Privacy policy

Last Updated: September 5th, 2026

The website www.callstrike.ai (the “Website”), operated by CALLSTRIKE LTD (“Callstrike”, “we”, or “our”), a company incorporated in England and Wales (company number 16572896, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom), provides access to the Callstrike platform (the “Platform”), a solution designed to help organizations train employees and increase awareness of voice-based and message-based social engineering threats, including vishing, phishing and deepfake impersonation, by running simulated attacks against that organization's own personnel (the “Security Training Services”).

By accessing, browsing, or using the Website and the Callstrike Platform, you may provide personal data to Callstrike. The Platform also generates personal data about you when a simulation is delivered to you.

Please read this Privacy Policy carefully. It outlines how we collect, use, share, and protect your personal information, and explains your rights in relation to your data. This Privacy Policy supplements our Terms of Service and any other related agreements or notices referencing this policy.

If you have any questions or concerns, feel free to contact us at privacy@callstrike.ai.

1. WHO IS THE DATA CONTROLLER OF YOUR PERSONAL DATA?

When using the publicly available Website:

Callstrike acts as the data controller for any personal data collected and processed for the administrative, operational, and commercial management of the Website as its publisher.

When using the Callstrike Platform:

Your employer is the data controller for personal data collected and processed in connection with the Security Training Services they have subscribed to.

Callstrike acts as the data processor, processing personal data solely on behalf of and under the instructions of your employer, in accordance with the subscribed Security Training Services.

This includes simulations that use a synthetic voice, a synthetic video likeness, a telephone call, or a messaging channel. In every case your employer decides who is simulated, who is targeted, and on what lawful basis. Callstrike does not select targets, does not verify authorization, and acts on your employer's documented instructions.

2. WHAT KIND OF PERSONAL DATA ARE PROCESSED?

All personal data is either directly provided by your employer, you, or one of our external partners. Additional data is also generated through your use of, or your participation in, the Security Training Services, including but not limited to:

Note on call recording. Whether a simulated call is recorded is a decision your employer makes for each campaign. Recording is enabled by default and your employer can turn it off in the campaign's call settings. Where recording is turned off, neither the call audio nor the turn by turn transcript is retained; only a high-level summary of the call and the outcome appear in your employer's reports. Where a simulation asks you to call a number back, that call is always recorded and the per-campaign setting does not apply to it.

Note on voice, likeness and AI processing. A voice sample and the voice model derived from it can identify a specific person. Callstrike therefore handles them as biometric data and as a special category of personal data, and restricts them to the simulation your employer configured. Because your employer is the controller, your employer is responsible for identifying the condition under law that permits this processing and for obtaining any authorization required from the person whose voice or likeness is used. Under our Terms of Service your employer warrants that it has done so before launching a simulation.

Note on realtime voice and video impersonation sessions. Where your employer runs a realtime session, the voice or video conversion happens on a compute instance that is provisioned for that session and destroyed when it ends. The conversion model is a general purpose model that is not built from any individual's voice, and no model derived from your voice is created for these sessions.

To set the target voice, your employer either uploads an audio sample for that session only, in which case it is held on that instance and destroyed with it, or selects a previously saved voice, in which case the stored audio sample described in the table above is used. That stored sample is retained until your employer deletes it.

Where the session is recorded, the recording and its transcript are stored and follow the retention period in Section 7. Where a session joins a video meeting, other participants in that meeting may be recorded as part of it.

Note on AI and automated processing. Simulated conversations are conducted by an AI system, not by a human caller. During a simulated call, what you say is transcribed by a speech recognition provider and the transcript is passed to a large language model, which generates the simulated caller's replies in real time. Transcripts, summaries and outcome evaluations are produced by these AI systems. Content you submit to the Platform, including scenario and template text, may also be processed by a large language model in order to draft, translate or refine simulation material. These systems do not make decisions about you that have legal effect. The outcome of a simulation may contribute to an awareness score held by your employer; how your employer uses that score is your employer's decision.

The provision of certain types of personal data may be required or optional to fully access and utilize the Callstrike Platform and the Security Training Services subscribed to by your employer. Any mandatory data fields will be clearly identified at the point of collection.

If you choose not to provide mandatory information, Callstrike may be unable to process your request, such as creating your Callstrike account, delivering training services, or processing a job application.

3. FOR WHAT PURPOSES DOES CALLSTRIKE USE YOUR PERSONAL DATA?

When you are using the Callstrike Platform, Callstrike operates as the data processor (as indicated in Section 1 of this policy). Your personal data is processed solely for the following purposes:

At your employer's discretion, the Platform may deploy features powered by artificial intelligence to enhance the effectiveness of the security training services and strengthen user awareness around data protection and cyber threats. Section 2 describes how that processing works.

