Privacy Policy
What personal data we collect, why, who else touches it, and what you can ask us to do about it.
Last updated: 26 August 2026
On this page
- Who we are
- Two different roles we play
- If you visit our website
- If you book a demo
- If you use the Kollup service
- Voice calls and why we don’t keep the audio
- Scores, and what they are not
- Who else processes data for us
- Sending data outside the EEA
- How long we keep things
- How we protect data
- Your rights
- If you’re a salesperson whose employer uses Kollup
- Children
- Changes to this policy
- Contact and complaints
1. Who we are
Kollup is operated by:
JELLYBYTE LTD
Registration No. HE 495017
Spyrou Kyprianou & Agias Fylaxeos 182,
Kofteros Business Centre, 2nd floor, Office 201,
3083 Limassol, Cyprus
Email: hello@kollup.com
We are a small company. Data protection questions reach a real person, and we answer them.
This policy explains how we handle personal data under the General Data Protection Regulation (EU) 2016/679 and the Cyprus Law 125(I)/2018. Cookies are covered separately in our Cookie Policy.
2. Two different roles we play
This distinction matters, because it changes who you should talk to about your data.
We are the controller for data about our website visitors, people who book demos, and the accounts of companies who buy Kollup. We decide why and how that data is used, and this policy is our explanation.
We are a processor for the practice-call data of our customers’ employees. When a company signs up and its salespeople run practice calls, that company decides what happens to those transcripts and reports. We only act on their instructions. If you are one of those salespeople, section 13 is for you.
3. If you visit our website
You can read every page of kollup.com without telling us who you are. We do not run advertising and we do not build profiles of visitors across other websites.
What we collect: our hosting provider keeps standard server logs — IP address, the page requested, the time, browser and device type. A small number of cookies keep the site secure and remember your cookie choices; these are listed in the Cookie Policy.
Analytics: we use Google Analytics 4, provided by Google Ireland Limited, to see how many people visit the site and which pages they read. It runs only if you accept the analytics category in our cookie banner — reject it, or close the banner, and the script is never loaded. Google Signals, advertising features and ads personalisation are switched off on our property, so there is no cross-site or cross-device profiling, and Google states that Analytics 4 does not log or store IP addresses. User-level analytics data is kept for 2 months, the shortest retention Google offers.
Why: to keep the site available, fast and protected against attacks, and to understand which parts of the site are useful.
Legal basis: our legitimate interest in operating and securing our own website (Article 6(1)(f)), and your consent for analytics and anything else that is not strictly necessary (Article 6(1)(a)). You can withdraw that consent at any time from the cookie preferences panel.
4. If you book a demo
Our booking page is provided by Calendly. When you book, you give us your name, email address, time zone, and your answers to two questions: what your team sells and how many reps are on it, and which call your reps struggle with most.
Why: to hold the meeting, to send you the invitation and reminders, and to prepare something useful rather than a generic pitch.
Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in following up on a meeting you asked for (Article 6(1)(f)).
What we don’t do: we do not add you to a marketing list because you booked a demo, we do not sell your details, and we do not pass them to anyone except the providers listed in section 8.
Booking data reaches us by email at hello@kollup.com and sits in our Calendly account. You can ask us to delete it at any time — see section 12.
5. If you use the Kollup service
Account data — we are the controller
- Account and company details: name, work email address, job title if you give one, password (stored only as a secure hash, never in readable form), role, and the company you belong to.
- Access tokens: invitation links and password reset links, which are single-use and expire.
- Correspondence: support emails and anything else you send us.
- Billing details: your company name, billing address, VAT number where you have one, and the invoices we issue. We bill by invoice — the Service never asks for, sees or stores card or bank details, and we do not use a payment processor.
Legal basis: performance of our contract with the customer company (Article 6(1)(b)), our legitimate interest in running and improving the service (Article 6(1)(f)), and legal obligations such as keeping accounting records (Article 6(1)(c)).
Practice-call data — we are the processor
When a rep runs a practice call, the service creates:
- the scenario the manager wrote — product information and the client persona to practise against;
- a transcript of the conversation, as text;
- a coaching report — an overall score, four sub-scores, strengths, and what to improve.
If the company also uses Live Assist on real calls, or builds a company knowledge base, the service additionally holds:
- the knowledge base a manager writes — what the company sells, approved objection responses, facts agents need mid-call and pitch style rules. It can be drafted automatically from a public web page the manager supplies;
- a transcript of the live conversation, including the other participants’ speech;
- the coaching tips shown on screen during that call, and the utterance that prompted each one;
- an optional customer label — a name or reference the agent types to identify the call.
