Numoloo

Remove the model layer and a softphone remains. What the vendor sells is detection of urgency, sentiment and intent, ranking of conversations by which need attention first, a summary of every call and voicemail, a pre drafted follow up email built from conversation context, and a recommendation on when to reach back out. Every one of those is model work, and none of them survives the removal test.

The telephony underneath, provisioning a number and placing and receiving calls, is plumbing the vendor barely markets. The price card settles it more cleanly than any argument could: the metered unit across all four tiers is credits consumed by the model, everything else is stated as included on every plan with no locked features, and users are the only other dimension. When a vendor meters the model capability itself and gives away the rest, the price card is telling you exactly what the removal test tells you.

The architectural position is stated consistently and it is load bearing: the model drafts and the person sends. Emails are described as pre drafted for review in three separate places, prioritised actions and drafts are delivered to a messaging channel, an inbox or an action centre for a human to work, and nothing in the product dispatches a message on its own.

In a category where the competitive pressure runs the other way, holding that line is a real choice and it is the reason a buyer can adopt this without handing over their outbound voice. Held off the top band because the review step is asserted rather than specified. No approval queue mechanics, escalation threshold, role definition or audit record of model decisions is described, no confidence signal accompanies a ranking, and no correction path exists for a call the model ranked wrongly. The prioritisation itself also runs without review, since the human sees the ordering rather than the reasoning that produced it.

The processing addendum does something most vendors here do not, and stops one step short of the disclosure that would move the band. Its sub processor table carries a category described as artificial intelligence and data processing providers, states exactly what flows to them, call recordings and transcripts, states what they do, speech to text processing, call analysis and summarisation, and states where they sit, the United States.

A buyer therefore knows that third parties process the content of every recorded conversation and knows their jurisdiction. What the buyer cannot learn is which third parties. Vendor identities within each category are withheld and available only on written request or from a location the addendum describes as non public. Model, provider, family, version and boundary appear nowhere on the site or in the addendum.

The evidence surface is empty and one word makes it worse than merely empty. Under a heading reading proven outcomes sit three phrases carrying no number, no denominator and no source: faster replies, stronger follow ups, fewer missed opportunities. Nothing proves them. Across the whole site there is no named customer, no logo, no testimonial, no case study, no review quoted and no result attributed to anybody.

In the position where evidence would normally sit, the vendor places a missed revenue calculator that takes the buyer's own guesses for missed call volume, average order value and conversion rate and multiplies them, presenting a figure the buyer generated as an estimate of what the product would recover. That is a marketing device wearing the clothes of measurement. A single customer with a dated before and after would move this row two bands.

One real mechanism exists and it is buried in the one place a buyer is least likely to look. The processing addendum requires the customer, where applicable law demands it, to configure and use the consent management features of the service including dual party consent functionality, so that recording and processing of audio is lawful. For a product that records every call, a two party consent mechanism is the single most important compliance feature it can ship, and this vendor ships one.

It appears in a contract clause and nowhere on the marketing site, in no feature page and in no frequently asked question. Around it the surface is thin. No recording statute or state is named, no list of jurisdictions where all party consent applies is offered, and the obligation is allocated wholly to the customer with an indemnity attached. The outbound side is empty: the product places calls and no registry scrubbing, calling window, abandonment position or dialing regime is addressed anywhere.

The processing addendum is the strongest document this vendor has and it is published in full and ungated, which is the distinction that separates real disclosure from a request form. Controller and processor roles are set out plainly. Four regimes are defined by name, and the Canadian definition names the federal act plus the Alberta, British Columbia and Quebec statutes individually rather than gesturing at the country.

Standard contractual clauses are incorporated with the parties annex completed and the supervisory authority mechanism specified. Data subject types are enumerated and prospects and their employees appear at the top of the list, which this index has recorded as rare. Personal information categories are enumerated down to call recordings, transcripts, caller identification and voicemail messages.

Breach notification, a fourteen day sub processor objection window and a seven working day data subject request notification are all fixed. Held off the top band on three counts: the privacy policy itself was not read for this build and is flagged, sub processor identities are withheld, and no retention period appears anywhere in a document that otherwise fixes timelines carefully.

