Skip to main content
Recepta.ai holds customer personal data on your behalf — names, phone numbers, addresses, call recordings, and transcripts. This page covers how that’s protected and what remains your responsibility.

​
Access control

Access is layered, so you can grant exactly what a person or system needs:
Every request — dashboard, API, or MCP — is scoped to one workspace. Data never crosses workspace boundaries.
Team members get standard or custom roles controlling what they can see and change. Recording and transcript access can be granted separately from general call access. See Team & roles.
Keys carry granular scopes — calls:read without calls:recording, for example. Give each integration its own key with the minimum it needs. See Authentication.
Multi-location workspaces can restrict staff to their own branch’s data. See Locations.

​
In transit and at rest

All API and dashboard traffic runs over HTTPS; plain HTTP is not accepted. API keys are stored hashed, not in plaintext, and are shown to you once at creation. Webhook payloads are signed so your endpoint can verify they came from Recepta.ai — see Webhooks.

​
What you’re responsible for

You are the data controller for your customers’ information. Recepta.ai processes it on your instructions.
Recording law, consent, and marketing rules are yours to comply with. See Recording & consent, SMS, and A2P 10DLC. Recepta.ai gives you the controls; it can’t make the calls lawful for you.
Practical obligations:
1

Disclose recording

Announce it on every call if you record. Assume the strictest applicable rule.
2

Capture and keep consent

For calling, texting, and emailing. Keep a record of where and when it was given — that’s what a carrier or regulator asks for.
3

Honor opt-outs and deletion requests

Suppression is automatic; a request to delete a record is something you action.
4

Publish terms and a privacy policy

Required by carriers for A2P approval, by payment providers, and by privacy law.
5

Manage access hygiene

Remove departed staff the same day, rotate API keys they created, and re-authorize integrations they owned.

​
Deletion and export

Contacts and call records can be deleted from the dashboard and over the API. Deletion is not reversible — restrict the permission accordingly. If a customer exercises a right to access or erasure, or you need a bulk export for migration, contact info@recepta.ai with the specifics.

​
Subprocessors

Recepta.ai relies on third-party providers for telephony, AI model inference, payments, and hosting. For the current subprocessor list, a DPA, or a security questionnaire, contact info@recepta.ai.

​
Reporting a vulnerability

Email info@recepta.ai with reproduction steps. Please don’t test against other customers’ workspaces or use live customer data in a proof of concept.