Privacy policy
Last updated: 25 April 2026
This is a translation. In case of conflict, the Norwegian version applies.
This privacy policy describes how Agentia AS (org. no. 836 863 372) processes personal data. We comply with the Norwegian Personal Data Act (personopplysningsloven) and the General Data Protection Regulation (GDPR).
1. Controller
Agentia AS is the controller for personal data collected through our services and this website.
- Org. no.: 836 863 372
- Address: Lørenveien 68, 0585 Oslo
- Email for privacy questions: [email protected]
2. What personal data we process
2.1 When you contact us
- Name, company, email, phone number
- The content of your enquiry
2.2 When we deliver voice agent services
- Audio and transcripts of calls between the AI voice agent and your customers or end users
- Metadata: timestamp, phone numbers (caller and recipient), call duration, call outcome
- Structured data extracted from the call (for example booking details or type of enquiry) for use in your integrated systems
2.3 Information collected automatically on the website
- IP address, browser, operating system (anonymised in analytics)
- Pages you visit, clicks and time spent on the page
- See the cookie policy for details
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Delivering the voice agent service to the customer | Contract (GDPR Art. 6(1)(b)), and where relevant a data processing agreement with the customer |
| Handling enquiries from website visitors | Legitimate interest (Art. 6(1)(f)) |
| Improving the service and model performance (anonymised) | Legitimate interest (Art. 6(1)(f)) |
| Invoicing, accounting and statutory obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing Agentia's services | Consent (Art. 6(1)(a)) or legitimate interest |
4. How we process voice data (calls handled by the AI agent)
When Agentia's voice agent handles calls on behalf of a customer, we act as processor for the customer's end users. The processing is governed by a data processing agreement between Agentia and the customer.
- Audio and transcripts are stored in the EU (servers in the EU/EEA, no transfer outside)
- Processing follows the instructions of the customer, who is the controller
- End users are told at the start of the call that it is handled by an AI agent
- Data is deleted in line with the agreed retention period (usually 12 months, shorter on request)
5. Subcontractors (processors)
We use the following subcontractors to deliver the service:
| Provider | Function | Data residency |
|---|---|---|
| ElevenLabs | AI voice generation, call orchestration, transcription | EU (selected region) |
| Supabase | Database for call metadata and application data | EU |
| Cloudflare | Website hosting, DNS, security | Global edge: the service is delivered from the geographically nearest location |
| Make.com | Integration platform for connecting to the customer's CRM, calendar and similar systems | EU |
| HubSpot | CRM and marketing (only for Agentia's own contacts) | EU |
| Google Workspace | Email, documents, internal communication | EU/global |
| Twilio / Link Mobility | Sending SMS as part of the call flow | EU |
We enter into data processing agreements with all subcontractors that process personal data.
6. Retention periods
- Enquiries via the form: 24 months, or until the customer relationship ends
- Call data (processor role): in line with the data processing agreement, usually 12 months
- Accounting data: 5 years (required by the Norwegian Bookkeeping Act, bokføringsloven)
- Marketing data: until consent is withdrawn
7. Your rights
You have the right to:
- Access the information we hold about you
- Have inaccurate information corrected
- Have information deleted ("the right to be forgotten") as far as the law allows
- Restrict or object to the processing
- Receive your information in a structured format (data portability)
- Withdraw your consent (where the processing is based on consent)
Send requests to [email protected]. We reply within 30 days.
8. Right to complain
You can complain to Datatilsynet, the Norwegian Data Protection Authority, if you believe we are processing your personal data in breach of the rules. See datatilsynet.no.
9. Security
We take technical and organisational measures to protect personal data:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Access control based on the principle of least privilege
- Logging of access to personal data
- Subcontractors are chosen on the basis of documented security measures (SOC 2, ISO 27001 where relevant)
- We are working towards our own ISO 27001 certification
10. Changes
We may update this policy. Customers are notified of significant changes by email, and the changes are made visible on this website. The date of the last update is shown at the top.