Draft — pending counsel review. This document describes how the service works today and will be finalised before general availability.
Version 1.0-draft · effective 2026-10-06
Privacy Policy
iCall.tel ("iCall.tel", "the service") is operated by the iCall.tel operating company ("we", "us"). This policy explains what personal information the service handles, why, for how long, and the choices you have. It describes the service as it actually works today; when that changes, this policy changes with it, with a new version and date at the top.
Who this is for. iCall.tel provides video calling to the applications, clients and users of the solutions it is integrated with. There is no public sign-up: accounts are created by invitation, or by an organization or application that uses iCall.tel. You may also join a call as a guest from a link someone sent you.
1. Our role
- For your organization's calls, meetings and recordings, the organization that invited you or that you work for (our customer) decides why and how they are used. It is the controller, and we act as its service provider / processor, under our agreement with it. Questions about that content are best sent to that organization; if you send them to us, we pass them on.
- For accounts, security and the running of the service — sign-in, abuse prevention, logs — we are the controller.
2. What we handle
| Category | Examples | Where it comes from |
|---|---|---|
| Account | name, email address, password (stored only as a one-way hash), two-factor settings, organization membership and role | you, or the organization that invited you |
| Sign-in sessions | session identifier, IP address, browser user-agent, timestamps | your browser when you sign in |
| Access requests | name, email, IP address, user-agent, and automated risk signals, if an access request is made | the request form, where enabled |
| Meetings | title, description, schedule, organizer, invitees' names and email addresses, RSVP responses | the organizer |
| Live calls | your audio, video and screen share; your display name; chat messages; the network addresses your browser uses to connect | you, during the call |
| Recordings | the audio and video of a call, when the organizer records it | the organizer's browser |
| Email delivery | recipient address, subject and content of invitations and notifications | generated by the service |
| Operational logs | IP addresses, request paths, error details, timestamps | our servers |
| Administrative audit trail | which administrator did what, when, from which IP address | our servers |
We do not use advertising or analytics trackers, we do not sell or share personal information for cross-context behavioural advertising, and we do not use your calls or recordings to train any model.
3. How calls work, and what we can see
- Media is encrypted in transit. Every audio and video stream is encrypted with DTLS-SRTP between browsers, and the web application is served only over HTTPS.
- Peer-to-peer first. With our built-in calling, audio and video normally travel directly between participants' browsers and never pass through our servers.
- Our relay. When two networks block a direct connection, media passes through a relay (TURN) that we operate ourselves. The relay forwards encrypted packets; it cannot decrypt them. We do not use third-party relays.
- Connection discovery. To find a direct path, browsers may ask a STUN server what their public IP address is. That may be our own server or Google's public STUN service; STUN sees your IP address only — no media, no names. Administrators can turn Google's STUN off.
- Signaling and chat pass through our server to set up the call. They are held in memory for the duration of the call and are not stored.
- We do not claim end-to-end encryption for recordings or for any optional media server: a recording is captured in the recording participant's browser and stored on our servers, where it is encrypted in transit and protected by access controls.
4. Recording
Only a meeting's organizer can record. Everyone in the call — including people who join after recording starts — sees that the call is being recorded. Recordings are stored on our own servers and are available to the people the organization allows. Recordings can be deleted at any time by those the organization allows; where a retention period is configured for the service, they are deleted automatically when it passes.
If you organize a call and record it, you are responsible for giving the notice and obtaining the consent that the law where your participants are requires — some places require every participant's consent.
5. Why we use it (purposes and legal bases)
| Purpose | Basis |
|---|---|
| Providing calls, meetings, recordings and invitations | performing our contract with the customer, and with you |
| Keeping the service secure — sign-in protection, abuse and fraud prevention, audit trails | our legitimate interest in a secure service, and legal obligations |
| Operating and troubleshooting the service | our legitimate interest |
| Complying with law and responding to lawful requests | legal obligation |
Where the law requires consent for something — for example, recording in some places — the organization that records is responsible for obtaining it.
6. Who we share it with
We share personal information only with the service providers listed at Sub-processors, only for running the service, and under written terms that restrict their use of it. We disclose information to authorities only when the law requires it; see section 9. We do not sell personal information.
7. Where it is stored
The service is hosted in the United States. If you use it from elsewhere, your information is transferred there. Where the law requires a transfer safeguard, we provide one through our agreement with the customer.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account and membership | while the account exists; deleted on request or when the organization removes you, except what we must keep by law |
| Sign-in sessions | until the session ends or expires (rolling, up to 7 days of inactivity) |
| Meetings | until the organization deletes them |
| Recordings | until deleted, or until the configured retention period passes |
| Live call media, signaling and chat | not stored — only for the duration of the call |
| Operational logs | rotated automatically and kept only as long as needed for security and troubleshooting |
| Administrative audit trail | kept for security and accountability |
| Backups | a small number of recent backups (by default the last seven); deleted data disappears from backups as they rotate out |
9. Requests from authorities
We disclose information only when compelled by valid legal process. Where the information belongs to a customer organization, we refer the request to that organization unless the law prohibits it, and we disclose no more than required.
10. Your rights
Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, to object to or restrict some uses, and to complain to a data-protection authority. Write to privacy@icall.tel. We answer within the time the law requires and will not treat you differently for asking. Where your request concerns an organization's content, we will forward it to that organization, which decides.
11. Security
We protect information with encryption in transit (TLS, DTLS-SRTP), encryption of stored credentials and secrets, one-way hashing of passwords, two-factor authentication, role-based access controls, rate limiting, and an audit trail of administrative actions. If a breach affects your information, we notify the affected customer — and you, where the law requires — without undue delay.
12. Children
The service is for business use by adults. It is not directed to children, and accounts may not be created for anyone under 18.
13. Changes
We publish every change here with a new version number and date. If a change materially affects how we use information already collected, we tell customers in advance.
14. Contact
the iCall.tel operating company · registered address available on request · privacy@icall.tel
Security issues: security@icall.tel (see also /.well-known/security.txt).