Your data, and who can reach it

This page answers the questions you should ask before putting your customer conversations on somebody else’s platform — and it is honest about which answers are a switch you control and which are a request you make to us.

The short version. Your data cannot be reached by another business, ever. Recording is off until you ask for it. Retention is real but it is not on by default — until a window is set, what you record is kept indefinitely.

Kept apart from every other business

Every table that holds your data is filtered by which business is asking, and that filter lives in the database rather than in our code. The practical consequence is the one that matters: if the question arrives without a business attached to it, the answer is nothing — not everything.

That direction is deliberate. A filter that fails open returns another business’s rows the first time somebody forgets to apply it; one that fails closed returns an empty screen and somebody notices immediately.

Two more things follow from it:

• The account Kooday’s own software runs as cannot turn the filter off. That is checked when the platform starts, not assumed.
• Our internal cross-business screens are assembled from per-business reads, so there is no “show me everything” path that could be misused or leaked.

What is recorded, and what is not

	Default	What changes it
Call recordings	Off	Switched on for your account when you ask
Call transcripts and summaries	On	Part of how calls become searchable records
Chat message content	On	It is the conversation; there is nothing to answer with otherwise
Your customers’ phone numbers in our logs	Masked	Nothing — they are always masked

Recording being off by default is the one people assume is the other way round. A new assistant records nothing until somebody asks us to switch it on.

How long it is kept

This is the section to read properly, because the honest answer is not the one most privacy pages give.

There is a retention window, and it is per-account. Once set, a background sweep deletes call recordings older than that window and redacts chat message content on the same schedule, without anyone remembering to run it.

⚠️ Until a window is set, nothing expires. The sweep only looks at accounts that have one. An account with no window keeps its recordings and message content indefinitely — it is not a 30-day default, or a 90-day default, or any default at all. If a retention period matters to you, ask us for one; do not assume you have it.

Setting it is not self-serve today. There is no box on your dashboard for it, and that is a deliberate hold rather than an oversight: switching a finite window onto an account that has always kept everything starts deleting recordings the moment it is saved, and that is not a change anybody should be able to make by accident. Ask us, and say what window you want.

Chat retention redacts, it does not delete. The conversation stays; its message content is removed. That is because the usage rows behind your invoice reference those conversations, and a billing record has to outlive the messages it describes — a deletion that took the invoice with it would be a worse outcome than a redaction that keeps it.

Erasing one specific thing

Separately from any window, one call’s recording or one conversation’s messages can be erased on request. This is the right-to-erasure path, and it is immediate.

⚠️ There is no button for this yet. It is available through the API to an admin on your account, or by asking us. If a customer has asked you to delete what you hold about them, send us the call or the conversation and we will do it — do not wait for a screen that does not exist.

Erasure is final. The recording is removed from storage and the link to it is cleared; there is no archive behind it that anyone can recover it from, including us.

What your assistant works out about a customer

Separately from the recordings and the messages, Kooday keeps a short buyer profile for each of your customers: a few observations about how they tend to buy, why a previous enquiry stopped, and anything they said that suggests they might need something else. It shows on their profile page under What we’ve learnt about this buyer.

Four things are worth saying plainly.

It is derived from that customer’s own conversations with you — nothing else. There is no outside data, no purchased list, no cross-referencing against other businesses. If it is not something they said to you, it is not in there.

Your business can see all of it, and delete any of it. There is no hidden model state: every line your assistant is given is on that page, with the count or the quotation it came from, and a Remove control. Removing one stops it being used from that customer’s next conversation, and it does not come back on its own.

The quoted lines are that customer’s own words, and they are treated as such. They are held on the same footing as your conversation records — kept to the same schedule, erasable the same way, and they never leave your account. They are not sent to any other business, they are not included in any report or export, and they are not used to build anything shared across Kooday’s customers.

None of it ever stops a customer being contacted, on its own. This is the important one. A note saying a previous enquiry ended with a competitor is background for your assistant to open a conversation better informed — it is not an opt-out, it does not block messages, and it cannot create one. Only the customer can opt themselves out (by replying STOP), and only the customer can undo that. Nothing your assistant concludes can add somebody to that list.

What is used to improve your assistant’s selling

If suggested improvements is switched on for your account, Kooday looks at your finished deals to work out which sales approaches end in won business, and can draft a lesson for you to approve. Four things about what that reads.

The comparison itself counts moves, not words. Which approach won more often is worked out from a tally attached to each finished deal: which approach your assistant used, what kind of hesitation it was answering, and whether the deal was eventually won. No transcript, message, note or buyer-profile quotation is part of that arithmetic.

But your conversations are read to check the labels, and you should know that. Your assistant labels its own moves, and a label nobody checks is worth nothing — a version that merely said “reframed” more often would appear to win with no change in behaviour at all. So a sample of conversations is read, transcript and messages included, and the question asked of each is narrow: did the move this label names actually happen here? The result is a count — how often the label was right — and it is what decides whether an approach may be compared at all. If a label cannot be trusted, the approach is dropped rather than reported.

That reading is the same material covered by everything above: kept to the same schedule, erasable the same way, and it never leaves your account.

The one sentence a machine writes is written from counts. When something does stand out, a model turns a row of numbers into an English instruction. It is given the counts and two short codes from a fixed list, and nothing else — no transcript, no customer, no business name, no product, no price. It cannot repeat what it was never shown. The sentence it produces is also required to contain no figures: every number you see on a suggestion is counted separately and rendered beside it, so the wording and the arithmetic cannot drift apart.

Nothing is shared between businesses, and nothing is trained. Your results are compared against your own other deals and never against another Kooday customer’s. No model is trained, fine-tuned or adjusted from your data — a lesson is a sentence placed in your assistant’s instructions, which you can read and stop using on the Teaching page at any time.

Nothing happens without you. Kooday cannot give itself an instruction. A drafted suggestion sits in a queue until a person on your team approves it, and approving it records a candidate rather than changing any conversation — the comparison itself is started only when you ask us for it. Suggestions are off unless you have asked for them.

Your accounts stay yours

Your calls run on a telephony account in your own name, billed to you at cost. You are not renting a number from us, and if you stop using Kooday the number stays with you.

That cuts both ways and it is fair that you know it: because the account is yours, its bill and its standing are yours too. If your provider suspends it, that is a conversation between you and them — we cannot answer on a number that has been withdrawn.

The same is true of your WhatsApp Business Account: it is yours, under your own Meta business, which is simply how WhatsApp works.

What is not offered: using your own AI provider account for your assistant’s voice or chat. That runs on Kooday’s provider accounts, and there is no bring-your-own-key option for it.

Who on your team can see what

There are three levels of access, and they are business-wide rather than per-person:

Role	Reaches
Business admin	Everything in your account, including billing and settings
User	The working screens — conversations, customers, reports
Kooday platform admin	Cross-business operational screens, for running the platform

⚠️ History says “you”, not which teammate. There is no per-operator identity on a conversation or a deal yet, so if two people share a business admin login you cannot tell from the record which of them replied. If that matters, give people their own logins.

Every change to your business, assistants and billing is written to a record of who did what and when, which cannot be edited afterwards and survives even the deletion of the account it describes.

Testing without consequences

The chat tester in your dashboard runs the real assistant and writes nothing.

⚠️ Unless you arm it. Your assistant’s real actions are switched off in the tester by default, and there is a tick box that turns them on for one turn. Ticked, a test can fire a real action — send a real message, write a real record. Every such turn is written to the audit record. It used to be true that a test could never do anything real; since 13 August 2026 it is not, and the tick box is the difference.

Questions we get asked

Is our data used to train another business’s assistant? No. Your conversations, recordings and business data are not used to train another business’s assistant. What we will not do is make a promise on behalf of the model providers underneath us — their own terms govern what they do with what passes through them.

Can Kooday staff read our conversations? Our operational screens are built per-business rather than as a single view over everyone. Support tickets you raise from the dashboard carry identifiers, not content — the id of a call, never its transcript; the id of a contact, never your customer’s name or number.

What happens to our data if we leave? Ask us and we will erase it. Your telephony number and your WhatsApp Business Account are yours already and stay with you.

Do you guarantee uptime? No. We do not offer a contractual uptime or resolution guarantee, and we would rather say so than sell you one we cannot stand behind. What we do publish are response-time targets for support.