Privacy Policy

The controller of the personal data collected through this site is VIGNEDEV (Appellia).

For any question regarding your personal data: contact@appellia.fr.

The personal data collected depends on the features you use. The exhaustive list is in the Subprocessors section below, where each recipient indicates precisely what data they process and for what purpose.

The processing of your data relies on one of the legal bases set out in Article 6 of the GDPR depending on the context: contract performance, legitimate interest, consent, or legal obligation.

When you call a company using Appellia, an automated voice assistant answers. It tells you so in its first sentence, and you can ask it at any point to take a message so that a person calls you back.

What you say and what it answers are automatically transcribed in full, then summarised. That written report is intended for the professional you called: they find it in their Appellia account and, depending on their settings, also receive it by email, in order to handle your request, call you back or confirm your appointment. These transcripts also help us spot the assistant’s mistakes and improve the service; access is then limited to the people at Appellia who need it. They are never sold, and never used for advertising.

Where your voice goes. We would rather write it down than let you assume otherwise: the conversation is processed live, and its transcript produced, by an artificial intelligence model provider established outside the European Union. That provider guarantees no European location for the processing: submitted content may pass through its facilities outside the European Union, covered by standard contractual clauses. Storage does stay European: the database and files are hosted in the European Union, under strict European jurisdiction. The role and location of each of our subprocessors are listed further down this page.

The text of the exchange is automatically deleted from our servers after 30 days - translation included. Appellia passes information on, it does not archive it: after that, all that remains with us is the summary, your contact details if you gave them, and any appointment. ⚠️ One exception, and we would rather write it down: if the professional chose to receive call reports by email, a copy of the text was sent to them. That copy is in their mailbox, not with us - so we can neither delete it nor retrieve it. It has to be asked of them, and we will help you do so.

The professional you called is the one who decides on this processing; Appellia acts on their behalf. You may ask to see the transcript of your call, have it corrected, have it deleted, or object to the processing. Write to contact@appellia.fr with your phone number and the approximate date of the call: we find the exchange, delete it from our servers, and pass your request on to the professional concerned for any copy they hold by email. We reply within one month. If our answer does not satisfy you, you may refer the matter to the CNIL.

When a professional ends their subscription, their account and all of their data are permanently deleted 30 days later: calls, summaries, contact records, appointments and documents. They are notified by email on the day the subscription ends, with the exact date and how to export their data beforehand. We keep no dormant accounts.

This section describes exactly which Google data Appellia accesses when you connect your calendar, what we do with it, and how we protect it. Connecting the calendar is optional: without it, the assistant simply takes a message instead of offering a time slot.

The permissions we request, and what they are used for

• Calendar read access (calendar.readonly): used only to know whether a time slot is free. We call Google’s free/busy function exclusively, which returns nothing but the start and end times of busy periods.
• Event management (calendar.events): used to add to your calendar the appointment booked by the assistant, and to remove it if you cancel from your Appellia account.

What we never read

The titles of your appointments, their descriptions, locations, attachments and attendee lists are never sent to us: we do not request them from Google. No content of an existing event is stored on our side. Of the appointment we create, we keep only what we wrote ourselves: its title, date, duration and identifier.

What the artificial intelligence sees

The voice assistant never receives your calendar. The computation happens on our servers, and the AI model receives only two things: whether the requested slot is free, and at most three free times to offer. They are used solely to handle the call in progress.

How this data is protected

• Encryption at rest: the authorisation granting access to your calendar is stored encrypted (AES-256-GCM) in a database hosted in the European Union.
• Encryption in transit: all exchanges with Google use HTTPS/TLS.
• Isolation: this authorisation never leaves our application server. It is sent neither to your browser, nor to our telephony gateway, nor to any subprocessor. Each customer account is isolated from the others.
• Least privilege: we use only the free/busy function, even though the granted permission would allow us to read more.
• Deletion: on disconnection we ask Google to revoke the authorisation, then erase it from our database. It is also erased when the account is deleted, at the latest 30 days afterwards.

Limited Use commitment (Google API Services)

Put the other way round: data from your Google Calendar is used ONLY to provide and improve the features you see in Appellia, namely knowing whether a time slot is free and writing into it the appointment booked during the call. It is used for no other purpose, internal or commercial.

And what we do not do with it: data from your Google Calendar, whether raw or derived, is never sold, never used for advertising, and never passed to anyone to train an artificial intelligence model. Our sole model provider is Google (Gemini API), used on a paid plan whose terms exclude the use of our data to train or improve its models. We use no intermediary, aggregator or model marketplace.

Taking back control at any time

You can disconnect your calendar from your Appellia account at any time, without contacting us. You can also remove access directly at Google, from the page listing the applications that have access to your account.

To provide this service, we work with third-party subprocessors. Each subprocessor only handles the data strictly required for their task, under a contract compliant with Article 28 of the GDPR.

The named list of our subprocessors, with their contact details and contractual commitments, is provided to our business customers on request and appended to their contract. We do not publish it here: it describes the technical architecture of the service, and publishing it would add nothing to your information while needlessly exposing our company.

Under the GDPR, you have the following rights over your data:

• Right of access and rectification
• Right to erasure (right to be forgotten)
• Right to data portability
• Right to object and to restrict processing
• Right to withdraw your consent at any time (when processing is based on consent)
• Right to lodge a complaint with the CNIL (cnil.fr) or any other competent authority

To exercise your rights: contact@appellia.fr. We commit to responding within a maximum of one month.

By default, this site only uses cookies strictly necessary for its operation (session, preferences). No advertising or profiling cookie is set without your explicit consent.

If an audience analytics feature requiring consent is enabled, a consent banner is displayed before any non-essential cookie is set.

This policy may be updated to reflect changes to the services and subprocessors used. The last update date is shown at the top of this page. Substantial changes will be notified by email to registered account holders.