Data Processing
Last updated: July 30, 2026
Roles
For the calls your customers make to your line, you are the controller and Aslan AI Systems LLC is your processor: we act on your documented instructions, which are the business rules, hours, services, and escalation policy you configure. For your own account and billing data we are the controller.
What happens during a call
The call reaches our telephony provider and the audio is passed to our backend, where speech is recognised, the conversation is handled by an AI provider under your configured business rules, and the reply is spoken back. Availability checks and bookings go to your Google Calendar over the token you granted. Where the business has enabled recording, the telephony provider stores the recording and we keep only the reference to it. The providers behind each of these steps are named in the Privacy Policy.
Where data is processed
The backend and database run in the United States. Each tenant's rows are isolated at the database level with row-level security. Some providers may process data in other regions under their own terms; we will name the region on request.
Callers
Before any conversation is processed the assistant announces that the caller is speaking with an automated assistant and, where recording is enabled, that the call may be recorded. Recordings and transcripts follow the retention windows in the Privacy Policy.
Sub-processors
Twilio, Google LLC, OpenAI, Microsoft Azure, Stripe, Neon, Resend, and Vercel. Each one's role is described in the Privacy Policy. We announce material changes to this list before they take effect.
Security
Data is encrypted in transit and at rest by our providers. Tenant isolation is enforced with PostgreSQL row-level security, admin actions require a separate credential, and deletion runs through an audited job rather than manual database access.
Requests and deletion
Business owners can export or delete account data from the portal. Deletion removes the tenant's records and schedules provider-side deletion of any recordings; provider backups, legal holds, and statutory retention windows still apply. Callers should contact the business they called, or write to info@leoanswers.com and we will route the request. We verify identity before acting.