Legal & compliance overview
Which legal documents govern your use of Chatley, which obligations sit with you as the caller, and where each one lives.
Chatley places and receives real telephone calls on your behalf, records and transcribes them, and processes personal data belonging to the people your agents speak to. That puts three separate bodies of obligation in play, and they do not all sit with the same party.
The binding documents
These live on chatley.ai and are the authoritative versions. Nothing in this documentation overrides them.
| Document | Covers | Last updated |
|---|---|---|
| Privacy Policy | What personal data is collected, how it is used and shared, retention, and your rights | 15 April 2026 |
| Terms of Service | The contract for using Chatley | 15 April 2026 |
| Partner Terms | The reseller and partner program | 15 April 2026 |
| HIPAA · PCI | Regulated-data positions | 15 April 2026 |
Who is responsible for what
| Area | Chatley's responsibility | Your responsibility |
|---|---|---|
| Platform security and availability | Operating the service, protecting data in transit and at rest | Securing your account, keys, and team access |
| Personal data | Processing it on your instructions | Deciding what is collected and why |
| Call recording consent | Providing the controls | Obtaining consent where the law requires it |
| Outbound calling law (TCPA, DNC) | Providing DNC tooling and attestation | Having a lawful basis to call each number |
| AI disclosure | Providing the ability to disclose | Disclosing that the caller is speaking to an AI |
The Privacy Policy states this directly for voice: by using the voice features you represent and warrant that you have obtained the consents required to record and process those conversations. You remain the caller.
Guidance in this section
- Call recording & consent — the obligation most often missed
- Security — account, key, and recording hygiene
Supplementary Policies & Technical Governance
- Acceptable Use Policy — Sets platform boundaries, calling standards, and prohibited use cases
- Data Processing Addendum — Standard GDPR / UK GDPR processor terms (available for Enterprise accounts)
- Subprocessors — Production infrastructure vendors and subprocessor register
All contracts and policies—including the Privacy Policy, Terms of Service, Partner Terms, HIPAA and PCI compliance disclosures—are operated under the single legal entity Chatley AI, Inc., a Delaware corporation.
Obligations that apply to you specifically
- Two-party consent recording. Some jurisdictions require every party to consent before a call is recorded. Calls that cross a border take the stricter rule.
- AI disclosure. A growing set of jurisdictions require a caller to be told they are speaking with an artificial voice, in some cases at the start of the call.
- TCPA and Do Not Call. Prior express consent, calling-hour windows, and DNC scrubbing apply whether a human or an agent places the call.
- Deletion requests. A caller asking for their recording to be deleted reaches you, and you action it in Chatley. Requests about Chatley's own handling go to security@chatley.ai.