way out.

The access question breaks into three: who at the provider can technically listen to a recording; who at your company sees which conversations; and what happens when someone leaves. The good answers: no one without a documented support reason; per-user access, revocable in one click; immediate revocation when an employee departs — not a support call to make during a resignation.

The technical baseline fits in one sentence: encryption in transit and at rest, hosting with an announced location, listed subcontractors. These three points guarantee nothing on their own — but their absence guarantees the opposite, and that's a fast filter during selection.

Depending on where your clients live — Europe and GDPR, Canada, the United States and its state laws — your duties vary in detail, not in spirit: purpose limitation, proportionate security, informing people, breach notification. This article is general information, not legal advice — verify your precise obligations with your usual source.

Practice beats doctrine: minimizing what you collect remains the cheapest protection. An answering system has no business asking for a card number by phone — payment goes through a secure link sent by text, and nothing sensitive lingers in a transcript. Every datum never collected is a datum never leaked.

1) Where is the data hosted, and under which jurisdiction? 2) How long are recordings kept, with automatic deletion or not? 3) Who can listen to a recording, in what case, with what trail? 4) What's the encryption, and the subcontractor list?

5) In what format does my data export — CSV, audio, JSON? 6) What's the deletion delay on request? 7) Are my conversations used to train shared models? 8) What exactly happens at contract end? Eight written answers, obtained before signing, beat every trust audit after the fact — and a provider hesitating on any one of them just made your choice easier.