Privacy Policy

Version 1.0 · effective 2 November 2026 · Controller: Digital Trend AS

Digital Trend AS, Holsbergstien 64, 5918 Frekhaug, Norway, operates ApiSIM. This policy explains what personal data we process, why, for how long, and your rights. Questions and requests: support@apisim.app.

Two roles

For your account, billing, support and our website we are the controller. For the content that flows through your workspace, such as messages, call records, recordings and transcripts about your customers, you are the controller and we are your processor, acting on your instructions under the Data Processing Agreement below.

Data we process as controller

• Account data: name of the workspace, e-mail address, password hash, sign-in events.
• Billing data: plan, invoices and payment status. Card details are handled by Stripe, never by us.
• Device data: the name you give a paired phone, its reported capabilities and connection status.
• Usage and security logs: API requests, IP addresses, error diagnostics, kept to operate and protect the Service.
• Support correspondence you send us.

Legal bases: performance of the contract with you (Art. 6(1)(b) GDPR), our legitimate interest in securing and improving the Service (Art. 6(1)(f)), and legal obligations such as bookkeeping (Art. 6(1)(c)). We do not sell personal data and we do not use workspace content for advertising or to train AI models.

Data we process on your behalf

Only conversations you explicitly start or scope from the dashboard or API are synchronised from your phone: message text, phone numbers, timestamps, call outcomes and, when you switch it on, call recordings and their transcripts. ApiSIM never imports a phone’s full message history. Recordings are stored encrypted at rest in a private bucket in the EU (AWS, Ireland) and are reachable only through short-lived links issued to your signed-in workspace or API key.

Sub-processors

• Amazon Web Services (EU, Ireland): storage of recordings and encrypted database backups.
• Stripe Payments Europe: subscription billing and invoices.
• Resend (EU region): transactional e-mail such as confirmations and receipts.
• Twilio: the telephone bridge leg of calls; audio transits Twilio and our media servers during a call.
• Deepgram, only if you choose cloud transcription for a workspace; otherwise transcription runs on our own servers.

We will announce sub-processor changes in the dashboard at least 14 days before they take effect.

Retention

• Recordings and transcripts: according to the retention period you set, by default 90 days, then deleted.
• Message content and call records: while your workspace is active and 30 days after it closes.
• Account and billing records: as long as required by Norwegian bookkeeping law (currently five years).
• Security logs: up to 12 months.

Your rights

You can access, correct, export and delete your account data from the dashboard or by e-mail. You may object to processing based on legitimate interest and complain to Datatilsynet, the Norwegian Data Protection Authority. If you are a recipient of messages or calls sent by one of our customers, please contact that business; we will help them respond.

Cookies

The dashboard uses one strictly necessary session cookie. The website uses no advertising cookies. If we add analytics we will use a privacy-preserving tool and say so here.

Data Processing Agreement

Forms part of the Terms of Service for every customer workspace.

1. Subject and duration. Digital Trend AS (processor) processes personal data in messages, call metadata, recordings and transcripts on behalf of the Customer (controller) for the purpose of providing ApiSIM, for as long as the Customer has a workspace.
2. Instructions. We process only on the Customer’s documented instructions, which are given through the dashboard, the API and these terms, unless required by law, in which case we inform the Customer before processing where permitted.
3. Confidentiality and security. Staff with access are bound by confidentiality. We apply tenant isolation enforced in the database, encryption in transit and at rest, scoped credentials, audit logs, encrypted off-site backups and least-privilege access.
4. Sub-processors. The Customer authorises the sub-processors listed above. We notify changes 14 days in advance; the Customer may object and, if unresolved, terminate.
5. Assistance. We assist the Customer with data-subject requests, security incidents and impact assessments as far as reasonably possible, given the nature of the Service.
6. Breach notification. We notify the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting their data.
7. Deletion and return. At the end of the Service the Customer may export their data through the API; we delete workspace content within 30 days unless law requires retention.
8. Audits. We provide information needed to demonstrate compliance and allow audits by the Customer or a mandated auditor at reasonable notice and frequency, at the Customer’s cost unless material non-compliance is found.
9. Transfers. Data is stored in the EU. Where a sub-processor processes data outside the EEA, transfers rely on EU Standard Contractual Clauses or an adequacy decision.
10. Customer obligations. The Customer warrants a lawful basis for every message, call, recording and transcription, including notices and consent, and remains responsible for its phone, SIM and carrier compliance.

A countersigned copy of this agreement is available on request from support@apisim.app.

Terms of Service Back to apisim.app