ReadyCall is a cloud contact-center platform: call center, CRM and ticketing, WhatsApp, live chat and an AI voice agent. It is operated by ReadyCall (Commercial Registration, Unified National Number: 7053474289; VAT number: 314584692100003).
This policy covers the website readycall.net and the platform app.readycall.net.
02Our role
Companies that subscribe to ReadyCall (our customers) are the controllers of their own customers’ and contacts’ data. ReadyCall is a processor: it processes that data on their behalf, under their instructions, only to provide the service.
For our customers’ account data and for website visitors’ data, ReadyCall is the controller.
03Data we collect
Account data: user name, email, mobile number, company name, role and permissions. Passwords are stored as a one-way hash and never kept in readable form.
Customer contacts in the CRM: names, numbers, emails, notes, tickets and any fields the customer adds.
Calls: caller and called numbers, time, duration, status, the agent or queue that handled the call, and the call recording when recording is enabled. Recording starts when the call is answered.
WhatsApp and live-chat messages: message text, attachments, and the sender’s name and number or the visitor’s chat details.
AI voice agent (when enabled): the call audio and its transcript, so the agent can understand and answer the caller.
Usage logs: sign-in records, the in-platform audit log, IP address, browser type and technical server logs.
Website visitors: what you type in the contact form (name, company, email, mobile, team size, message). The site also stores your first-visit source (referring site and campaign tags, if any) in your browser and sends it with the form if you submit it.
04Why we use data
We use data for one main purpose: running the contact-center service for our customers. This includes:
Routing calls and messages to agents and queues, and keeping them in the customer record.
Reports and dashboards for our customers.
Technical support and troubleshooting.
Billing and subscription management.
Protecting the platform: detecting abuse and unauthorized sign-in attempts.
Answering contact requests sent from the website.
We do not sell personal data, and we do not use our customers’ end-customer data for anything other than providing the service to them.
05Where data is stored and how we protect it
Our customers’ data is hosted in data centers inside the Kingdom of Saudi Arabia.
Encryption in transit: the website and platform run over HTTPS with TLS 1.2 and TLS 1.3 only; browser calls are encrypted with DTLS-SRTP.
Passwords: stored with bcrypt hashing.
Integration tokens (such as WhatsApp tokens): encrypted with AES-256-GCM.
Data separation: each company’s data is isolated, and users of one company cannot reach another company’s data. Inside a company, access follows the user’s role.
Backups: a weekly backup is encrypted on the server itself before upload (restic, AES-256) and then stored in Google Drive. Google does not hold the decryption key. We keep the last 8 weekly and 6 monthly backups and test restoring from them regularly.
06Retention
Call recordings are kept according to the customer’s plan:
Starter plan: 30 days.
Growth plan: 90 days.
Business and Enterprise plans: 365 days.
The data stays available to the customer for the period of its plan; we then keep it for up to 90 additional days for support and to restore it on request, after which it is permanently deleted, except what the law or an investigation requires us to keep.
Other account, CRM and message data is kept for the life of the subscription. After termination, the customer may request an export of its data within 90 days, and the data is deleted within 180 days, except what the law requires us to keep.
Deleted data may remain in the encrypted backups (8 weekly and 6 monthly) for up to 6 months, after which it expires automatically with the backup rotation.
Website contact-form data is kept for 12 months.
07Third parties
We share data only with the service providers needed to run the platform, and only as much as each one needs:
Hosting provider: inside the Kingdom, hosting the servers the platform runs on.
Meta (WhatsApp Business — WhatsApp Cloud API): sending and receiving WhatsApp messages for companies that enable the channel. Messages are also subject to Meta’s policies.
Google (Google Drive): storage of the encrypted backups.
The telephony provider (SIP trunk): phone calls and their numbers pass through it.
OpenAI: when the AI voice agent or call transcription is enabled, call audio and text are sent to OpenAI for processing (its servers are in the United States).
Anthropic: when the in-platform AI assistant is used, the questions and the data needed to answer them are sent to it.
Spacemail: sending email from the platform, such as notifications and password resets.
We may disclose data to authorities where the law requires it.
08Your rights under the Saudi PDPL
The Saudi Personal Data Protection Law gives you the following rights:
To be informed: to know how and why your data is collected, as set out in this policy.
Access: to request access to your data or a copy of it.
Correction: to request that your data be corrected, completed or updated.
Deletion: to request deletion of your data when it is no longer needed, subject to what the law requires us to keep.
If your data is held by a company that uses ReadyCall (for example because you called or messaged it), that company is the controller; we forward your request to it and help it carry the request out.
You may also file a complaint with the competent authority that supervises the application of the Personal Data Protection Law.
We may update this policy when the service or the law changes, and we update the “Last updated” date at the top of the page. For material changes we inform our customers by email or in the platform.