Privacy Policy

1. Who we are and what this policy covers

In this policy, “Laracalls”, “we” and “our” mean [COMPANY LEGAL NAME] ([ADDRESS]). Laracalls (formerly Dora AI) develops and operates Lara, a Turkish-speaking AI sales assistant that makes outbound phone calls on behalf of businesses. Our offices are in London and California.

We process personal data in two different capacities:

• As data controller: data about visitors to our website, people who contact us or request a demo, and employees of our customer businesses who use our dashboard. We decide for what purposes and how this data is processed.
• As data processor: data processed in the calls Lara makes on behalf of a customer business. The data controller for this data is the business that has the calls made (Article 3 of Law No. 6698 on the Protection of Personal Data (“KVKK”)). We process this data under our contract with that business and in accordance with its instructions. Details are in Section 3.

2. What data we process and why

We process the data below on the legal grounds listed in Article 5 of KVKK: the formation or performance of a contract, compliance with our legal obligations, our legitimate interests provided they do not harm your fundamental rights and freedoms, and, where required, your explicit consent.

2.1 Website visitors

• What: IP address, browser and device information, pages visited, time of visit, links you click within the site, and sample call recordings you play.
• Why: to run the site and keep it secure, to prevent misuse, and to understand how the site is used so we can improve it.
• Legal basis: legitimate interest; explicit consent for non-essential cookies. Cookie details are in the cookie policy.

2.2 People who request a demo or contact us

• What: full name, work email, phone number, company name and your job title, the message you send us, and our notes from our conversations with you.
• Why: to respond to your request, schedule a demo, prepare a suitable offer for you, and maintain the business relationship afterwards.
• Legal basis: steps taken prior to entering into a contract, and legitimate interest. Before sending you marketing messages, we obtain your separate consent where the law requires it.

2.3 Dashboard users at our customer businesses

• What: full name, work email, role and permission information, dashboard login records, support requests; company and payment details for invoicing.
• Why: to open and manage your account, provide secure access to the dashboard, provide support, send service-related notifications, and meet invoicing and accounting obligations.
• Legal basis: performance of a contract, legal obligation and legitimate interest.

3. People called on behalf of our customers

Lara calls our customer businesses' customers and leads on their behalf: she follows up on the inquiry, answers questions, talks with the person about an appointment or a sale, writes the call summary into the business's customer relationship management (CRM) system, and makes a confirmation call before the appointment.

For these calls, the data controller is the business that has the calls made. The business decides who is called, for what purpose and at what times; it is also responsible for informing the people called and obtaining any required permissions. Laracalls processes this data as a data processor, under the service agreement and data processing terms we have with the business.

Data processed in these calls

• Information the business gives us: full name, phone number, inquiry details (e.g. the product or service the person is interested in), notes from previous calls.
• The call itself: audio recording, written transcript of the conversation, call duration and outcome.
• Information resulting from the call: call summary, appointment date and time, callback request.
• Information the person called shares about someone else during the call (e.g. a parent saying what grade their child is in).

What we use this data for

Only as instructed by the business: to make the call, pass its outcome to the business, and display it in the business's dashboard. Because Laracalls is responsible for setup and call quality, our team may, on the business's behalf, review call recordings and transcripts to check that Lara is working correctly.

Whether call data will be used to improve the service in general: [USE OF CALL DATA FOR SERVICE IMPROVEMENT — TO BE SETTLED IN THE CONTRACT]

Who to contact to exercise your rights

The fastest route is to contact the business that called you; at the start of the call, you are told which business you are being called on behalf of. If your request reaches us, we forward it to the relevant business without delay and help the business respond.

4. Who we share data with

We do not sell personal data. We share data only with the recipients below, and only to the extent necessary:

• Our service providers: hosting and data storage, telephony infrastructure, speech recognition (converting speech to text), language model, speech synthesis (converting text to speech), email and authentication services. These providers process data on our behalf and on our instructions. Current list: [SUB-PROCESSOR LIST]
• The customer business's own systems: call summaries and appointment details are written into the business's CRM or a similar system on its instructions.
• Our advisers: those who provide us with professional services such as legal, accounting and audit services.
• Competent authorities: public authorities and bodies and judicial authorities, where required by law or upon a duly made request from a competent authority.
• Corporate transactions: in a transaction such as a merger, acquisition or investment, the counterparty, to the extent necessary to evaluate the transaction and subject to a confidentiality obligation.

5. International transfers

Our offices are in the United Kingdom and the United States, and some of the service providers we use are located outside Turkey. For this reason, personal data may be transferred outside Turkey and stored abroad. Countries to which data is transferred: [DESTINATION COUNTRIES]

We make these transfers with the appropriate safeguards provided for in Article 9 of KVKK and, for individuals in the United Kingdom, in the UK GDPR. For information about the safeguards we use, you can write to us.

6. Retention periods

We keep personal data for as long as is necessary for the purpose for which it is processed and for the period required by law. When that period ends, we delete, destroy or anonymize the data.

• Website visit logs: [RETENTION PERIOD — SITE LOGS]
• Demo and contact requests: [RETENTION PERIOD — DEMO REQUESTS]
• Dashboard user and billing information: for the term of the contract and for [RETENTION PERIOD — CUSTOMER ACCOUNTS] thereafter, without prejudice to the retention periods required by tax and commercial law.
• Recordings, transcripts and summaries of calls made on behalf of customers: for the period set by the customer business, up to a maximum of [RETENTION PERIOD — CALL RECORDINGS]; when the contract ends, they are deleted or returned to the business, as the business instructs.

7. Security

We take appropriate technical and organizational measures to prevent unlawful processing of, and unlawful access to, personal data. These include:

• access to the dashboard and call recordings is limited to authorized users,
• data is encrypted in transit,
• our team accesses data only to the extent their work requires,
• data is backed up regularly.

No system is completely secure. If we become aware of a security breach affecting your data, we will notify the individuals concerned, our customer and the competent authorities as required by law.

8. Your rights and how to exercise them

Under Article 11 of KVKK, you can apply to us regarding your personal data and request to:

• learn whether your data is processed and, if so, request information about it,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Turkey or abroad to whom it has been transferred,
• request its correction if it has been processed incompletely or inaccurately, its deletion or destruction if the conditions for processing no longer apply, and notification of these actions to the third parties to whom the data was transferred,
• object to an outcome that is unfavorable to you and results from the analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

You can submit your request in writing to [EMAIL] or to [ADDRESS]. We respond to requests within thirty days at the latest (KVKK Article 13). If you find our response unsatisfactory, you can file a complaint with the Turkish Personal Data Protection Board (KVKK Article 14). Application methods and other details are set out in the KVKK privacy notice.

If you are in the United Kingdom, you may have similar rights under the UK GDPR and can lodge a complaint with the UK Information Commissioner's Office (ICO). If you are in another country, that country's law may give you additional rights; you can send your request to the same address.

For requests about calls Lara made on behalf of a business, see Section 3.

9. Cookies

We use cookies and similar technologies on our website. Our cookie policy explains which cookies we use, for what purposes, and how you can change your preferences.

10. Children

Our website and service are intended for businesses; we do not knowingly collect data from anyone under 18. If information about a child is shared in a call made on behalf of one of our customers (e.g. a parent mentioning their child's grade), that information is processed under the rules in Section 3 and only on the customer's instructions.

11. Changes to this policy

We may update this policy as our service or the law changes. The current version is always on this page; the date at the top of the page shows the latest change. If there is a significant change, we will also notify our customers separately.

12. Contact

For any question about this policy or your personal data: