Personal data processing policy
The business passes conversation recordings to us itself and is responsible for notifying participants and getting their consent. We store data in Kazakhstan, mask phones, IINs, cards and names in transcripts, delete audio right after recognition and send nothing to third-party AI services.
This English version is a courtesy translation; the Russian version prevails.
1. General
1.1. This policy describes how the Vsem service (vsem.kz) processes personal data. It is based on Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" («the Law»).
1.2. Terms are as in the Law: the subject is the person the data relates to; the owner and the operator are those who set the purposes of processing and process the data; a third party is one connected with them who processes the data on their instructions.
2. Whose data we process and in what role
| Whose data | What | Owner and operator | Vsem's role |
|---|---|---|---|
| The business's customers — participants in recordings | voice, words of the conversation; in the transcript phones, IINs, card numbers and names are replaced with labels | the Vsem business client | we process on the business's instructions |
| The business's employees | voice, name or extension, marks on conversations; voice for recognition — only with the employee's consent | the Vsem business client | we process on the business's instructions |
| Cabinet users | phone number, name (if given), Telegram chat for sign-in and notifications, actions in the cabinet | Vsem | owner and operator |
| Website visitors | a request (name, phone, company) — if left; ad tags (utm) in a cookie | Vsem | owner and operator |
The business client decides which conversations to record and must notify participants and get their consent (Articles 7 and 8 of the Law). This is a condition of signing up — see the User Agreement.
3. Purposes
- Conversation recordings — checking conversations against the business's checklist, training and supporting employees, recording customer demand. Other purposes — only by a separate decision of the business.
- Cabinet users' data — sign-in, role-based access, notifications, invoices, support.
- Website requests — to call back.
4. Where data is stored
4.1. Databases with personal data are on servers in the Republic of Kazakhstan (Article 12 of the Law).
4.2. Speech recognition and checklist checks are done by our models on our servers. We do not pass recordings and transcripts to third-party AI services (ChatGPT, Claude and others). The business downloads the package for its assistant itself — without recordings and customer names; de-identified quotes go into it only if the business turned them on.
4.3. Cross-border transfer (Article 16 of the Law): we do not transfer data abroad ourselves, with two caveats that the business or the visitor turns on:
- Telegram. Sign-in and notifications (signals, the morning summary) come through Telegram, whose servers are outside Kazakhstan. Notifications contain item names and, if the recipient may read transcripts, a short de-identified quote.
- Website fonts load from Google Fonts: the visitor's address is visible to Google. The cabinet with the data does not use this.
5. How we protect data
- Masking before the database: phones, IINs, card numbers, e-mails, addresses and customer names in transcripts are replaced with labels.
- Encryption: conversation texts, quotes and names are stored encrypted; the website and the cabinet work over HTTPS.
- Role-based access: the owner decides who sees transcripts, who listens to recordings, who exports quotes; an employee sees only their own conversations. Every playback of a recording goes into the access log.
- Business isolation: one business's data is not accessible to another at the database level.
- Backups are encrypted.
6. Retention
| What | How long |
|---|---|
| Recording audio | deleted right after recognition; if the business turned on listening — an encrypted copy for a day or a week |
| Transcripts and marks | 7 days by default, longer at the business's choice (plan options) |
| Demo without sign-up | 24 hours or at once with the «Delete now» button |
| Cabinet data | while the cabinet exists; deleting the cabinet erases all its data, including at the recognition service |
| Website requests | while needed to get in touch, then deleted |
The business can delete any conversation with one button. De-identified transcripts are used to improve models only with a separate tick by the business.
7. Subjects' rights
7.1. A person whose data is processed may know about the processing, demand correction and deletion, and withdraw consent (Article 24 of the Law).
7.2. A customer or employee of a business should contact the business itself — it owns this data and knows which recordings exist. We help the business find and delete the data.
7.3. Cabinet users and website visitors contact us: the «Feedback on Vsem» button in the cabinet or the Telegram bot @vsemkzbot.
8. Security breaches
If we discover a personal data security breach, we will notify the authorised body (Article 25 of the Law) and the business whose data it concerns, and tell what has been done.
9. Responsible person and changes
9.1. The person responsible for organising personal data processing at Vsem (Article 25 of the Law) is appointed by order; contact — through the «Feedback on Vsem» button in the cabinet or @vsemkzbot.
9.2. A new version of this policy is published on this page with its date; cabinet owners confirm it at their next sign-in.
Source: Law of the RK "On Personal Data and Their Protection" No. 94-V (official publication — Adilet, adilet.zan.kz).
The documents are accepted with a checkbox at sign-up: «I accept the terms and confirm that recordings are made with the participants notified and consenting». We keep who accepted which edition and when.