Recording and AI

You decide how Cohavo records and uses AI on your calls, and you’re responsible for telling your callers and staff. This page explains how it works and gives you wording to adapt. It isn’t legal advice.

1. Call recording

• On by default. A new Cohavo server records inbound, outbound and internal calls. Admins can switch recording off or on for each team and each person, and phone menus can start or stop recording at any step.
• No announcement unless you switch it on. Cohavo doesn’t tell callers that calls are recorded until you set it up: switch on Announce in your phone menu’s Recording step and callers hear “This call may be recorded.” before recording starts. It only covers calls that go through that phone menu, so for other calls add your own wording to your greeting or have your team say it. See the sample wording below.
• Pausing. Agents can pause and resume a recording during a call, for example while a caller reads out card details. Each pause is logged.
• Where recordings are kept. In your own storage bucket in London. They’re played only through your server, after it checks the person has permission.
• Who can listen. Admins choose, by role, who can play recordings, listen in to live calls and export data. Team leads can listen in to live calls if their role allows it.
• How long they’re kept. Recordings, transcripts and AI call notes are deleted automatically after 180 days, or after the period you set in Company › Data & privacy. Deleting a recording also deletes its file, its transcript and its AI call notes. Call actions, call reviews and tickets made from a call keep their own copy of what the AI noted until they’re deleted.

2. Voicemail

• Off until switched on. Each person, or an admin, can switch on voicemail for that person. Then a call to their direct number or extension that they don’t answer (or one that reaches them while they’re on Do not disturb, Offline or on another call) can leave a message. Calls to a queue never go to a person’s voicemail.
• Recorded even when calls aren’t. A message is recorded whatever the person’s call recording setting, because the caller chooses to leave it after the greeting asks them to.
• The greeting. The standard greeting says the person’s first name and your company name (“You’ve reached Kit at Example Print…”). It’s made once by your text-to-speech supplier (OpenAI or ElevenLabs, the same as your phone menus). If it can’t be made, callers hear a recorded prompt instead.
• For a team. A phone menu’s Voicemail step can take a message for a person or for a team. A team’s message waits on the team’s list until someone takes it. Its greeting is the team’s standard one (“You’ve reached Sales at Example Print…”), a greeting you type for the step (read out by your text-to-speech supplier), an audio file, or none.
• Kept like a recording. In your own storage bucket in London, played only through your server: by the person it was left for (for a team’s message, the people in that team), and by the people who can play recordings. It’s deleted with recordings (180 days unless you change it in Company › Data & privacy), with its written-out words. A message shorter than 3 seconds isn’t kept.
• Where it shows. As a To do on Phone › Call actions for the person it was left for (or on the team’s list), and in their notifications. The To do keeps its own copy of the message’s words until it’s deleted, as call actions do.
• AI. With AI call notes, a message is written out by the same supplier as call recordings, and OpenAI gives it a one-line title from the words. It isn’t summarised, reviewed or counted in your reports.

3. Transcription and AI

AI is part of the Pro plan. It runs only on the calls of people with a Pro licence. A call taken by someone on a Basic licence is recorded as usual, but it isn’t transcribed and nothing from it goes to an AI supplier; the same goes for a voicemail message left for them. A company on the Team plan has none of this.

For calls taken by people with a Pro licence:

• Transcripts. Every recorded call is transcribed after it ends, by Deepgram unless ElevenLabs or OpenAI is chosen for your server.
• Call notes and follow-ups. OpenAI writes a summary, the caller’s mood, any points to look at, and suggested follow-ups from the transcript. It receives the transcript, the names and numbers on the call, and your business profile.
• Reports. Daily and weekly AI reports summarise calls by team and by person, including a rating for each person, using their call figures and working status.
• Call reviews. Calls the AI flags are put on a list for a person to review.

Call notes, follow-ups and reports are on by default on the Pro plan. Ask us to switch any of them off for your business. Anyone who can already open a call can read its notes.

Only if you switch them on or set them up:

• Live assist. A live transcript of the call (Deepgram) for the people you choose, with the caller’s details picked out on your own server.
• Voice agents. An AI agent that answers in your phone menu. Voice agents run on ElevenLabs, and their thinking is done by an OpenAI model we choose, through ElevenLabs. ElevenLabs gets the caller’s audio and what the agent needs to answer: its greeting, rules and instructions (including any business information you put in them), your business name and whether you’re open, your Business profile, and if you switch on Know the caller, the caller’s number and their name and company from your contacts. Voice agents answer from What it knows, the same websites and written answers as the website chat’s AI, unless you switch that off for an agent. It stays on your server: when a caller asks about your business, your server searches it and ElevenLabs gets only the few passages that match that question. To find them, the caller’s question goes to OpenAI with email addresses and phone numbers hidden. ElevenLabs keeps no audio of these calls. After each call your server copies the conversation and then deletes it at ElevenLabs, usually within minutes (30 days at most, if a deletion fails). Your server keeps the transcript, a summary and the details the agent collected (the caller’s name, why they called, a callback number and whether it was resolved) with the call’s history, for the period set for voice agent conversations in Company › Data & privacy (180 days unless you change it). The people who can see a call’s recordings can see them. Questions an agent couldn’t answer from What it knows are listed for you, with email addresses and phone numbers hidden, so you can add answers. Callers can ask for a person or press 0 at any time. When an agent passes a call on, the person who answers sees why in Cohavo: the agent’s reason and a one-line summary, such as the caller’s name and what they need. At the call’s time limit, the agent says it’s passing the caller to a person. Messages an agent takes go to your To do list in Cohavo. When someone on your team tests an agent with Try it, their voice and words go to ElevenLabs in the same way as a call. The test is deleted at ElevenLabs when it ends, and nothing of it is kept.
• Website chat AI. An AI assistant that answers your website chats first (OpenAI), from What it knows: your own website pages, the answers you write and your Business profile. Visitors’ questions are searched with email addresses and phone numbers hidden.
• Writing help. When someone presses Rewrite on an email, the draft and the customer’s three latest emails (with addresses and numbers hidden) go to OpenAI.

