Vandale Solutions Back to site

Privacy Policy

Last updated: 2026-10-16

This Privacy Policy explains how Exclusive Recipe Unipessoal Lda ("Vandale Solutions", "we", "us") collects, uses, and protects your personal data when you use our website and services. We are the data controller responsible for your personal data. If you have questions, contact us at info@vandalesolutions.com.

1. Information we collect

We collect the following personal data:

  • Call bookings. When you book a call through the calendar on our site: your name, email address, phone number, and, if you provide them, your company name and a note. The calendar is provided by Cal.com (see Section 3). After you book, our confirmation page shows your name and call time, kept briefly in your browser's session storage (see our Cookie Policy); we do not store them from that page. If you tick the text-message box on the booking form, we also record that choice, the number you gave, and the texts we send you about that booking.
  • Client records. If you become a client: the business and contact details needed to deliver the service under our written agreement with you, and billing details processed by our payment provider.
  • Onboarding records. If you buy the Call Recovery System, the answers you give on your private onboarding page, when you book the setup call, and on the setup call: your business details, service area, hours, main phone line and carrier, where alerts should go, and the name, email address and phone number of each person you designate to receive urgent-call alerts, together with your confirmation that they agreed to receive those alerts by email and by automated phone call. If you were named as an alert contact by a client, this is how we got your email address and phone number; the client is responsible for the alerts you receive, and we set them up on the client's instructions. To stop them, ask the client or email us at info@vandalesolutions.com.
  • Call Recovery System call data. If you are a client of The Call Recovery System: recordings, transcripts, and extracted lead details of calls your AI receptionist answers. Recordings and full transcripts stay in your own phone-platform workspace. After each call, the call's details and transcript pass through our automation server so we can send your alerts and log the lead. We process this data on your behalf, as your processor, only to deliver and improve your service, as described in our Service Terms and their Annex A. If you called a business that uses our service, see Section 10.
  • Prospect contact details. If we identified your business as a potential fit for our services: your business name and publicly listed contact details (contact name, role, business phone number, and email), plus notes about the public source we found them in, all collected from public sources such as job boards, your business website, business directories, and public contractor licensing registries. For businesses we write to or are considering writing to, we may also note public facts about the business from its Google listing and its own website: its rating and review count, its opening hours, any response time its website promises, the marketing and call-tracking tools its website loads, its logo, and short excerpts (up to 40 words, without the reviewer's name, phone numbers or emails) of public Google reviews that mention trouble reaching the business by phone. We use these to personalise our outreach, the missed-call report and the sample call described below. We also count them together across all the businesses in our lead database to publish anonymous statistics about the trades we serve, for example how many websites promise a response time. Those statistics never name or identify a business or a person. We also keep a record of our contact history with you: dates, outcomes, and any do-not-contact request, which we honor permanently.
  • Missed-call report links. If you ask for our missed-call report, we send you a link that is unique to your business. Each time it is opened, we record the date and time against your prospect record so we know it was read. We set no cookie and do not add your IP address to your prospect record; it is held briefly in memory to limit abuse, and our hosting provider's request logs hold it briefly.
  • Sample-call links. If you reply to our email with interest, we may make a short sample call for your business: AI-generated voices read a script that uses your business name, city, trade and, if we have it, the owner's first name, and the page shows your logo taken from your own public website (or your initial if we cannot find one). The caller, address and phone number in the sample are fictional. The page is reachable only through the link we send you. Each time the link is opened, we record the date and time against your prospect record. If you press play on the sample, we also record the first time you did so (date and time only). We set no cookie and do not add your IP address to your prospect record; it is held briefly in memory to limit abuse, and our hosting provider's request logs hold it briefly. The sample is kept with your prospect record for the period in Section 4 and deleted at once if you object.
  • Demo-line calls. If you call our demo phone number, the call is answered by our demo AI receptionist on a recorded line: the recording, transcript, and the number you called from are kept for up to 30 days and then deleted.
  • Discovery-call recordings. If you book a call with us, an AI note taker joins the video call to record and transcribe it for our notes and sales training. We say so at the start of the call and remove it if you prefer. This covers the recording, the transcript, and a written summary.
  • Technical data. Limited request metadata (such as your IP address) used transiently to rate-limit abuse and keep the service secure.

This website sets no cookies and runs no analytics. Apart from the short-lived technical data any web request involves (such as your IP address, held briefly in memory to limit abuse and in our hosting provider's request logs), browsing it leaves no personal data with us. We only receive data you actively send, through the booking calendar, the private onboarding page we send clients after checkout, or by email, with two exceptions: opening a personal missed-call report link or a personal sample-call link, and first pressing play on a personal sample call, records the date and time against your prospect record, as described above. The demo call recordings on our public pages are our own recordings of our demo agent; playing them collects nothing from you.

