Data, privacy &
Quebec Law 25.

We process data on behalf of our business clients.

In most cases Anova acts as a service provider processing data on behalf of our business clients. When a clinic, law firm, or studio uses an Anova agent to answer their phone, the caller information that flows through belongs to that business — they decide why it is collected and how it is used, and we process it to deliver the service they have asked for. We aim to handle that data carefully, transparently, and only for the purposes the engagement requires.

For our own website visitors and the people who contact us directly, we act as the business responsible for that limited data. This page describes both situations.

The data that passes through an agent.

A voice agent, by its nature, touches a small set of information — largely on behalf of the business client. We aim to keep this to what the service actually needs:

• Call audio and recordings — the voice of the call as the agent answers and responds.
• Transcripts — the text version of the conversation, used to book, route, and summarise.
• Caller contact details — name, phone number, email, and anything a caller chooses to share.
• Appointment information — the date, time, and service a caller books.
• Lead records — the qualified-lead and call summary that the business sees in its dashboard.

Call and lead data is pulled from our AI voice provider into the Anova client dashboard so the business can see analytics and reporting on its own calls.

The services we rely on, and why.

We use a short, deliberate list of trusted providers to run the service. Each is listed below with its purpose:

• Retell AI — our AI voice provider; processes call audio, recordings, and transcripts. Processing may occur in the United States.
• Cloudflare — runs our website and edge infrastructure.
• Google Workspace — our business email.
• Resend — transactional and business email delivery.
• Google Calendar — appointment booking and scheduling.
• CRM and spreadsheets (optional) — if a client connects a CRM such as HubSpot or Follow Up Boss, or Google Sheets, lead and call data also flows there at the client's direction.

A Data Processing Agreement (DPA) is available on request.

Some processing happens outside Quebec.

We want to be transparent rather than alarming: some of the data described above is processed outside Quebec and Canada. In particular, voice calls, recordings, and transcripts are processed by Retell AI, and that processing may occur in the United States. Other infrastructure providers may also process data outside the province. We choose established providers and we are happy to walk a client through the specifics for their deployment.

How we protect what we hold.

We aim to apply sensible, layered safeguards to the data we handle:

• Encrypted in transit — traffic to our site and dashboard is served over HTTPS/TLS.
• Access controls — access to data is limited to the people and systems that need it to run the service.
• We do not sell personal data — caller and lead information is used to deliver the service, not sold or rented to third parties.

No system can promise perfect security, but we aim to handle your data with the care it deserves and to keep our practices honest and current.

Access, correction, deletion, consent.

Under Quebec's Law 25 and PIPEDA, individuals have rights over their personal information, including the right to access the data held about them, to correct inaccurate data, to request deletion, and to withdraw consent. Because we usually process caller data on behalf of a business client, requests about a specific business's callers may be directed to that business, and we will help them respond.

To exercise a right or ask a question, email [email protected] and we will route your request to the right place.

Telling callers they are speaking with an AI.

Businesses using Anova should inform their callers that calls are answered by an AI agent and may be recorded and transcribed. We help configure a clear disclosure at the start of the call, and we encourage every client to keep their own notices and consent practices in line with their obligations.

How long data is kept.

Anova does not maintain its own separate database of call recordings or transcripts. That data is held by our AI voice provider (Retell) and is read into your dashboard through secure API access — Anova displays and analyzes it rather than warehousing its own copy. Data is retained for the duration of the engagement so the service can function and the business can use its own call history and analytics. It is deleted on request, or after the service is terminated, in line with the arrangement we have with the client. We do not keep personal data longer than the engagement reasonably requires.

This page describes our data practices and is not legal advice.

The essentials, at a glance.

Last updated 2026-06-25. Questions? [email protected].