Draft: to be reviewed by a lawyer before launch.

Data Processing (DPA)

Version 2026-10-20.1 · last updated 2026-10-20

What is processed

During a call: the caller's voice (streamed in real time for recognition, not stored), their number, the conversation text and the order, booking or message.

Retention

Conversation text, orders and the activity log are kept while the account is active; they are deleted 30 days after the account is deleted. Security log: 12 months. Voice: not stored.

Sub-processors

Anthropic (AI, USA); Microsoft Azure (speech recognition and synthesis, West Europe); Vala (phone line, Kosovo); the hosting provider (Hetzner Online GmbH, Germany); the bank for payments ([to be decided]); Telegram (only if the owner enables approvals).

Security

argon2id passwords, protected connections, each business's data separated from the others, tamper-evident logs, access only for authorised people.