AI can be wrong. Summaries, ratings, flags and suggestions are prompts for a person, not decisions. Check them before you rely on them, and don’t use them on their own to make decisions about people, such as staff performance or employment.

Suppliers. These suppliers are in the USA. What each one keeps, for how long, and whether it may use data to improve its models is on our Subprocessors page. We never use your data to train AI models ourselves.

4. Before you switch on recording or AI: a checklist

1. Decide which teams, people and calls you record, and why.
2. Choose your lawful basis (below). If it’s legitimate interests, write down your assessment.
3. Check whether you need a data protection impact assessment. If you record or use AI at scale, or for sensitive calls, you probably do.
4. Add a notice to every recorded or AI-enabled number (sample wording below).
5. Update your website’s privacy notice.
6. Tell your staff in writing about recording, transcription, AI suggestions, listening in and reports.
7. Limit who can play recordings, listen in or export data.
8. Check how long recordings, transcripts and notes are kept (180 days unless you change it) and that it suits you.
9. Decide how you’ll handle sensitive information and card details (below).

5. Sample wording

Phone greeting, recording and AI: “Thanks for calling [business]. Calls are recorded and may be transcribed and summarised using AI, so we can help you and improve our service. You can find out more at [website]/privacy, or ask the person you speak to.”

Phone greeting, recording only: “Calls may be recorded for training and quality. Find out more at [website]/privacy.”

Voice agent: “Hello, you’re through to [business]’s automated assistant. I’m an AI and I can help with [tasks]. You can ask for a person or press 0 at any time.”

Outgoing calls: “Just so you know, this call is recorded and may be transcribed using AI.”

Your website’s privacy notice: “We use Cohavo to handle calls, emails and website chat. When you contact us, we record calls, keep the messages you send us, and may use AI tools to transcribe and summarise conversations and suggest next steps for our staff. We do this to help you, keep accurate records, train our team and improve our service (our legitimate interests). Recordings are kept for [period] and transcripts and summaries for [period]. Cohavo processes this information for us under contract, and some of its suppliers process it outside the UK under approved safeguards.”

Your staff: “We use Cohavo for calls, email and chat. Calls on [teams] are recorded. Recordings may be transcribed and summarised by AI, and you may see a live transcript during calls. Team leads can listen in to live calls for training, quality and to support you. Reports show, by team and person, call volumes and times and an AI rating of calls; and for email and website chat, how many each person handled, how quickly they replied, chats given to them that they didn’t reply to in time, and customers’ ratings. We won’t use AI output on its own to make decisions about your performance or employment: a manager will always review it. Recordings are kept for [period]. Ask [contact] about any of this, or to use your data protection rights.”

Where you monitor calls on your own phone system, the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 require you to make all reasonable efforts to tell the people using it.

6. Rules for voice agents and live assist

Every Cohavo voice agent is always instructed to: say it’s an AI; pass the caller to a person whenever they ask, and callers can also press 0 (connect each of the AI Agent step’s hand-off exits, and its Couldn’t connect exit, in your call flow to a queue or a person, so someone can answer); tell anyone who may be in danger to hang up and call 999 from another phone; give no legal, medical or financial advice; and never take card or bank details. You can add your own rules on top, but not remove these. AI can still get things wrong, so you’re still responsible for these rules:

• Say it’s AI. Voice agents must say at the start that they’re automated. Cohavo flags a greeting that doesn’t.
• A way to a person. Callers must be able to reach a person or leave a message at any time. If nobody is free, say what happens next.
• Urgent calls. If a caller may be in danger or have a medical emergency, the agent should stop, tell them to call 999 from another phone, and pass them to a person if one is free (see Emergency calls).
• No significant decisions. Voice agents and AI reports mustn’t make decisions with legal or similarly significant effects on a person (for example refusing a service) without meaningful human involvement and the safeguards the UK GDPR requires.
• Stay in scope. Keep each agent to the tasks you set. Don’t let it give legal, medical or financial advice.
• Test first. Use Try it and sample calls with different accents, background noise and requests for a person before going live.

7. Choosing a lawful basis

What	Usual basis	Notes
Recording calls to settle disputes, keep records and train staff	Legitimate interests	Write down your assessment, give a clear notice, and let callers raise objections.
Recording a regulator requires (for example some financial services)	Legal obligation	Check your sector’s rules.
AI transcripts and summaries for record-keeping	Legitimate interests	Consider accuracy and the suppliers outside the UK.
Voice agents answering calls	Legitimate interests, or contract when handling the caller’s request	Say it’s AI; offer a person.
Consent	Only if callers have a real choice you can honour (for example “press 2 not to be recorded”)	If refusing means you can’t help them, consent isn’t valid.

8. Sensitive information and card details

Callers may mention their health, religion, ethnicity or criminal matters without being asked. That’s special category data: you need an extra condition under data protection law to keep it. Consider not recording sensitive teams, keeping those recordings for a shorter time, and training staff not to ask for more than they need.

Card payments: don’t record card numbers or security codes. Pause the recording while a caller reads them out, or take payments on a separate line. Card industry rules (PCI DSS) forbid keeping security codes. Cohavo doesn’t remove card numbers from call transcripts, so a pause is the safeguard.