Privacy Policy

Last updated: 2026-09-25

Data Processing Agreement · Sub-processors

This Privacy Policy explains how Totem Studio International Technologies, S.L. (“Totem Studio”, “Totem”, “we” or “us”) processes personal data when you visit our websites, use our platform (AI voice and chat assistants, CRM, automations, dashboard and integrations), purchase our services or communicate with us. It also explains when we act as a controller and when we act as a processor on behalf of our customers, and how you can exercise your rights.

Liability for Content

We have made every effort to ensure the accuracy and completeness of the content on our pages. However, we cannot guarantee the correctness, completeness, or current relevance of the content. As a service provider, our responsibility for our own content on these pages is in accordance with general laws. As a service provider, we are not required to monitor third-party information that is transmitted or stored, nor are we required to investigate circumstances that suggest illegal activities. The responsibility to remove or block the use of information under general laws remains intact. Liability in this regard can only be assumed from the moment we become aware of a specific legal violation. Upon becoming aware of such violations, we will promptly remove the offending content.

Liability for Links

Our website contains links to external websites owned by third parties, and we have no control over the content of these sites. Consequently, we cannot be held responsible for the content of these third-party sites. The individual provider or operator of the linked pages is responsible for their content. At the time of linking, the linked pages were examined for potential legal violations, and no unlawful content was identified. Continuously monitoring the content of linked pages without concrete evidence of legal violations is unreasonable. If we become aware of any legal violations, we will remove the associated links immediately.

Copyright

The content and works on our website are subject to European and international copyright law. The reproduction, modification, distribution, and any form of exploitation beyond the scope of copyright law require written consent from the respective author or creator. Downloads and copies of this website are permitted for private, non-commercial use only. In cases where the content on this site was not created by the operator, third-party copyrights have been respected. Specifically, third-party content is identified as such. If you become aware of a copyright infringement, please notify us accordingly. Upon becoming aware of legal violations, we will immediately remove the offending content.

Company Information

• Registration: Totem Studio International Technologies, S.L. — NIF B45528395 — Ronda de Buenavista 24, bloque 9, 4.º C, 45005 Toledo, Spain — Registro Mercantil de Toledo, tomo 1.171, sección 8.ª, hoja TO-19.191
• Contact: +34 900 433 533 · hello@totemstudio.ai · totemstudio.ai
• Privacy contact: hello@totemstudio.ai

Interpretation and Definitions

Interpretation

Capitalized terms have the meanings set out below. The definitions apply whether terms appear in singular or plural.

Definitions

For the purposes of this Privacy Policy:

• Personal Data: Any information related to an identified or identifiable natural person.
• Data Subject: The individual to whom personal data relates.
• Processing: Any operation performed on personal data, whether automated or not, including collection, storage, use, disclosure, and deletion.
• Controller: The entity that determines the purposes and means of processing personal data.
• Processor: The entity that processes personal data on behalf of the controller.
• Consent: Any freely given, specific, informed, and unambiguous indication of the data subject's wishes.
• Services: Our websites, apps, dashboard, AI voice and chat assistants, CRM, automations (including n8n workflows) and related support.

Controller and processor

The controller is Totem Studio International Technologies, S.L., tax ID (NIF) B45528395, registered office at Ronda de Buenavista 24, bloque 9, 4.º C, 45005 Toledo, Spain, registered in the Toledo Commercial Registry, volume 1.171, section 8, sheet TO-19.191. Privacy contact: hello＠totemstudio.ai. We have not appointed a Data Protection Officer; all privacy enquiries are handled at that address. Totem is the controller for data about visitors to its websites, account users, billing, support and its own sales and marketing contacts. When a business customer uses the platform to serve its own clients, callers or leads, that business is the controller and Totem acts as its processor under the Data Processing Agreement published at /legal/data-processing-agreement. If your data is processed in this way, please contact that business to exercise your rights; if we receive your request, we will forward it to them.

Categories of Personal Data We Process

Website & Analytics

Device and usage data (IP address, date and time, pages viewed, referring page, approximate location, device, operating system and browser), events and cookie identifiers. Analytics and advertising cookies are only activated with your consent.

Interactions with voice and chat assistants

Call and conversation metadata (caller number or identifier, date, time, duration and outcome), audio recordings and transcripts (on by default on supported voice channels), messages, summaries, action results (for example, an appointment booked or a reminder sent), contact details provided during the conversation and the context needed to complete the task. Totem processes this data as a processor on behalf of the business customer.

Communications

Emails, SMS, WhatsApp messages and other messages exchanged with us or through the platform, together with their delivery metadata.