Provenance is as clean as an architecture allows and the contract states it rather than leaving it implied. Every record originates in the customer's own calls with the customer's own contacts. A purchased database, an enrichment supplier, a waterfall cascade and a scraping layer are all absent from the product.

The addendum then does the work: the customer is named as controller and stated to retain control, responsible for providing notices and obtaining consents, while the vendor processes only on instruction, will not process or retain or disclose outside the stated business purpose, will not sell, and will not share for cross context behavioural advertising. Held off the top band by two openings.

Sub processor identities are withheld, so a buyer cannot learn which company holds their recordings. And rendering personal information fully and irrevocably anonymous is listed as an instructed processing purpose with no standard, method or verification described for it, which is the door through which conversation content can leave the addendum's protection entirely.

Exposure is genuinely low and no position is taken on the little of it there is. Nothing here scrapes, rents an identity, rotates accounts, ships a browser extension or automates against a professional network. The two external surfaces are a team messaging channel that receives prioritised actions and drafts, and carrier telephony for the numbers the platform provisions, which appears in the addendum only as a sub processor category described as voice transport and call routing.

Neither carries a conformance statement, and the messaging platform integration is not documented anywhere beyond a sentence on the homepage. The addendum does reference integrations configured by or on behalf of the customer as an instructed processing purpose, which implies a wider integration surface than the site describes, and none of it is enumerated.

This vendor answers in a contract the question this index has been asking across the whole sweep and almost nobody answers. The addendum states that the vendor will not combine personal information with personal information it processes on behalf of other parties unless expressly permitted. That is the cross client boundary, closed in writing, in a published document, by a company launched this year, on the same question that sits open at several of the largest vendors in this index.

Around it: processing restricted to the stated business purpose, no sale, no sharing for cross context behavioural advertising, authorised personnel trained and bound by confidentiality that survives their engagement, and sub processors bound by substantially the same terms with the vendor remaining fully liable for them. Held off the top band by one word that never appears. Training is not addressed anywhere.

The purpose limitation and the combination clause arguably reach it, and the addendum never says so, while a separate clause authorises rendering data fully and irrevocably anonymous with no standard attached. Anonymised transcripts training a model would breach neither clause, and the sub processor table confirms that speech to text and summarisation providers already hold that content.

The person on the other end of the call is recorded, transcribed, scored for sentiment and intent, and tagged, and the vendor's own product screenshot shows a named individual carrying the labels decision maker and qualified lead applied during a live call. Two things hold this row above the bottom band and both sit in the addendum rather than in the product.

Prospects and their employees are named explicitly as a data subject population, and the consent management features include dual party consent functionality the customer is required to configure where law demands it. What is missing is any disclosure mechanic. Nothing describes what the person is told, whether an announcement is played, whether the model's presence is stated, or how someone objects to being scored.

The measure already set in this index for this category is a recorder that joins as a named participant and announces itself, and nothing comparable was located. The pre drafted follow up email then goes out under the seller's name with no position taken on whether the recipient learns a model composed it.

Two delivery destinations exist and both are outbound only: prioritised actions and email drafts are pushed to a team messaging channel, to an inbox, and to the platform's own action centre. That is the whole documented integration surface.

For a conversation intelligence product the consequential gap is the system of record, because call insight that never reaches the pipeline stays trapped in the tool that produced it, and no synchronisation to any customer relationship platform is described anywhere. A programmatic interface, webhooks, a marketplace listing and developer documentation were absent from every surface read. The processing addendum refers to integrations between the service and third party services as configured by the customer, which suggests more exists than the site documents, and none of it is named.

Residency is answered function by function rather than in one sentence, which is more useful than what most vendors here publish. The sub processor table carries a location column and fills it for all six categories, and every one reads United States: cloud hosting and infrastructure, voice transport and call routing, the artificial intelligence and data processing providers handling speech to text and summarisation, transactional email delivery, authentication and identity, and internal notifications.