This data belongs to the customer company, which decides who can see it and how long it is kept. We process it only to deliver the service.
Every company’s data is isolated. Every record in our database is tied to a company, and every query is restricted to that company. One customer cannot see another customer’s scenarios, calls or reports. This is enforced in application code on every query, not by interface controls, and is reviewed whenever data access code changes.
Please don’t put real customer data into scenarios. Practice scenarios describe an imaginary client. There is no reason to paste a real prospect’s name, contact details or commercial terms into one, and we ask managers not to.
6. Voice calls and why we don’t keep the audio
This is the question we get asked most, so here is the honest, technical answer.
When a rep speaks during a practice call or a Live Assist session, the audio streams from their browser to our speech provider, which converts it to text in near real time. We store the text. Kollup does not store call recordings. Live Assist audio is discarded as it is transcribed and never written to disk on our systems; for voice practice calls the audio is handled in transit by our real-time voice provider and only the transcript comes back to us. There is no recording in your account to play back, because we do not keep one.
The transcript is then used to generate the coaching report, and both are saved against that company’s account.
Live Assist has two capture modes, and the second one matters. In microphone mode it listens through a single microphone and uses AI to work out who is speaking. In online-meeting mode it captures the rep’s microphone together with the audio of the browser tab the meeting is running in — which means the speech of everyone else on that call is transcribed too.
It is the rep’s responsibility, and their employer’s, to comply with any local law requiring the other participants to be told that a conversation is being transcribed, or to consent to it. We provide the tool; we cannot give that notice or obtain that consent on your behalf, and we do not monitor whether it has been done.
7. Scores, and what they are not
Kollup scores practice calls — and, where Live Assist is used, real calls — from 1 to 10 across four areas, and writes a short assessment. These scores are produced by an AI model reading the transcript.
They are a coaching aid, not a verdict. We do not use them to make any decision about any individual. If an employer chooses to use them in a performance review, that is the employer’s decision and the employer’s responsibility — including telling their staff that it happens, and letting a human being review the outcome. We would encourage any customer to treat a practice score as a conversation starter rather than a measurement.
We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.
8. Who else processes data for us
We use a small number of specialist providers to run this website and to deliver the Kollup service. Every one of them is bound by a written data processing agreement, may only act on our instructions, and may not use your data for their own purposes.
We do not sell personal data, and we do not share it with anyone for their own marketing.
Our website and demo booking
If you are simply visiting kollup.com or booking a demo, these are the only companies involved, and we name them because your data goes to them directly:
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Hostinger | Hosts this website | Server logs, anything submitted through the site | EU |
| Calendly | Demo booking | Name, email, time zone, your answers to the booking questions | USA |
| Google Ireland Limited | Google Analytics 4 — website statistics, loaded only with your consent | Pages viewed, approximate location, device and browser type. No advertising features, no IP address stored | Ireland, with transfers to the USA |
The Kollup application
The service itself is built on specialist cloud infrastructure, including GPU-backed providers for speech and language processing. The categories of sub-processor we rely on are:
| Category of sub-processor | What it processes | Where |
|---|---|---|
| Cloud application hosting and database | All service data — accounts, scenarios, transcripts and reports | Outside the EEA |
| Large language model provider | Scenario text and call transcripts, to play the AI client and generate coaching reports | Outside the EEA |
| Speech-to-text provider | Call audio, in transit only, converted to text and discarded | Outside the EEA |
| Real-time voice infrastructure | Call audio and transcripts, in transit during a voice practice call | Outside the EEA |
| Speech synthesis provider | The text the AI client speaks, converted to a voice. Engaged through our voice infrastructure provider | Outside the EEA |
| Transactional email | Name and work email address, to deliver invitations, password reset links and service notifications | Outside the EEA |
We do not publish the names of these providers, but we will give them to you. Keeping the list off a public page is a commercial decision, and a common one — it is not a way of avoiding scrutiny.
Customers on any plan, free tier included, can request the complete named list in writing at hello@kollup.com, subject to the confidentiality terms of our agreement. Organisations evaluating Kollup can ask for it before signing, and we will normally provide it under a non-disclosure agreement. You get what each provider processes, where it is located and the transfer safeguards that apply — everything you need for your own compliance records.
That list covers who processes personal data and under what safeguard. It does not extend to how the Service is built — our architecture, how data is routed between providers, model names, versions or prompts, our scoring logic, or our commercial terms. See clause 8 of the Data Processing Agreement for the full conditions.
We will also notify customers in advance of any change to that list, so you have a genuine opportunity to object before it takes effect, as Article 28(2) GDPR requires.
