This notice covers this site and the Canto product. It is written to be read once, in about eight minutes, and it says what we actually do rather than what we could theoretically be permitted to do.
Two roles matter throughout. When you visit this site or hold a Canto account, we are the controller of your data and this notice governs it. When our agent answers your customers, you are the controller of that conversation and we are your processor: what we may do with it is set by our agreement with you and by the settings in your workspace, not by this page.
Nothing in this notice takes away a right the law gives you. Where the two disagree, the law wins.
Who we are
Canto is a company registered in Portugal, with offices at Rua da Prata 88, 1100 Lisboa, and at 212 King Street West, Toronto M5H, Canada.
For the data described in this notice we are the controller. Our privacy contact answers at hello@canto.example, and a named data protection officer is appointed for the Lisbon entity. Mail addressed to either office reaches them.
If you are a customer of a company that uses Canto, and you are here because an agent told you it was recording, the company you were speaking to is the controller of that conversation. We answer on their behalf. The section below on what you can ask for says what to do in that case, and we will not leave you without an answer either way.
What we collect
Four kinds of data, and we would rather hold less of all four.
Account data: the name, work email and company of the people who hold a Canto login, the workspace they belong to and the role they hold in it. If you sign in through your own identity provider we receive the identifier it sends and no password ever reaches us.
Billing data: company name, billing address, tax identifier and the invoices themselves. Card details are handled by our payment processor and are never stored on our systems.
Product usage: which screens an account opens, which settings it changes and when, in an audit log that is itself a product feature. Volume counters for the invoice: conversations, voice minutes, indexed documents.
Site data: what a browser sends when it asks for a page, plus the contents of any form you send us.
We do not buy contact lists, we do not enrich your record from third-party data brokers, and we do not build a profile of you across other people’s websites. The cookies section below covers the site itself.
The conversation itself
This is the part that matters, and the part most notices in this category leave vague.
When an agent answers on your behalf it processes what the customer says, what the agent replies, the channel it happened on, the time it took and the outcome. On a voice channel that means audio, which is transcribed and may be retained as a recording if your workspace is set to keep one. On chat channels it means the text of the thread.
What the agent is not allowed to keep
Sensitive strings are redacted before a transcript is written. A full card number is never read back and never stored. Where a customer volunteers something sensitive, it is masked in the transcript and in the analytics that read it. The guardrails every deployment ships with are on the product page.
Training
We do not train shared models on your conversations. Content from your workspace is used to answer inside your workspace and nowhere else, it is never pooled with another customer’s, and it is never sent to a model provider under terms that would allow them to train on it. If we ever want to change that, it would be an opt-in, asked for plainly, and refusing it would cost you nothing.
Why we are allowed to
Under the GDPR and the UK GDPR every use of personal data needs a lawful basis. Ours are these, and there is no fifth.
Contract: running the account, answering the conversations, sending the invoice and supporting all three.
Legitimate interests: keeping the service secure, preventing abuse, measuring how the product is used in aggregate, and writing to a business contact about the product they bought. We weigh each of these against your interests and we will show you the assessment if you ask.
Legal obligation: tax records, accounting records, and answering a lawful order.
Consent: for optional things only, which means marketing email to someone who is not already a customer, and any nonessential cookie. Consent can be withdrawn at any time and withdrawing it never affects the service.
Where we act as your processor, the basis for the conversation belongs to you. Our agreement with you records it and we act only on your documented instructions.
Who else touches it
We use a short list of subprocessors, each under a written contract with the same obligations we carry ourselves.
Cloud hosting, in the region your workspace is set to.
Speech recognition and speech synthesis, for the voice channel.
Language model inference, under terms that forbid training on your content.
Telephony and messaging carriers, for the channels you connect.
Payment processing, error monitoring and product analytics.
The current list, with each provider’s name, purpose and location, is published in your workspace under Settings and is available on request. We give thirty days of notice before a new subprocessor starts, and you may object in that window.
We do not sell personal data and we do not share it for cross-context behavioral advertising. There is no exception to that sentence.
Where it lives, and how long
A workspace is pinned to a region when it is created: the European Union or the United States. Conversation data stays in the region you chose.
Support staff in the other office may need access to diagnose an incident. That access is role based, it is logged in the workspace’s audit log, and it is covered by the standard contractual clauses together with the additional measures our transfer assessment sets out.
Retention
Conversation content: the window your workspace sets, from thirty days to twenty-four months. Voice recordings may be set to zero, in which case only the redacted transcript survives the call.
Aggregate metrics: counts, latencies and resolution rates with no conversation content in them, kept for as long as the account exists.
Account and audit data: for the life of the account, then twelve months.
Billing records: ten years, because tax law says so.
When an account closes, conversation content is deleted within thirty days and backups age out within a further thirty-five. We will confirm the deletion in writing if you ask us to.
What you can ask for
You can ask for a copy of your data, a correction, a deletion, a restriction, a portable export, or that we stop relying on legitimate interests altogether.
Write to hello@canto.example and we will answer inside thirty days. We do not charge for it and we will not ask you to justify the request. If we cannot do what you asked, we will say which part of the law stops us.
If you were a customer of a company using Canto and your request concerns that conversation, send it to us anyway. We will pass it to the controller within two business days and tell you we have done so, because being bounced between two companies is not an answer.
You may also complain to a supervisory authority. Ours is the Comissão Nacional de Proteção de Dados in Portugal, and you may instead go to the authority where you live or work.
How we protect it
Encryption in transit and at rest, single sign-on and directory provisioning on the plans that include them, and an audit log of every action taken inside a workspace.
Access to production is role based, granted for a reason and reviewed quarterly. Staff take security training when they join and again every year. We run an annual penetration test with an external firm and we fix what it finds before we publish the letter.
If a breach affects your data we will tell you without undue delay and inside seventy-two hours of becoming aware of it, with what happened, what data, what we have done and what you should do. We would rather send that message early and be slightly wrong than send it late and be exactly right.
Cookies, and this site
This site sets one cookie, and it is the one that keeps you signed in to the dashboard.
We use privacy friendly analytics that count page views without a cookie, without a cross site identifier and without a profile of the visitor. There is no advertising pixel on any page of this site, which is also why there is no consent wall in front of it.
Server logs record the request, the time, a truncated address and the browser string, and they are kept for thirty days for security and debugging. Forms you send us arrive as email and are kept for as long as the conversation they start.
Changes, and where to write
We date every version of this notice and keep the previous ones. This is version 2.1, effective Jul 1, 2026.
A change that materially affects how we handle conversation data is announced by email to workspace administrators at least thirty days before it takes effect, and carries a summary of what moved. A typo or a clearer sentence is fixed without ceremony and the date at the top changes.
Anything at all about this page goes to hello@canto.example, or by mail to either office. The terms of service sit next to this notice and the two are meant to be read together.