A buyer therefore knows where their recordings, transcripts and metadata sit at every stage. European transfers are covered by standard contractual clauses with the parties annex completed and the competent supervisory authority identified. Held off the top band because it is a posture with no options in it, offering no regional choice, and because the identity behind each category is withheld so none of it can be verified.

Worth noting for accuracy: the address given for the entity in the transfer annex is a business formation agent in Delaware rather than an operating location, and the only other geographic signal available is a company database record placing the company in New York.

A documented control set exists and no certification does, which is exactly the split this band describes. The addendum enumerates seven measures individually: role based access limited to a business need, secure authentication with multi factor where a third party supports it, encryption in transit with the protocol named, reputable cloud infrastructure, data minimisation, monitoring with an incident response procedure, and contractual obligations on vendors.

Breach notification and a detailed audit right sit alongside them, and all of it is published rather than gated. Against that, no service organisation control report, international standard, penetration test, attestation, trust centre, status page or vulnerability reporting route was located anywhere.

Two smaller things a buyer should notice: the footer link labelled security leads to this processing addendum rather than to any security page, so the label promises something the site does not have, and encryption is committed for data in transit while data at rest goes unmentioned in a product whose stored asset is recorded conversations.

The ladder is published in full with no quote wall at the top, which is rarer than it should be: a fourteen day trial with two users, a hundred and fifty credits and no card required, then fifty nine, a hundred and eighty nine and three hundred and seventy nine, each carrying its own seat count and credit allowance.

Every plan is stated to include full access with no locked features, so the feature gating that decides the real bill elsewhere in this index is genuinely absent, and there is no commitment and no cancellation penalty. Held off the top band by three things a buyer needs and cannot get. The card never states a billing period against any price.

The credit is never defined, so nobody can convert an allowance into a number of calls, which for a product that meters exactly this is the most important number on the page. And the expansions the card advertises, more users and more credits on every paid tier, carry no price at all, alongside telephony itself: the platform provisions numbers and carries calls, and no number rental, per minute rate or inclusion statement appears anywhere.

A contractual exit right exists, it is published, and it includes the return option most addendums leave out. On request the vendor will provide a copy of or access to all or part of the customer's personal information in its possession. On termination it will securely delete or destroy that information, or return it and retain nothing where the customer directs so in writing.

Where a law compels retention, the vendor must notify the customer in writing with the documents concerned, the legal basis, and a specific timeline for destruction once the requirement lapses, which is a discipline larger vendors routinely skip. Held off the top band on three counts. No self serve export function, file format or download path is described anywhere in the product. No deletion timeline is fixed, so securely delete has no clock attached to it.

And the question that matters most for this product goes unanswered: whether the call recordings and transcripts themselves come out, and in what form, rather than only the personal information the addendum governs.

The email half of this axis barely applies, because the product drafts and a person sends from their own mailbox rather than the vendor sending at volume, and transactional delivery appears only as a sub processor category. The voice half applies squarely and goes unaddressed.

This platform provisions telephone numbers and places outbound calls, which makes caller reputation the direct equivalent of sender reputation, and nothing is published about it: no position on number labelling or spam likely flagging, no branded calling or attestation scheme, no verification of the numbers it hands out, no calling window enforcement and no registry scrubbing.

For a product whose whole premise is that the phone drives revenue, the risk that its own numbers get labelled before they connect is the one operational threat to that premise, and it is not discussed anywhere.

The size band is legible and the market is not. Seat counts are published against every tier, two, four and eight with stated expansions to six and ten, so the ceiling is visible and small, and the vendor describes its buyer as businesses and solo professionals who rely on phone calls to drive revenue. That much is honest and useful.

Everything else is missing: no industry, no region, no customer count, no language or territory coverage for the transcription and analysis, and no statement of who this product would be wrong for. One ambiguity a buyer should resolve before trialling, recorded here because the vendor's own surfaces disagree: the site names no vertical at all, while a company database record lists seven buyer types running from home service businesses and real estate professionals through to sales organisations and support teams. Those are different motions with different compliance exposure, and the site gives a reader no way to tell which one the product was built around.