Callstrike does not use your personal data to train or improve any artificial intelligence model of its own. We may use aggregated, de-identified data that does not identify your employer or any individual to operate, secure and improve the Platform.

Whether the third party providers listed in Section 4 use data submitted to them for their own model training is governed by our contract with each provider, and those terms differ between providers. Where we can state the position contractually: Anthropic's terms prohibit training its models on customer content; OpenAI does not use data submitted through its API to train its models; and AssemblyAI's data processing agreement prohibits using the data for any purpose other than performing the service. If you need the position for a specific provider, write to privacy@callstrike.ai and we will tell you what our contract with that provider says.

4. WHO CAN ACCESS YOUR PERSONAL DATA?

4.1 Sub-processors

The following sub-processors are engaged by Callstrike to deliver the Website and the Security Training Services. Which of them process your data depends on which Security Training Services your employer has subscribed to.

Our sub-processors may engage their own sub-processors in order to provide their services to us. Where they do, they are required to do so under a written contract that passes on equivalent data protection obligations.

We may add or replace a sub-processor as the Platform develops. DigitalOcean is under evaluation as an additional provider of GPU compute for realtime synthetic voice and video sessions, and is not in use today.

An up to date list of sub-processors is available on request from privacy@callstrike.ai, and customers may ask us for advance notice of changes to it.

5. WHERE IS YOUR PERSONAL DATA TRANSFERRED?

Callstrike is established in the United Kingdom. The Platform application and its primary database are hosted in the European Union (Belgium). A number of the sub-processors listed in Section 4.1 are located outside the United Kingdom and the European Economic Area, principally in the United States. In particular, call recordings and other stored media are held in the United States and the European Union, and the speech recognition, language model and synthetic voice providers involved in a simulated call are located in the United States.

Transfers are made on the following basis:

• From the UK to the EEA: covered by the UK adequacy regulations for the EEA, so no additional transfer mechanism is required.
• From the UK to the United States and other third countries: the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, as applicable.
• From the EEA to third countries, where a customer is established in the EEA: the EU Standard Contractual Clauses.

These safeguards are contained in the data processing terms we have entered into with each sub-processor that receives personal data outside the United Kingdom and the European Economic Area.

You may request a copy of the safeguards in place for a given transfer, with commercial terms redacted, by writing to privacy@callstrike.ai. Where you are a member of a customer's personnel, that request may be routed through your employer as the controller.

6. HOW DOES CALLSTRIKE PROTECT YOUR PERSONAL DATA?

Callstrike has implemented technical and organizational measures to safeguard your personal data against accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure. The measures below are those in place today.

Encryption. The Website, the administrator console and the learner portal are served over HTTPS only, with plain HTTP requests redirected and HTTP Strict Transport Security enabled. Our API is available over HTTPS and all first party applications are configured to use it. Personal data is encrypted at rest: the primary database is encrypted using platform-managed keys, and stored media, including call recordings and voice samples, is encrypted server side using AES-256.

Access to stored media. The media store blocks all public access. Media is not directly readable from the internet; it is served only through our content delivery network, under a policy that permits read access to that single distribution and nothing else, and delivery is authenticated using signed URLs or signed cookies depending on the environment.

Authentication. Authentication is delegated to WorkOS AuthKit. Your employer may connect its own identity provider for single sign-on, in which case authentication happens against that provider and we never receive your password. Sessions use short-lived, cryptographically signed access tokens which are verified against the provider's public keys on every request and are refreshed automatically. Callstrike does not store passwords.

Separation between customers. Each customer's data is held in a separate workspace. The workspace a request may act on is derived from the verified access token rather than from anything the client can set, and every query that reads or writes customer data is scoped to that workspace. Administrators and learners authenticate through separate paths with separate permissions.

Secrets. Credentials for the Platform and for the third party services listed in Section 4.1 are held in a managed secrets service, are not stored in source code, and are not committed to our code repositories. An automated check compares the configuration of our staging and production environments on every change and fails if they diverge.

Audit trail. Administrative actions within a workspace are recorded in an append-only audit log. Each record captures who acted, what action was taken, on what, the outcome, when it happened, and the originating network address, user agent and request identifier. Records are chained together cryptographically per workspace, so that any later alteration or removal of a record is detectable. The chain is computed over the structural fields only and deliberately excludes personal data, so that an erasure request can redact the personal details from a record without destroying the evidence that the event occurred.