9. Sending data outside the EEA
Some of the providers above are based in the United States, and Google Ireland Limited transfers analytics data to Google LLC there. That means personal data is transferred outside the European Economic Area.
Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses under Article 46(2)(c) GDPR, together with any additional technical measures the provider applies — such as encryption in transit and at rest. For Google Analytics, Google relies on the adequacy decision for the EU–US Data Privacy Framework where it applies, and on the Standard Contractual Clauses where it does not.
If you need the details — which provider, which country, which safeguard — ask us at hello@kollup.com and we will set it out in writing.
10. How long we keep things
| Data | Kept for |
|---|---|
| Website server logs | As long as needed for security and troubleshooting, then deleted |
| Google Analytics data | User-level data kept for 2 months, then only aggregated totals remain. Nothing is collected at all unless you accepted analytics cookies |
| Demo booking details and related emails | Up to 24 months from our last contact, unless you ask us to delete them sooner |
| Account data | For as long as the account is open, then deleted within 90 days of closure |
| Scenarios and company knowledge base | For as long as the customer company keeps them |
| Coaching reports and transcripts | Visible for a period set by the company’s plan, shown on its Billing page. After that they are hidden, and permanently deleted — with the transcript and the record of any live tips — once a further 90-day grace period passes. Moving to a longer plan restores reports not yet deleted |
| Call records after a report is deleted | Date, duration, mode and the user it belonged to, with no conversation content, kept so that we can meter minutes and invoice correctly |
| A user removed from a team | Their account and their reports are deleted immediately, and we cannot reverse it |
| Call audio | Not stored by us at any point |
| Invoices and accounting records | As required by Cyprus tax law |
11. How we protect data
- Everything travels over encrypted connections (HTTPS/TLS).
- Passwords are stored as salted hashes, never in a form anyone can read — including us.
- Sessions use secure, HTTP-only cookies, backed by server-side records that can be revoked.
- There is no self-service password reset. Reset links are issued inside the account by an administrator or manager, are single-use and expire.
- Every database query is scoped to a single company, so data cannot leak between customers.
- Access to production systems is limited to those who need it.
- Raw call audio is never written to disk on our systems.
- A coaching report leaves the account only if someone in that account creates a share link. Links use an unguessable token, are kept out of search engine indexes, expire with the company’s report retention window, and can be revoked at any time.
- Our own platform administration view shows operational and billing information only — company, plan, minutes used, call dates and durations. It does not display transcripts, reports or knowledge base content.
No system is perfectly secure, and we won’t pretend otherwise. If a breach affects your personal data and poses a risk to you, we will notify the Commissioner within 72 hours where required, and tell you directly where the risk is high.
12. Your rights
Under the GDPR you can ask us to:
- Access — give you a copy of the personal data we hold about you.
- Rectify — correct anything inaccurate or incomplete.
- Erase — delete your data, where we have no overriding reason to keep it.
- Restrict — pause what we do with it while a question is resolved.
- Port — provide it in a machine-readable format, or send it to another provider.
- Object — stop processing based on legitimate interests, including any direct marketing, which we will always stop on request.
- Withdraw consent — at any time, where we relied on consent. This does not affect what was done beforehand.
Email hello@kollup.com and we will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we don’t hand your data to someone else.
13. If you’re a salesperson whose employer uses Kollup
Your practice calls, transcripts and scores belong to your employer, not to us. We hold them on their behalf and cannot decide what happens to them.
So if you want to see your data, correct it, or have it deleted, ask your employer first — they control it, and they can act immediately. If you contact us instead, we will pass your request to them and support them in answering it, but we can’t act on it independently.
Two things worth knowing. If your employer uses Live Assist on real calls, the conversation — including what the customer says — is transcribed while it happens, and the tips shown on your screen are recorded alongside it. And your reports do not stay visible forever: how long they last depends on your employer’s plan, after which they are hidden and then permanently deleted.
Your employer should also have told you that they are using Kollup and what they do with the results. If they haven’t, that’s a conversation worth having with them.
14. Children
Kollup is a business tool sold to companies. It is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.
15. Changes to this policy
We update this page when what we do changes — a new sub-processor, a new feature, a different retention period. The date at the top shows the current version. If a change materially affects you, we will tell account holders by email rather than quietly editing the page.
16. Contact and complaints
Anything at all: hello@kollup.com. Our Data Processing Agreement is published and applies to every customer automatically — no signature needed — and we will send a countersigned copy, or sign yours where its terms are compatible, on request.
If we haven’t resolved something to your satisfaction, you can complain to:
Office of the Commissioner for Personal Data Protection
Iasonos 1, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy
If you live in another EU or EEA country, you may complain to your own national authority instead.