Your data, and who can reach it

This page answers the questions you should ask before putting your customer conversations on somebody else’s platform — and it is honest about which answers are a switch you control and which are a request you make to us.

The short version. Your data cannot be reached by another business, ever. Recording is off until you ask for it. Retention is real but it is not on by default — until a window is set, what you record is kept indefinitely.

Kept apart from every other business

Every table that holds your data is filtered by which business is asking, and that filter lives in the database rather than in our code. The practical consequence is the one that matters: if the question arrives without a business attached to it, the answer is nothing — not everything.

That direction is deliberate. A filter that fails open returns another business’s rows the first time somebody forgets to apply it; one that fails closed returns an empty screen and somebody notices immediately.

Two more things follow from it:

• The account Kooday’s own software runs as cannot turn the filter off. That is checked when the platform starts, not assumed.
• Our internal cross-business screens are assembled from per-business reads, so there is no “show me everything” path that could be misused or leaked.

What is recorded, and what is not

	Default	What changes it
Call recordings	Off	Switched on for your account when you ask
Call transcripts and summaries	On	Part of how calls become searchable records
Chat message content	On	It is the conversation; there is nothing to answer with otherwise
Your customers’ phone numbers in our logs	Masked	Nothing — they are always masked

Recording being off by default is the one people assume is the other way round. A new assistant records nothing until somebody asks us to switch it on.

How long it is kept

This is the section to read properly, because the honest answer is not the one most privacy pages give.

There is a retention window, and it is per-account. Once set, a background sweep deletes call recordings older than that window and redacts chat message content on the same schedule, without anyone remembering to run it.

⚠️ Until a window is set, nothing expires. The sweep only looks at accounts that have one. An account with no window keeps its recordings and message content indefinitely — it is not a 30-day default, or a 90-day default, or any default at all. If a retention period matters to you, ask us for one; do not assume you have it.

Setting it is not self-serve today. There is no box on your dashboard for it, and that is a deliberate hold rather than an oversight: switching a finite window onto an account that has always kept everything starts deleting recordings the moment it is saved, and that is not a change anybody should be able to make by accident. Ask us, and say what window you want.

Chat retention redacts, it does not delete. The conversation stays; its message content is removed. That is because the usage rows behind your invoice reference those conversations, and a billing record has to outlive the messages it describes — a deletion that took the invoice with it would be a worse outcome than a redaction that keeps it.

Erasing one specific thing

Separately from any window, one call’s recording or one conversation’s messages can be erased on request. This is the right-to-erasure path, and it is immediate.

⚠️ There is no button for this yet. It is available through the API to an admin on your account, or by asking us. If a customer has asked you to delete what you hold about them, send us the call or the conversation and we will do it — do not wait for a screen that does not exist.

Erasure is final. The recording is removed from storage and the link to it is cleared; there is no archive behind it that anyone can recover it from, including us.

Your accounts stay yours

Your calls run on a telephony account in your own name, billed to you at cost. You are not renting a number from us, and if you stop using Kooday the number stays with you.

That cuts both ways and it is fair that you know it: because the account is yours, its bill and its standing are yours too. If your provider suspends it, that is a conversation between you and them — we cannot answer on a number that has been withdrawn.

The same is true of your WhatsApp Business Account: it is yours, under your own Meta business, which is simply how WhatsApp works.

What is not offered: using your own AI provider account for your assistant’s voice or chat. That runs on Kooday’s provider accounts, and there is no bring-your-own-key option for it.

Who on your team can see what

There are three levels of access, and they are business-wide rather than per-person:

Role	Reaches
Business admin	Everything in your account, including billing and settings
User	The working screens — conversations, customers, reports
Kooday platform admin	Cross-business operational screens, for running the platform

⚠️ History says “you”, not which teammate. There is no per-operator identity on a conversation or a deal yet, so if two people share a business admin login you cannot tell from the record which of them replied. If that matters, give people their own logins.

Every change to your business, assistants and billing is written to a record of who did what and when, which cannot be edited afterwards and survives even the deletion of the account it describes.

Testing without consequences

The chat tester in your dashboard runs the real assistant and writes nothing.

⚠️ Unless you arm it. Your assistant’s real actions are switched off in the tester by default, and there is a tick box that turns them on for one turn. Ticked, a test can fire a real action — send a real message, write a real record. Every such turn is written to the audit record. It used to be true that a test could never do anything real; since 13 August 2026 it is not, and the tick box is the difference.

Questions we get asked

Is our data used to train another business’s assistant? No. Your conversations, recordings and business data are not used to train another business’s assistant. What we will not do is make a promise on behalf of the model providers underneath us — their own terms govern what they do with what passes through them.

Can Kooday staff read our conversations? Our operational screens are built per-business rather than as a single view over everyone. Support tickets you raise from the dashboard carry identifiers, not content — the id of a call, never its transcript; the id of a contact, never your customer’s name or number.

What happens to our data if we leave? Ask us and we will erase it. Your telephony number and your WhatsApp Business Account are yours already and stay with you.

Do you guarantee uptime? No. We do not offer a contractual uptime or resolution guarantee, and we would rather say so than sell you one we cannot stand behind. What we do publish are response-time targets for support.