Change control. Our production and staging branches are protected: direct force-pushes are blocked, protections apply to administrators as well, and defined automated checks must pass before a change can be merged. Every proposed change is subject to an automated code review and a separate automated security review covering authentication, separation between customers, secret handling and injection risks. The backend test suite must pass before a change can be deployed.

Environment separation. We operate distinct local development, staging and production environments, and changes are promoted in that order. Development and staging are seeded with synthetic test data. Production personal data is not copied into development, staging or test environments.

Resilience. The production database runs in a highly available configuration replicated across zones, is backed up automatically each day, and supports point in time recovery. See Section 7 for how long backups are retained.

If you discover a vulnerability or wish to report a security incident, please contact us at security@callstrike.ai. We ask that you give us a reasonable opportunity to remediate before disclosing publicly.

8. DATA PROCESSING TERMS FOR CUSTOMERS

Where Callstrike acts as data processor, we process personal data only on the documented instructions of the customer as controller, under the agreement between Callstrike and that customer and as described in this policy. Where the Platform is purchased through a reseller or other intermediary, the controller is the organization that determines how the Platform is used against its own personnel.

Customers, and prospective customers under evaluation, can contact us at privacy@callstrike.ai to discuss the data protection terms that apply to their engagement, including the sub-processor list and notice of changes to it, the international transfer safeguards described in Section 5, assistance with data subject requests, security measures, breach notification, and the return or deletion of data at the end of the relationship.

9. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

When you are using the publicly available Callstrike Website and Callstrike acts as the data controller (as outlined in Section 1 of this policy), you may contact Callstrike directly regarding your personal data rights by emailing privacy@callstrike.ai.

When you are using the Callstrike Platform and Callstrike acts as the data processor (as outlined in Section 1), you should contact your employer directly to exercise your data protection rights. Callstrike will assist your employer in responding, under the data processing terms described in Section 8.

In accordance with applicable data protection regulations, you have the following rights concerning your personal data:

• Right of access: You may request access to your personal data, including clear and transparent information about how it is processed and your rights, as well as a copy of the data held.
• Right to rectification: You may request the correction of inaccurate, incomplete, or outdated personal data.
• Right to object: You may object to the processing of your data where it is based on legitimate interest, unless the controller demonstrates compelling legitimate grounds or the processing is required for legal claims or compliance.
• Right to restriction of processing: You may request the restriction of processing in the following cases:
  • You contest the accuracy of your data: restriction applies while verification is ongoing.
  • The processing is unlawful, and you prefer restriction over deletion.
  • The data is no longer needed by the controller, but you need it for legal claims.
  • You have objected to processing, and restriction applies while it is verified whether legitimate grounds override your rights.
• Right to withdraw consent: If processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of prior processing.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format and, where feasible, request transmission to another provider. This applies if:
  • The request relates only to your personal data.
  • It does not infringe on the rights or freedoms of the controller or others.
  • The processing is automated (i.e., not paper-based).
  • The processing is based on your consent or a contract (see Section 3 for details).
• Right to erasure ("right to be forgotten"): You may request deletion of your data when:
  • You object to processing and no overriding legitimate reason exists.
  • You withdraw consent on which processing was based.
  • The data is no longer necessary for the original purpose.
  • The use of your data does not comply with legal or regulatory obligations.

Where erasure is exercised through your employer, the Platform replaces your identifying details with a non-identifying placeholder and erases the associated recordings, transcripts and media it holds, while retaining the de-identified outcome record. A synthetic voice model is handled separately, as described in Section 7.

Depending on your country of residence, you may have additional rights under local data protection laws.

The availability of these rights depends on the legal basis under which your personal data is being processed, as outlined below:

In certain circumstances, we may request specific information to verify your identity and ensure that your rights are exercised securely. This is an appropriate safeguard to prevent unauthorized access to your personal data by individuals who are not entitled to receive it.

If needed, you also have the right to lodge a complaint with a data protection supervisory authority. Callstrike is established in the United Kingdom, so the relevant authority is the Information Commissioner's Office (ICO), whose complaints process is described at ico.org.uk. If you are located in the European Economic Area, you may instead lodge a complaint with the supervisory authority of your own country of residence or place of work. This right may be exercised at any time and free of charge, except for any postal or legal assistance costs should you choose to engage third-party support during the procedure.

10. CHANGES TO THIS POLICY

This privacy policy may be updated from time to time, particularly to reflect changes to the Website, the Security Training Services, our sub-processors, or applicable regulations. We therefore recommend reviewing this policy periodically, especially each time you use the Callstrike Website or Platform.