Customer Account & Billing

Users’ name, email address, phone number, authentication identifiers, roles and permissions; company details, subscription, invoices, payment history and records of contract acceptance. Card data is processed by Stripe; Totem does not store full card numbers. We obtain this data from you or from the person in your organisation who invites you to the account.

Integrations & Automations

Data exchanged with the services the customer connects (calendar, email, CRM, WhatsApp, Instagram, Messenger and telephony) and with our n8n automation engine, to the extent needed to provide the service. Tokens and credentials of connected accounts are stored encrypted.

Special Categories

Totem does not request special categories of data (such as health data) or data relating to criminal offences for its own purposes. If a business customer uses the platform in a field where such data may arise, that business, as controller, must have a valid exception under Article 9 GDPR and appropriate safeguards, and Totem processes the data only on its instructions. Sensitive information that a person volunteers during a conversation is processed like the rest of that conversation, under the business customer’s instructions.

Collection and Deletion of Data

Collection of General Data and Information

Each time you access our websites or the dashboard, our servers and, if you accept them, our analytics tools record general technical data:

• Browser type and version
• Operating system
• Referrer URL
• Pages accessed
• Date and time of access
• IP address
• Internet service provider
• Other similar data used to ensure security and integrity

This data is used for:

• Delivering and optimizing content
• Ensuring performance and availability
• Detecting and preventing abuse and fraud
• Aggregated statistics to improve the Service

Technical logs are stored separately from account data, and security logs are kept for a maximum of 12 months.

Deletion of data

We delete personal data once it is no longer needed for the purpose for which it was collected, in line with the periods set out under “Data retention”. Where the law requires us to keep it, as with invoices, we keep it blocked with restricted access for the statutory period and then delete it. Backups rotate and expire within a maximum of 98 days.

Purposes and Legal Bases (GDPR)

Creating and managing your account, providing the platform you have subscribed to (voice and chat assistants, CRM, automations and integrations) and supporting you.

• Art. 6(1)(b) GDPR – Performance of a contract
• Art. 6(1)(f) GDPR – Legitimate interests (security and service improvement)

For data about our customers’ own clients, callers and leads, the legal basis is determined by the business customer as controller; Totem processes that data on its instructions under the Data Processing Agreement.

Billing, payment collection, accounting and tax compliance.

• Art. 6(1)(b) GDPR – Performance of a contract
• Art. 6(1)(c) GDPR – Legal obligation (commercial and tax law)

Call recording and transcription on the platform’s voice channels.

• Legal basis determined by the business customer as controller, for example consent (Art. 6(1)(a) GDPR) or its legitimate interests (Art. 6(1)(f) GDPR)

Recording and transcription are on by default, and the assistant identifies itself as AI at the start of the call. The business customer must inform callers and have a legal basis.

Platform security and prevention of fraud and abuse.

• Art. 6(1)(f) GDPR – Legitimate interests
• Art. 6(1)(c) GDPR – Legal obligation

Website analytics and advertising measurement using cookies.

• Art. 6(1)(a) GDPR – Consent

Marketing communications about our services to customers and business contacts.

• Art. 6(1)(f) GDPR – Legitimate interests
• Art. 6(1)(a) GDPR – Consent, where required by law

You can object at any time by writing to hello＠totemstudio.ai.

Keeping records of contract acceptance and defending our rights against potential claims.

• Art. 6(1)(f) GDPR – Legitimate interests
• Art. 6(1)(c) GDPR – Legal obligation

Recipients and sub-processors

We only share personal data with the providers needed to deliver the service, which process it on our behalf under data processing agreements and appropriate safeguards, except where they are stated to act as independent controllers or under the customer’s own contract. We will also disclose data where required by law or by a competent authority. Our providers are:

• Google Cloud / Firebase (Google Cloud EMEA Ltd and Google Ireland Ltd) — Hosting, authentication, database, storage and cloud functions · Account and CRM data, messages, files, recordings and logs · European Union: database in the EU multi-region (eur3); storage and functions in Belgium (europe-west1) · Transfers to Google LLC (USA) covered by the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs)
• OpenAI (OpenAI Ireland Ltd; processing by OpenAI OpCo, LLC) — AI voice (GPT-Live), transcription, assistant reasoning and tools, and assistant preparation · Audio, transcripts, instructions, conversation and business context, and tool inputs and results · United States. The managed Agents API does not offer EU data residency or zero data retention · Standard Contractual Clauses (OpenAI is not DPF-certified). By default, OpenAI does not use API data to train its models
• Hostinger International Ltd (Cyprus) — Virtual servers running our n8n automation engine · Automation inputs, context, results and logs · European Union: servers in France (Paris) and Germany (Frankfurt) · No international transfer
• Telnyx LLC — Telephony when provided through Totem: numbers, call transport, SIP and WebRTC · Phone numbers, call metadata and audio · United States · DPF and Standard Contractual Clauses
• Stripe (Stripe Payments Europe Ltd, Ireland) — Payments, subscriptions and billing; Stripe acts as an independent controller for fraud prevention and regulatory compliance · Billing, payment and transaction data; Totem does not store full card numbers · Ireland, with transfers to Stripe, LLC (USA) · DPF and Standard Contractual Clauses
• Google Analytics, Google Ads and Google Tag Manager (Google Ireland Ltd); Meta Pixel (Meta Platforms Ireland Ltd) — Website analytics and advertising measurement, only with your cookie consent · Cookie identifiers, device data and browsing events · Ireland; these providers may process data in the United States · Google: DPF and Standard Contractual Clauses. Meta: DPF and Standard Contractual Clauses
• Meta: WhatsApp, Instagram and Messenger (Meta Platforms Ireland Ltd and WhatsApp Ireland Ltd) — Messaging channels connected by the customer · Identifiers, messages, attachments and delivery metadata · Ireland · Under the customer’s own contract with Meta
• Zadarma (Voice Cloud S.L., Spain) and the customer’s other telephony accounts — Telephony contracted directly by the customer · Phone numbers, call metadata and audio · Spain for Zadarma; other carriers according to the customer’s contract · Under the customer’s own contract
• Google Workspace / Microsoft 365 — Calendar and email connected by the customer · Authorised account data, events and sent emails · According to the customer’s account · Under the customer’s own contract
• Retell AI, Inc. — Legacy voice agents, only for customers still using them · Audio, metadata, transcripts and summaries · United States · Standard Contractual Clauses; under the customer’s own contract

Services the customer connects with its own account (Meta, Zadarma and other telephony accounts, Google Workspace, Microsoft 365 and Retell AI) operate under the contract between the customer and that provider and are not, by default, Totem’s recipients. Totem does not sell personal data.

International Data Transfers

Totem’s core infrastructure is in the European Union: the database in Google Cloud’s EU multi-region, storage and functions in the Belgium region, and the n8n servers in France and Germany. Transfers outside the European Economic Area occur with OpenAI (United States, Standard Contractual Clauses), Telnyx (United States, DPF and Standard Contractual Clauses), Google (DPF and Standard Contractual Clauses, for support and ancillary access) and Stripe (DPF and Standard Contractual Clauses). This information also meets the transparency obligation in Article 28 of the EU Data Act (Regulation (EU) 2023/2854). You can request a copy of the applicable safeguards at hello＠totemstudio.ai.

Cookies and SDKs

We use cookies and similar technologies to make the website and dashboard work, to remember your preferences and, only if you accept, to measure site usage and the performance of our advertising. Non-essential cookies stay off until you accept them in the cookie banner, and you can change your choice at any time from the cookie icon.

• Necessary: authentication, security and load balancing; no consent required
• Functional: preferences such as language
• Analytics: Google Analytics, via Google Tag Manager, only with your consent
• Advertising: Google Ads and Meta Pixel, only with your consent

Security

We apply technical and organisational measures appropriate to the risk: hosting in the European Union, encryption in transit (TLS), AES-256-GCM encryption of connected-account tokens and credentials, authorisation rules that isolate each team’s data, App Check anti-abuse protection, role-based access, daily backups and activity logging. No system is completely invulnerable.

Call Recording, Transcription, and Notices

Call recording and transcription are on by default on supported voice channels. The voice assistant identifies itself as artificial intelligence at the start of every call. The business customer using the platform is responsible for informing callers about the recording and the processing of their data and for having a valid legal basis. Retention periods for calls and messages can be configured in the account’s Settings.

Data Retention

We keep personal data only for as long as needed for each purpose and, after that, for the periods required by law:

• Account data: For the duration of the contract.
• Invoices and accounting records: 6 years (Article 30 of the Spanish Commercial Code).
• Tax records: 4 years (Spanish General Tax Law).
• Records of contract acceptance: For the duration of the contract and then for the limitation period for claims (5 years, Article 1964 of the Spanish Civil Code).
• Support tickets: 3 years after closure.
• Sales and marketing contacts: Until you object to the processing.
• Analytics cookies: According to your choice in the consent tool, up to a maximum of 14 months.
• Security logs: Up to 12 months.
• Content processed on behalf of customers (calls, recordings, transcripts, messages and contacts): Until the customer deletes it or until the automatic deletion period configured in Settings expires (for example, 30, 90, 180 or 365 days for calls and messages, plus lead review reminders). When the contract ends, the customer has 30 days to export its data; the data is then deleted.
• Backups: Daily backups that rotate and expire within a maximum of 98 days; point-in-time recovery covers the last 7 days.
• Assistant session state at OpenAI: OpenAI keeps session state until Totem deletes it. Totem requests deletion once each completed call has been reconciled, and abandoned sessions are deleted after 7 days of inactivity. OpenAI may keep abuse-monitoring logs for up to 30 days.