2. How and why we use it (legal bases)

  • To respond to your enquiry and provide our services: performance of a contract or steps taken at your request prior to a contract.
  • To schedule and manage the call you booked, including confirmation and reminder emails and, if you agreed on the booking form, up to three text messages about that booking (a confirmation, one reminder before the call, and one reschedule text if we miss each other): steps taken at your request before a contract and our legitimate interest in running the meetings you book with us. We never use these texts for marketing. Message and data rates may apply. Reply STOP to any text and we stop all texts to that number immediately, sending at most one message confirming your opt-out; any other clear request to stop works too. Reply HELP, or email us, for help. Mobile carriers are not liable for delayed or undelivered messages.
  • To contact businesses that may benefit from our services (B2B outreach by phone or email using publicly available business contact details): our legitimate interest in marketing our services to businesses. You can object at any time: one reply or one sentence on a call ("stop", "unsubscribe", "take me off your list") and we add you to our internal do-not-contact list and stop.
  • To answer your reply to our email, including making the sample call described above: our legitimate interest in responding to your interest in our services.
  • To secure the service and prevent abuse (e.g. rate limiting): our legitimate interests.
  • To comply with legal obligations where applicable: legal obligation.
  • To deliver the Call Recovery System to a client, keep its account and billing records, and set up the alerts it asks for: performance of our contract with the client; for the client's staff and the alert contacts named to us, our and the client's legitimate interest in running the service the client bought.
  • To keep accounting, tax and commercial records for as long as Portuguese law requires: legal obligation.
  • To answer and record calls to our demo line so callers can hear how the receptionist works: our legitimate interest in demonstrating our service to people who call to try it.
  • To record and transcribe discovery calls booked with us: our legitimate interest in keeping accurate notes and improving our calls. Tell us at the start or at any time and we remove the note taker.
  • To log when a personal missed-call report or sample-call link is opened or first played: our legitimate interest in knowing whether what we sent you was read, to plan our follow-up.
  • Whether you must give us data, and automated decisions. Giving us your details is your choice, but we need contact details to book a call, and a client's business and billing details to provide the service. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. AI tools help us classify public review text, draft outreach, read your replies to our emails and draft or send our answers (some answers are sent by our AI assistant without a person reviewing them first; ask in any reply and we will tell you, and a person takes over), and run our clients' receptionists; none of that produces such effects on you.

We do not sell your personal data, and we do not use it for advertising profiling.

3. Who we share it with

We share data with the service providers ("processors") below that help us run the service, under appropriate data-processing terms, and with the other recipients listed after them:

  • n8n (self-hosted): workflow automation that receives the booking notification from Cal.com and the answers from a client's onboarding page, stores them in our internal client-relationship database (hosted on the same self-hosted infrastructure), and triggers our notification and reminder emails. It also runs our clients' Call Recovery System automations: it receives each call's details from the client's phone platform, sends the client's lead and urgent-call alerts, and logs the lead. It keeps no record of runs that succeed; records of failed runs, which can include the call details and transcript, are deleted automatically after 14 days.
  • Hostinger: the server provider hosting our self-hosted automation and database infrastructure, on servers located in the EU.
  • Google Workspace: our business email (including outreach, confirmation, and notification emails, and the lead and urgent-call alert emails we send to clients), calendar invitations, and the spreadsheets where we keep prospect and lead records.
  • Vercel: hosting of this website.
  • Lead research providers (currently Outscraper and Consulti) that supply public business listing, review and website data, and Anthropic, whose AI model classifies public review text, drafts outreach lines, and reads replies to our emails to draft or send our answers.
  • fal.ai: generates the AI voices for sample calls, using the voice models it runs (currently ElevenLabs). It receives only the sample script, which may include your business name, city and first name, under its data processing addendum; servers in the US.
  • Cold-email delivery platforms (currently Instantly and the email-verification service Reoon): used to send our business-outreach emails and to verify that a publicly listed business email address is deliverable before we write to it.
  • Cal.com: scheduling. The booking calendar on our site is Cal.com's; the details you enter there (name, email, phone, company, and any note) are processed by Cal.com under its own privacy policy, and it sends the confirmation with the Google Meet link.
  • Quo: the US business phone and text-messaging provider we send booking texts from. It processes your number and the message content as our processor; servers in the US.
  • Fathom: the AI note taker on booked discovery calls. It records, transcribes, and summarises the call under a data processing agreement, with model training on our data switched off; servers in the US, covered by its Data Privacy Framework certification.
  • Stripe: payment processing for client subscriptions. Stripe processes billing details under its own privacy policy.
  • The AI phone platform (for Call Recovery System clients): client receptionists run on a phone-AI platform workspace that we create and the client holds as its Admin, under its own agreement with the platform, and pays for directly. Call recordings, transcripts and post-call data are stored there with the retention window set out in our Service Terms (90 days by default). The call details are also passed to our automation server and lead database above.
  • Professional advisers and authorities: our lawyers, accountants and auditors, under confidentiality; and courts or authorities where the law requires it, or where needed to establish, exercise or defend legal claims.
  • Business transfer: if we sell or reorganize our business, the buyer or successor, which must keep to this policy.
  • Links and embedded services: our site links to, and embeds, services run by others (such as the Cal.com booking calendar). Their own privacy policies apply to what they collect.

