Legal

Privacy policy

Nicra processes phone conversations, chat conversations and booking data on behalf of its clients. This policy describes exactly what is collected, why, and for how long it is kept.

Last updated: October 2026
Contact: contact@nicra.ch

Who is responsible for the data

Responsibility for callers’ data lies with the business that uses Nicra – the practice, salon or studio. Nicra processes that data on the business’s instructions, as a processor, and does not use it for any other purpose.

What data is collected

The caller’s phone number, the recording and transcript of the call, a short summary of the conversation, chat messages, messages received through connected channels (WhatsApp, email, Instagram) together with the sender’s identifier (phone number, email address or Instagram ID), details of the booked appointment (name, phone number, email if the customer leaves one, service, time) and technical call data such as duration and time of the call. For a booking, the agent and the chatbot ask only for what is needed, but the recording and transcript contain everything said in the conversation.

Notice of recording

At the start of the conversation, the agent states that the conversation is being recorded and, for businesses in Croatia as an EU member state, that it is an automated assistant. It does not answer untruthfully when asked whether it is a person. The caller may ask to speak to a person: the agent transfers the call to the business or takes a number so someone calls back.

Where data is stored

Nicra’s database and server functions are located in the European Union (Supabase, Frankfurt, Germany), and the website and dashboard run on servers in Switzerland (Infomaniak), which also send our emails. Speech, language models and voice in calls are processed by Retell AI, OpenAI, Microsoft Azure and ElevenLabs, on servers in the US and the EU, and chat messages by Anthropic, in the US. WhatsApp and Instagram messages are carried by Meta (Meta Platforms Ireland Ltd.), and emails in the Email channel are received and sent by Resend (Resend, Inc., US). Call recordings are stored by Retell AI. Where data is transferred outside the EU/EEA and Switzerland, the transfer relies on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. The full list of suppliers and what each one does is in the Data Processing Agreement. The contact and demo, partner application, waitlist, sign-up, login and password reset forms are protected by Cloudflare Turnstile (Cloudflare, Inc.), which processes your IP address and browser data to stop bots; the legal basis is our legitimate interest in preventing abuse (GDPR Art. 6(1)(f), Serbian ZZPL Art. 12(1)(6), Swiss FADP).

Retention period

We keep call recordings and transcripts and chat messages for 90 days and then delete them, both on our side and at our voice provider. Within the same period we also delete the short call summary if it contains personal data. The time, length and outcome of a conversation are kept for billing minutes. Appointment data is kept for as long as the business relationship with the client continues.

Free trial protection

To keep the free trial to one per account and per email address, when you open a business we keep a fingerprint (an HMAC made with a secret key) of your confirmed email address and of the network (IP address), and when you enter the business’s tax number, website or Google Maps link, a fingerprint of those too. A phone number you confirm is kept as the business’s contact for as long as the business exists and, as a fingerprint, for trial protection; numbers you only type in (the business phone, the transfer number) are not used for this. We do not use cookies or anything else stored on your device for this purpose. A fingerprint is pseudonymised data: without the secret key, which we keep separately from the database, the data cannot be read from it, and our staff only see which kind of data matched. We refuse a trial automatically only when the same account already had a trial (with no time limit), the same confirmed email address had one in the last 13 months, or another business that had a trial entered the same tax number with a valid check digit first (while that business exists, otherwise for 13 months from its trial); a tax number entered during a trial ends it only if the other business entered it first. The same confirmed phone number only holds back the remaining minutes until a review, and the website, Google Maps link, network and a tax number that fails the check-digit test are used only to flag a trial for a person to look at. Your account, business and data stay in every case, and you can choose a package right away. You confirm the number with a WhatsApp message (Meta Platforms Ireland Ltd.) or manually through support; the check that you are not a robot is done by Cloudflare Turnstile (Cloudflare, Inc.), which sees your IP address and browser data in the process. Where data is transferred outside the EU/EEA, the transfer relies on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. The legal basis is our legitimate interest in preventing abuse (GDPR Art. 6(1)(f), Serbian ZZPL Art. 12(1)(6), Swiss FADP). Fingerprints and the tax number in the trial record are deleted 13 months after the trial started and are kept until then even if you delete your account or business; the network fingerprint is deleted after 30 days. That an account already had a trial is remembered for as long as the account exists. To object, or to have a person review a decision, use the “Request a review” button in the dashboard or write to contact@nicra.ch.

Your rights

You have the right to request access to, rectification, erasure and portability of your data. Requests should be sent to the business that uses Nicra, or to us at contact@nicra.ch, and we will forward them to the party responsible.

Cookies

Without asking, we only use cookies the site cannot work without: one that keeps you logged in, one that remembers which business account you are working in, one that remembers the language you chose, and one that remembers your cookie choice (6 months). Only if you allow it, the nicra_ref cookie remembers for 90 days the partner who referred you, so they get a commission if you open an account; the legal basis is your consent, which you can withdraw at any time. Accessibility settings and the fact that you closed the waitlist window are stored only on your device and are never sent to us. We do not use Google Analytics, we have no Facebook pixel, and we do not track you across other websites. You can change your choice under “Cookie settings” at the bottom of every page.

Sensitive data

The agent does not ask about a diagnosis or symptoms: for an appointment it asks only for the name, phone number, service and time. If a caller mentions health data themselves, it stays in the recording and transcript until they are deleted, 90 days after the conversation. We conclude a data processing agreement with healthcare providers.

This document is a working draft and will be supplemented following a legal review before any contracts are signed with clients. In the meantime, please send any questions to contact@nicra.ch.