# P13 — Security, Privacy & Recording Compliance

**Updated:** 30 August 2026 · Legal facts web-verified 30 Aug 2026 (sources §6). We are not lawyers; per-market defaults below are conservative by design and the founder signs them off before pilot 1 (item O6). This document is written as a testable checklist — `TEST_PLAN.md` case 20 and the go-live gate reference it.

---

## 1. What data flows through this service

Call audio (transient, platform-processed) · transcripts · caller PII (name, phone, and vertical-sensitive details — clinic calls can contain health information) · booking data · client business knowledge · client credentials (calendar, CRM, WhatsApp). The platform (Retell/Vapi-class) and its sub-processors (STT/LLM/TTS providers) process call content by necessity — this is disclosed to clients in the pilot agreement in plain words.

## 2. Recording & consent — per-market rules (the strictest-law principle)

| Market | Law (verified 30 Aug 2026) | **Our binding default** |
|---|---|---|
| **UAE** | ALL-party consent; Federal Decree-Law 34/2021; violations up to AED 500,000 + up to 2 years imprisonment; applies equally to VoIP | **Audio recording OFF. Transcript-only QA.** Greeting still identifies the assistant. No exceptions without written legal advice |
| **US** | Federal: one-party. **12+ states two-party/all-party** (incl. CA, FL, PA, WA…); cross-state calls follow the stricter law; some states additionally require AI-disclosure | **Treat every US client as two-party:** greeting includes "this call may be recorded" + identifies itself as an AI assistant. One greeting standard for all states — no per-state cleverness |
| **Bangladesh** | Two-party consent posture under Digital Security Act 2018 + Personal Data Protection Ordinance (gazetted Nov 2025) **[verify PDPO enforcement rules before scale — new law, practice unsettled]** | Greeting discloses assistant + recording; recording ON only with client's written acknowledgment; transcript-only offered as the cautious option |
| **KSA/Gulf other** | Not yet researched to citation level — **gap, logged honestly** | No recording until researched per-country; transcript-only |

**Greeting line standard (all markets):** business name + "…this is the automated assistant" + recording/monitoring disclosure where recording or transcript QA is on. The QA script verifies it on every call (global expected, `TEST_PLAN.md`).

## 3. Credentials vault

All client secrets in the team password vault under `p13/<client_id>/<system>` — platform API keys, calendar OAuth, CRM webhook tokens, WhatsApp Business access · founder + one named backup have access; per-client sharing never happens over chat/email · **no credentials or PII inside prompt text or knowledge packs** (prompts are semi-portable files that travel — treat them as public) · platform accounts: unique passwords + 2FA · client-side: we request least-privilege (a calendar we can write events to, not their whole Google account, where scoping allows).

## 4. Data handling rules

1. Lead payloads (`API_CONTRACT.md` §3) go only to destinations the client designated in writing.
2. Recordings (where lawful) delivered by expiring link, never email attachments.
3. Clinic clients: transcripts treated as health-adjacent — no forwarding into group chats, no marketing reuse; US healthcare clients get an explicit "we are not presenting this as a HIPAA-covered service at pilot" line in the agreement **[verify: revisit BAA options with the platform before signing any US clinic — Retell/Vapi enterprise tiers advertise HIPAA postures; pilot default is DON'T sign US medical clients until checked]**.
4. Marketing use of any real call/recording requires written client consent (`MARKETING.md` §3).
5. No call content pasted into ad-hoc AI chats for debugging; QA happens inside the platform dashboard.

## 5. Retention

| Data | Default retention |
|---|---|
| Audio (where on) | Platform minimum; purge ≤ 90 days unless client requests longer in writing |
| Transcripts | 12 months (QA + dispute trail), then delete |
| Lead/booking data | Client's property, lives in THEIR systems from day 1 — we hold only the delivery pipeline copies ≤ 30 days |
| After cancellation | Export offered; our copies purged ≤ 30 days post-offboarding; vault entries deleted; platform workspace archived then removed |

## 6. Testable checklist (walked at go-live gate + quarterly)

☐ Greeting contains assistant-identification + market-correct disclosure (heard on a live call) · ☐ Market recording policy matches §2 table in the platform settings (screenshot filed) · ☐ UAE/Gulf client: audio storage verified OFF · ☐ All client secrets present in vault, none in prompts/chats (search the prompt pack for tokens) · ☐ 2FA on platform account · ☐ Lead destination = the one in the signed intake · ☐ Retention timers noted in client runbook · ☐ Owner received the plain-language privacy one-pager · ☐ (Clinic) forbidden-topics + emergency wording passed QA cases 13 · ☐ O6 sign-off recorded for this market.

## 7. Sources

recordinglaw.com/world-laws/world-recording-laws/uae-recording-laws/ (UAE all-party, penalties) · dubailawyers.com/blog/recording-phone-calls-in-uae/ · frejun.com/call-recording-laws-uae/ · avoma.com/blog/call-recording-laws (US two-party states) · en.wikipedia.org/wiki/Telephone_call_recording_laws · frejun.com country guide + exporb.com 2026 global guide (Bangladesh DSA 2018 / PDPO Nov 2025). All accessed 30 Aug 2026.