This page explains how call recordings are handled on the AllForce platform. It is written for two audiences: the customer deploying an AI employee on AllForce, and the end user (person being called or calling in).
If you have been called by an AI employee powered by AllForce and you want to know what was recorded, exercise your rights, or request deletion — please start by contacting the business that called you. They are the legal controller of that recording. AllForce processes the recording on their behalf. Our contact details are at the bottom of this page if you cannot reach them.
1. What is recorded
When a customer enables recording on an AI employee, the following may be stored for each call:
- The audio of the call (both sides of the conversation);
- A written transcript generated by speech-to-text;
- Technical metadata (call timestamp, duration, phone numbers, call outcome).
The customer controls whether recording is enabled. If you see a call being recorded in the AllForce dashboard or receive a transcript, it is because the customer has chosen to enable that feature for that specific AI employee.
2. Who controls recordings
Under GDPR, the customer (the business operating the AI employee) is the data controller of call recordings and transcripts. They decide:
- Whether recording is enabled;
- Why the call is made or received;
- How long recordings are retained (within the limits the Service allows);
- Who within their organization may listen to or read the recording;
- Whether the recording is shared with anyone else.
AllForce is the data processor. We host, process, and transmit the recording solely on the customer's instructions, and only to deliver the Service.
3. Disclosure to end users — customer responsibility
Many jurisdictions require that participants be informed that a call is being recorded. Requirements vary significantly across countries and regions:
- Spain & most of the EU: One party consent is generally acceptable for recording your own conversations, but commercial recording usually requires at minimum a clear disclosure. For recordings used as a data-processing activity under GDPR, a lawful basis (consent, contract, or legitimate interest) and a transparency notice are required.
- "All-party consent" states in the United States (including California, Florida, Illinois, Massachusetts, Pennsylvania, and others): every participant must consent to being recorded.
- Other jurisdictions may have stricter rules around recording automated / AI-generated calls in particular.
The customer is responsible for:
- Determining what consent or disclosure is required in the jurisdiction of the end user;
- Configuring the AI employee to deliver that disclosure at the start of the call;
- Honoring any opt-out received during the call;
- Obtaining and documenting consent where the law requires it.
AllForce provides the technical tools to play a disclosure audio prompt or a scripted opening, but the content and triggering of that disclosure are the customer's responsibility.
4. Retention of recordings
Recordings are retained according to the customer's configuration, with a default of 90 days unless the customer has separately agreed a different retention period with us. After the retention period, recordings are automatically deleted from our active systems and purged from backups within a further reasonable period.
5. Security of recordings
- Recordings are transmitted over TLS-encrypted channels;
- Recordings at rest are encrypted using industry-standard encryption;
- Access to recordings is limited to the customer's authorized users and a small number of AllForce engineers on a strict need-to-know basis for support and abuse-investigation purposes;
- All access to recordings by AllForce personnel is logged.
6. If you are an end user
You have the following rights under GDPR in respect of a recording of a call in which you participated:
- Access the recording and transcript;
- Receive a copy in a portable format;
- Have the recording corrected if it contains inaccurate personal data;
- Have the recording erased, subject to legal retention obligations;
- Object to the processing;
- Lodge a complaint with your data protection authority (in Spain, the AEPD).
How to exercise these rights
- Step 1 — contact the business that called you. They are the controller and are best placed to identify the specific recording and act on your request.
- Step 2 — if you cannot reach them or they do not respond, contact AllForce at privacy@allforce.ai. We will forward your request to the controller and, if necessary, assist them in responding.
- Step 3 — complaint. You may contact the AEPD (aepd.es) or the supervisory authority in your country of residence.
7. AI disclosure
AllForce's AI employees are AI systems that generate speech and respond in real time. While they aim to sound natural, they are not human. If you ask directly whether you are speaking to a person or an AI, a well-configured AI employee will identify itself as an AI. Our Terms of Service prohibit customers from configuring their AI employees to deny being AI when directly asked.
We provide this information so that you can make an informed decision about whether to continue the conversation or hang up.
8. Contact
For questions about recordings on the AllForce platform: privacy@allforce.ai.