---
id: legal-overview
title: Legal & compliance overview
slug: /legal
description: Which legal documents govern your use of Chatley, which obligations sit with you as the caller, and where each one lives.
---

Chatley places and receives real telephone calls on your behalf, records and
transcribes them, and processes personal data belonging to the people your
agents speak to. That puts three separate bodies of obligation in play, and they
do not all sit with the same party.

## The binding documents

These live on chatley.ai and are the authoritative versions. Nothing in this
documentation overrides them.

| Document | Covers | Last updated |
| --- | --- | --- |
| [Privacy Policy](https://chatley.ai/privacy-policy) | What personal data is collected, how it is used and shared, retention, and your rights | 15 April 2026 |
| [Terms of Service](https://chatley.ai/terms-of-service) | The contract for using Chatley | 15 April 2026 |
| [Partner Terms](https://chatley.ai/partner-terms) | The reseller and [partner program](../partner/overview.md) | 15 April 2026 |
| [HIPAA](https://chatley.ai/hipaa-compliance) · [PCI](https://chatley.ai/pci-compliance) | Regulated-data positions | 15 April 2026 |

## Who is responsible for what

| Area | Chatley's responsibility | Your responsibility |
| --- | --- | --- |
| Platform security and availability | Operating the service, protecting data in transit and at rest | Securing your account, keys, and team access |
| Personal data | Processing it on your instructions | Deciding what is collected and why |
| Call recording consent | Providing the controls | Obtaining consent where the law requires it |
| Outbound calling law (TCPA, DNC) | Providing DNC tooling and attestation | Having a lawful basis to call each number |
| AI disclosure | Providing the ability to disclose | Disclosing that the caller is speaking to an AI |

The Privacy Policy states this directly for voice: by using the voice features
you represent and warrant that you have obtained the consents required to
record and process those conversations. You remain the caller.

## Guidance in this section

- **[Call recording & consent](./call-recording.md)** — the obligation most often missed
- **[Security](../security.md)** — account, key, and recording hygiene

## Supplementary Policies & Technical Governance

- **[Acceptable Use Policy](./acceptable-use.md)** — Sets platform boundaries, calling standards, and prohibited use cases
- **[Data Processing Addendum](./dpa.md)** — Standard GDPR / UK GDPR processor terms (available for Enterprise accounts)
- **[Subprocessors](./subprocessors.md)** — Production infrastructure vendors and subprocessor register

:::info[Operating Entity]
All contracts and policies—including the Privacy Policy, Terms of Service, Partner Terms, HIPAA and PCI compliance disclosures—are operated under the single legal entity **Chatley AI, Inc., a Delaware corporation**.
:::

## Obligations that apply to you specifically

:::note[The ones an AI voice product makes easy to overlook]
- **Two-party consent recording.** Some jurisdictions require *every* party to
  consent before a call is recorded. Calls that cross a border take the stricter rule.
- **AI disclosure.** A growing set of jurisdictions require a caller to be told
  they are speaking with an artificial voice, in some cases at the start of the call.
- **TCPA and Do Not Call.** Prior express consent, calling-hour windows, and DNC
  scrubbing apply whether a human or an agent places the call.
- **Deletion requests.** A caller asking for their recording to be deleted
  reaches you, and you action it in Chatley. Requests about Chatley's own
  handling go to security@chatley.ai.
:::