Privacy policy

Courtesy translation. Only the French version of this page is binding.

Version in force on 30 September 2026. Nodical places calls and sends SMS on behalf of its customers: this page explains who is responsible for what, which data is processed, for how long, and how to exercise your rights.

1. Who is responsible

For website visitors, people who write to us and users of the customer workspace, the data controller is NODICAL (formerly SD CONSEIL), a French simplified joint-stock company (société par actions simplifiée) with share capital of €1,000, registered with the Paris Trade and Companies Register under number 949 086 672, whose registered office is at 38 avenue Victor Hugo, 75116 Paris, France (“Nodical”).

For people called or contacted by SMS as part of a campaign, the data controller is Nodical's customer, in whose name the agent introduces itself. Nodical then acts as a processor, on that customer's instructions, under a data processing agreement compliant with Article 28 of the GDPR.

Model improvement. Where the customer's contract expressly allows it, Nodical reuses, on its own behalf, recordings and transcripts of these calls to improve its speech understanding models. For this use only, Nodical is the data controller (see section 2).

2. Data processed and purposes

Website visitors

The website sets no audience-measurement cookie and no advertising tracker. A single technical service receives data on every visit, without any action on your part: our host's audience measurement (Vercel Web Analytics), which counts page views without cookies and without recognising a visitor from one day to the next. The typefaces are served by the website itself: no request is made to Google. The contact form collects name, email, phone, company and message, solely to call you back and answer your request. The website's chat assistant sends the text you type to our artificial intelligence provider (Anthropic) to produce an answer; do not enter sensitive information in this assistant.

Users of the customer workspace

Email, password (stored as a hash, never in clear text), role, sign-in dates, actions performed (creating a campaign, deciding on a contact), company verification documents (company registration extract, identity document of the director, proof of registered address), declared use and commitment. Purposes: providing the Service, securing access, invoicing, and verifying the identity of the company before any outbound call, which meets a duty of care and of preventing fraudulent use.

People called or contacted by SMS

Title, last name, first name, phone number and, where applicable, email and context data supplied by the customer (subject of a quote, customer status); date, time and duration of the call, outcome, summary, transcript and recording of the conversation, SMS replies. Purpose: carrying out the campaign decided by the customer (callback, reception, follow-up, prospecting) and reporting the result to it. The legal basis is the customer's: contractual relationship, legitimate interest or consent as the case may be, which the customer undertakes to ensure before importing any file.

Chances of winning (for the customer)

In the customer's workspace, each contact already called may receive an estimate of their chances of converting: the share of the same customer's comparable contacts (same call outcome, same call duration, same sector if supplied, same campaign) whose won or lost outcome is known. The calculation uses only that customer's results, never another customer's. It is used to rank the order in which the customer's team calls back; it makes no decision producing legal effects for the person, triggers no call and is never shown to the person called. Legal basis: the customer's, for its prospecting. You may object with the customer or by email to enterprise@nodical.ai.

Model improvement (where the customer's contract allows it)

Data: recordings, transcripts, call outcome and technical measurements (durations, response times). Before any annotation, names, phone numbers, addresses and other elements that directly identify the person are removed or replaced (pseudonymisation). Purpose: training and evaluating Nodical's models to better tell a person from an answering machine, better understand requests, and reduce response times and errors. Legal basis: Nodical's legitimate interest in improving the quality of its service. This data is never used to make a decision about the person, to contact them again, or for another customer; it is stored and processed in the European Union. You may object at any time, without giving a reason, by email to enterprise@nodical.ai stating the number called: the calls concerned are then excluded from training data.

3. Call recording and identification of the agent

Conversations are recorded and transcribed. Recording is announced at the start of the call, together with, where the customer's contract allows it, its reuse to improve our models. The agent introduces itself in the name of the customer company and announces at the start of the call that it is an automated voice assistant (EU AI Act, Article 50); it confirms it whenever asked and never passes itself off as a human. Anyone called may ask for the call to end, ask not to be contacted again, or obtain a copy of the recording concerning them (see section 7).

4. Consent, opt-out and calling hours

A prospecting call made by the agent is treated as an automated call. A consumer is only called for prospecting if they have given prior consent to receive telemarketing calls from an automated voice assistant: this has been the rule in France since 11 August 2026, and in Spain, where that consent must be express. The customer collects this consent and keeps proof of it. In France, a professional is only called for an offer related to their business, after being informed and with a simple way to object; in Spain, automated commercial calls to businesses also require their prior consent. Anyone who refuses during the call is added to the customer's opt-out list and is not called again. Advertising exclusion lists (Lista Robinson in Spain) are respected where the law requires it. Calls respect the days and hours authorised in the country of the person called. For each imported file, the customer certifies that the numbers were lawfully obtained and that the people concerned consented.

5. Recipients and sub-processors

Data is accessible to the Nodical team, to the extent necessary, and to the customer concerned for the data of its own campaigns. Nodical uses the following sub-processors, bound by contract:

Vercel Inc. (United States): hosting of the website and the customer workspace; storage of verification documents in the United States (Washington), under standard contractual clauses;
Neon Inc.: database, European Union;
Brevo (Sendinblue SAS, France): sending of account and notification emails;
CallR (France): telephone routing and SMS;
ElevenLabs Inc. (United States): the agent's speech synthesis and recognition;
Anthropic PBC (United States): the website's chat assistant;
Payment: top-ups are paid by bank transfer to the publisher's account; Nodical stores no banking data of the Customer. If a card payment provider is added, it will be named here.

Transfers outside the European Union are governed by the European Commission's standard contractual clauses or by an adequacy decision, depending on the provider.

6. Retention periods

Contact requests: 24 months after the last exchange.
Customer workspace account: the term of the contract, then 5 years for the data needed for evidence and accounting.
Verification documents: the term of the contract, then 5 years (duty of vigilance), unless early erasure is requested where the law allows it.
Calls, transcripts and recordings: 12 months after the call, then deletion; the customer may request a shorter period for its campaigns.
Recordings and transcripts reused for model improvement, in pseudonymised form: no more than 3 years after the call, then deletion or anonymisation.
Log of sent messages (emails, SMS): 3 years, for evidence purposes.

7. Your rights

You have a right of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions for after your death. To exercise them: enterprise@nodical.ai, or by post to the publisher's address. If you were called on behalf of a Nodical customer, we forward your request to that customer and help it respond; you may also ask directly not to be contacted again, which we apply without delay. You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), if you believe your rights are not respected.

8. Security

Encrypted connections, hashed passwords, data partitioned per customer, private storage of verification documents, logging of sent messages and access. In the event of a data breach likely to create a risk for individuals, Nodical notifies the CNIL and, where applicable, the persons concerned, within the legal time limits, and informs its customers without undue delay.

9. Changes

This policy may evolve with the Service. The version in force is the one published on this page, with its date.