Privacy policy

This policy covers the company that runs telkit, telkit.no and the dashboard.

You can reach us through the contact page.

Our role depends on the data. The role decides who you should contact.

Processor

For the content our customers send and receive through telkit: messages, calls, recordings, transcripts, letters and contact lists. The customer decides the purpose, and we process the data on the customer's behalf under Article 28 of the General Data Protection Regulation (GDPR).

Controller

For data about our customers and their users: sign-in, the company, verification, payment and logs. Here we decide the purpose ourselves.

If you received an SMS, an email, a letter or a call from a business that uses telkit, that business is the controller. Contact the business about your data. We cannot answer on its behalf.

As controller we process the following data:

Sign-in and user

Name, email address and mobile number, the companies you are a member of and your role in each. Sign-in is handled by Clerk. The owner's mobile number and email address receive notices when the balance runs low.

The company

Organisation number, name and address. When a company registers, we fetch its name and address from Enhetsregisteret at Brønnøysundregistrene. We also store when the terms were accepted.

Verification

Before a company can send letters, make calls or get its own number, we verify it. We then store the certificate of registration (firmaattest), the legal name and address, the name, role and email address of the person who can sign, the beneficial owners and their shares, what the services will be used for, and when the rules of use and the emergency number statement were accepted. When BankID is used in the verification, we store the person's name, date of birth and role in Enhetsregisteret. We do not store the national identity number, only a checksum made with a secret key.

Payment

Card payments go through Stripe. We store a reference to the card, the card brand, the last four digits and the expiry date, who agreed that the card may be charged, and every top-up, fee and refund. We never hold the card number.

Invitations

The email address of the person invited, and the role. An invitation is valid for 7 days. We keep only a checksum of the link, not the link itself.

API keys

The key's name, who created it and when it was last used. The key itself is stored only as a checksum.

Logs

Messages, calls and letters are recorded with the API key or person that sent them. When a telkit employee opens a customer's data, this is logged with a reason and a time.

Each kind of processing has a basis in Article 6(1) of the GDPR:

• Opening and running the account, delivering the services and taking payment: the contract with the company (point b) where you are a party to it, otherwise our legitimate interest in delivering what the company ordered (point f).
• Verifying companies before letters, telephony and their own numbers: our legitimate interest in knowing who sends, and in preventing misuse of the service (point f).
• Keeping accounts: a legal obligation (point c) under the Norwegian Bookkeeping Act (bokføringsloven).
• Security, troubleshooting and detecting misuse: our legitimate interest in a safe service (point f).
• Low-balance notices and other messages about the account: the contract with the company (point b) or our legitimate interest in keeping the customer informed (point f).

As processor we handle what our customers send and receive through telkit:

• SMS: sender, recipient number, text and delivery status, and incoming replies.
• Email: sender, recipients, subject and content, and incoming email.
• Letters: the recipient's name and address, and the PDF sent digitally through Digipost or on paper.
• Calls: the numbers, times, duration and any text read aloud.
• Recordings and transcripts, when the customer asks for them on a call, and audio files the customer sends in for transcription.
• Contacts: name, phone number, email address, postal address and notes.
• Recipients who have opted out of SMS from a sender.
• Events sent to the customer's own system (webhooks).

The customer decides what the data is used for and must have a legal basis for it. We process it to deliver the service the customer ordered.

• The event log the customer's system reads events from keeps each event for 30 days.
• Customers can delete contacts, templates, webhooks and transcription jobs themselves. When a transcription job is deleted, its text is removed at once and its audio file afterwards.
• Messages, calls, recordings, call transcripts and letters are not deleted automatically. The customer can ask us to delete them.
• Data about users, the company and its verification is kept for as long as the company is a customer.
• Accounting records are kept for as long as section 13 of the Bookkeeping Act requires: five years after the end of the financial year for entries and their documentation, and three years and six months for agreements and correspondence.

Some tasks are carried out by suppliers. They process data on our behalf:

• Sveve sends SMS and receives replies.
• Resend sends and receives email.
• Digipost delivers letters digitally or on paper.
• DIDWW provides Norwegian phone numbers and connects calls to the telephone network.
• LiveKit carries the audio of calls and records them.
• ElevenLabs turns text into speech and speech into text.
• Stripe takes card payments.
• Clerk handles sign-in.
• Anthropic is the language model behind summaries, AI agents, spoken menu choices and voicemail detection, when the language model is switched on.
• Cloudflare checks that the demos on the start page are used by people (Turnstile).

The full list, with what each supplier does and where it processes data, is on the subprocessors page. We look up organisation numbers, names and addresses in Enhetsregisteret, which is a public register.

ElevenLabs processes text read aloud and audio transcribed into text in the United States. Resend sends email from its EU region in Ireland, but stores account data such as logs and metadata in the United States. Anthropic may process text from calls in the United States, Europe, Asia and Australia when the language model is switched on. Processing locations are not documented for every supplier; see the subprocessors page for each supplier's status.

Such a transfer needs a basis under Chapter V of the GDPR, for example an adequacy decision (Article 45) or standard data protection clauses (Article 46). You can ask us which basis applies to each supplier.

• Sign-in uses cookies from Clerk, such as __session and __client_uat. They are needed to keep you signed in.
• The dashboard remembers in your browser which company and which profile you chose last.
• The dashboard keeps actions that have not finished sending in your browser, so they are not sent twice if you reload the page.

We use no analytics or advertising tools on telkit.no.

Under Chapter III of the GDPR you can ask for:

• access to the data we hold about you (Article 15)
• correction of data that is wrong (Article 16)
• erasure (Article 17), where we have no duty or reason to keep it
• restriction of processing (Article 18)
• your data in a machine-readable format (Article 20)
• objection to processing we base on legitimate interest (Article 21)

We reply within one month. For a large request the deadline can be extended by two months, and we tell you so within the first month. It costs nothing.

If the request is about content a business sent you through telkit, it should go to that business. We help the business to answer.

• API keys, invitation links and national identity numbers from BankID are stored only as checksums.
• Files such as recordings, audio files, certificates of registration and letters are stored under a key. A link to a file is created only when someone opens it, and it expires soon after.
• Events sent to the customer's system are signed, so the customer can check that they come from us.
• A telkit employee who opens a customer's data must give a reason. Access lasts a limited time and is logged.

If we discover a security breach affecting data we process for a customer, we notify the customer without undue delay, as Article 33 of the GDPR requires.

If you believe we process your data in breach of the rules, you can complain to Datatilsynet, the Norwegian data protection authority (Article 77 of the GDPR). Datatilsynet recommends contacting us first, as that often settles the matter.

We update this policy when our processing changes. The date at the top shows when it last changed.