Effective: 2 September 2026
Business data processing
This page explains in factual terms what 4word does with the information of customers who call the business: what is stored, for how long, who may see it, and what the business is responsible for. It is a summary, not a data-processing agreement.
The short version
Toward the customers who call the business, the business is the controller and 4word processes their information on its behalf. Call content - transcript, summary and lead - is cleared automatically after 30 days, and the call row and the caller's number stay in the CRM until the business deletes the call. The duty to inform customers rests with the business, and the assistant identifies itself as an AI assistant on every call.
What this page covers
This page covers the business product: the phone receptionist that answers in the business's name, the messaging channel when it is enabled, and the CRM where inquiries are collected. It does not cover the personal product, which is described in the privacy policy. It is a factual summary and not a data-processing agreement; when such an agreement is required, this page is its factual basis.
Who is responsible for what
For information a business owner provides directly - contact details, the knowledge base and system settings - 4word acts as controller. For the information of customers who call the business - name, phone number, reason for the inquiry, call transcript and summary - the business is the controller and 4word processes it on the business's behalf and per its instructions. In practice: the lawful basis for the processing and the duty to inform customers rest with the business, and we supply the tools.
What is stored about each caller
For each call we store the caller's phone number, their name if it was given during the call or identified, the call time and duration, the reason for the inquiry as understood, the call transcript, an automatically generated summary, and the lead details extracted - for example an appointment request, a callback number or an item of interest.
The call is transcribed in real time and is not recorded as an audio file. Extracted details are the product of natural conversation and may contain hearing or transcription errors, so any critical detail should be verified with the customer. The assistant opens every call by identifying itself as an AI assistant, and the business owner cannot remove that disclosure - the system rejects a greeting that denies it.
How long it is kept
Call content - the transcript, the summary and the lead - is cleared automatically after 30 days. The call row itself, including the caller's number, stays in the business's CRM until the business deletes the call. The knowledge base and the settings are kept for as long as the account is active. The full retention table, shared by this site and the servers, is on the privacy policy page.
Subprocessors
A call passes through the telephony provider, the speech-recognition provider and the model providers; summaries and replies are produced at the model provider; messages on the WhatsApp channel pass through Meta when the channel is enabled. The full list, with what each provider receives and where it processes it, is on the subprocessors page.
Controls already in place
Phone numbers and email addresses are stored with field-level encryption, and transcripts are encrypted at rest. Traffic is encrypted with TLS. Dashboard permissions separate owners from team members, and administrative actions are written to a per-business audit trail that fails closed - an action that cannot be recorded is not performed. Changes to the receptionist configuration are kept as versioned releases.
What deactivation does
Deactivating the receptionist stops incoming calls and deletes nothing: calls, leads and the knowledge base stay as they are, and the retention clock keeps running. Closing the account deletes the business's data through the deletion process, and the dedicated number is released and may later be assigned to another business.
A request to delete one caller's information
A customer who contacted the business and wants to access, correct or delete their information should approach the business, which is the controller. The business can delete a call and its lead directly from the dashboard. If a deletion is needed that the dashboard does not offer, the business owner can write to support@4word.io and we will carry it out on the business's behalf. 4word operates the service.
We acknowledge such a request within two business days and complete it within 30 days. We may need to verify that the person asking is authorised to act for the business. Deletion in the live systems happens immediately; at subprocessors and in backup copies it is carried out on a best-effort basis and may take until the end of the backup window.
What the business is responsible for
Informing its customers that phone inquiries are answered by an AI assistant and transcribed, and holding a lawful basis for the processing. The assistant states that it is AI on every call, but that statement does not replace a privacy notice from the business itself.
Handling its own customers' requests for access, correction and deletion, and passing on to us only those that cannot be carried out from the dashboard.
Using the leads export only for the purpose for which the information was given, keeping it secure, and not passing it to a third party without a lawful basis. The exported file contains third parties' personal information.
Contact
4word operates the service. For questions about this page, about the processing or about a particular provider, write to support@4word.io or use the contact form on the site.