Children’s Data

Our Services are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child provided personal data, please contact us to request deletion.

Legal or Contractual Obligations

Some data is necessary to enter into and perform the contract, such as account and billing data, and some is required by commercial and tax law.

If you do not provide it, we will not be able to create your account or provide the services. Providing data through our contact forms is voluntary.

Automated Decision-Making

Totem’s AI assistants automate tasks such as answering calls and messages, collecting details, booking appointments and routing conversations. Totem does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. You have the right not to be subject to such decisions.

Your rights

Right of Access

You may request confirmation and a copy of your personal data.

Right to Rectification

You may request correction of inaccurate or incomplete data.

Right to Erasure

You may request erasure of your data when it is no longer necessary, when you withdraw your consent, when you object to the processing or when the processing is unlawful.

Right to Restrict Processing

You may request restriction under certain conditions (e.g., accuracy contested, processing unlawful).

Right to Data Portability

You may request export in a machine-readable format where processing is based on consent or contract and carried out by automated means.

Right to Object

You may object to processing based on legitimate interests on grounds relating to your particular situation. If you object to processing for direct marketing, we will stop processing your data for that purpose.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

Supervisory Authority

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), www.aepd.es, or with the supervisory authority in your country of residence.

To exercise your rights, write to hello＠totemstudio.ai stating the right you wish to exercise. Where necessary to verify your identity, we may ask you for additional information. Exercising your rights is free of charge and we will respond within one month, which may be extended by two further months for complex requests, in which case we will let you know. If your data is processed by a business that uses Totem (for example, if you called or wrote to a business served by a Totem assistant), that business is the controller: please contact it directly; if we receive your request, we will forward it to them. If you live outside the European Union (for example, in Kenya, Latin America or the United States), you have equivalent rights under your local law, such as Kenya’s Data Protection Act 2019, and you can exercise them at the same address.

Data Breach Notification

If a personal data breach occurs, we will notify the AEPD within 72 hours of becoming aware of it where the law requires, and we will inform the people affected where the breach is likely to result in a high risk to their rights. If the breach affects data we process on behalf of a customer, we will inform that customer without undue delay and in any event within 48 hours of becoming aware of it, so that it can meet its own obligations.

Google Ads and Meta Pixel

If you accept advertising cookies, we use Google Ads and Meta Pixel to measure the performance of our campaigns, for example whether a visit from an ad leads to a sign-up, and to show our ads to relevant audiences.

These cookies are not set without your consent. You can withdraw it at any time from the cookie icon on the website or in your browser settings.

Google Ireland Ltd and Meta Platforms Ireland Ltd process this data under their own privacy policies, available on their websites.

Analytics

If you accept analytics cookies, we use Google Analytics, managed through Google Tag Manager, to understand how the website is used and to improve it.

Scope of Processing

Event data, pages visited, device, operating system and browser information, approximate location and cookie identifiers.

Purposes of Processing

Evaluate usage, generate reports, enhance product performance and reliability.

Recipient

Google Ireland Ltd.

Transfer to Third Countries

Google may process data in the United States. These transfers to Google LLC are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

Duration of Storage

According to your choice in the consent tool, up to a maximum of 14 months.

Your Choices

You can withdraw your consent at any time from the cookie icon on the website; withdrawal does not affect the lawfulness of earlier processing.

Legal Basis of Processing

We rely on the following legal bases under GDPR:

• Art. 6(1)(a) GDPR: When you provide explicit consent for specific processing activities.
• Art. 6(1)(b) GDPR: Necessary processing to fulfill a contract with you.
• Art. 6(1)(c) GDPR: Processing required to comply with legal obligations.
• Art. 6(1)(f) GDPR: Processing based on our legitimate interests, provided they do not override your rights and freedoms.

Legitimate Interests in the Processing

Our legitimate interests are keeping the platform secure and preventing fraud and abuse, improving the service, sending communications about our services to customers and business contacts, and keeping evidence to defend our rights. You can object to this processing at any time.

Changes to This Privacy Policy

We may update this Privacy Policy. Each version will be published on this page with its update date. Where a material change affects customers, we will notify them by email or in the dashboard at least 30 days in advance.

Contact Us

For any questions about this Privacy Policy or to exercise your rights, contact Totem Studio International Technologies, S.L.:

• hello@totemstudio.ai
• Ronda de Buenavista 24, bloque 9, 4.º C, 45005 Toledo, Spain
• +34 900 433 533