We do not sell or share your mobile number or your text-message opt-in data with third parties or affiliates for their marketing purposes. Your number is shared only with Quo and the mobile carriers, as needed to deliver the texts you agreed to.

Some providers (including Google, Vercel, Cal.com, Quo, Anthropic, and fal.ai) are headquartered outside the EEA. Where personal data is transferred outside the EEA, transfers are protected by the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) approved by the European Commission, or another appropriate safeguard under GDPR, as applicable to each provider.

4. How long we keep it

We keep enquiries from visitors who did not become clients for up to 2 years from the date of submission, then delete or anonymise them. Prospect/outreach data is kept for up to 12 months after our last interaction, or removed immediately if you object. Demo-line call recordings are kept for up to 30 days. Discovery-call recordings and transcripts are deleted within 90 days; the written summary is kept with your prospect record for the same 12 months. Your text-message choice on the booking form, our text-message logs, and any opt-out (date and wording) are kept for 5 years so we can show what you agreed to and keep honoring your opt-out; the do-not-contact entry itself is kept for as long as needed to honor it. Client account and project data is retained for 10 years from the end of our engagement, in line with Portuguese commercial and tax record-keeping obligations. That 10-year period applies to our own account and billing records. Our clients' callers' details, including any still held in records of failed automation runs, are deleted within 30 days after that client's service ends, as Annex A of our Service Terms says, unless the client asks for an export first. Records of failed automation runs are deleted after 14 days in any case. Onboarding records, including a designated alert contact's name and email address and the client's confirmation of their agreement, are kept for the term of the service and 4 years after it ends; a replaced alert contact's email address is deleted within 30 days of the change, keeping only the record of what was agreed and when. You may request earlier deletion of your data at any time (see Your Rights below) unless retention is required by law.

5. Your rights

Under the GDPR you have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent where processing is based on consent. For text messages, replying STOP is enough. We extend these rights to everyone whose data we hold, wherever you live, including visitors from the United States. To exercise any of these rights, email info@vandalesolutions.com. We will respond within one month. You also have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

US state privacy laws. We don't sell or share personal information (as California and other US state laws define those words), don't use it for targeted advertising, and don't profile people in ways that produce legal or similarly significant effects. Wherever you live in the US, you can ask us what we hold about you, for a copy, for a correction, or for deletion, by emailing info@vandalesolutions.com. We verify the request using information we already have (usually by replying to the email address on our records), answer within one month, and won't treat you differently for asking. If we refuse, you can appeal by replying to our answer, and we respond within 45 days; if you're still unhappy, you can contact your state attorney general. An authorized agent may ask for you with your signed permission.

6. Cookies

This website does not set any cookies. See our Cookie Policy for details.

7. Data security

We protect your data with measures including encryption in transit (HTTPS), access controls, and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your data and review our practices regularly. If a breach puts your personal data at risk, we tell the CNPD and you where the law requires.

8. Children and age

Our services are intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently done so, please contact us and we will delete the data promptly.

9. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the "Last updated" date above. If we make a material change, we also email our clients before it takes effect.

10. If you called a business that uses our service

Some home-service businesses use our Call Recovery System to answer their calls. If you called one of them, an AI receptionist answered on a recorded line, as its greeting said. That business decides how your call information is used and is responsible for it (it is the "controller"); we handle it only on the business's behalf (as its "processor"), to pass your details and request to the business and to run its line. The recording and full transcript are kept in the business's own phone-platform workspace, by default for 90 days. The details you gave (such as your name, number, address and what you need) pass through our automation server, are sent to the business by email (and, if you report an emergency, by an automated phone call to the person it named for urgent calls), and are kept in our database for that business until it stops using our service, then deleted within 30 days. If an automated step fails, its record, which can include your details and the transcript, is kept up to 14 days so we can fix it, then deleted. We don't use your call to market to you, we don't sell it, and we don't train AI on it. To ask about, correct or delete your information, contact the business you called; if you contact us instead, we pass your request to the business.

11. Contact

Exclusive Recipe Unipessoal Lda
Beco da Areia, nº 25, Birre, 2750-053 Birre, Portugal
info@vandalesolutions.com