Privacy Policy
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. This English version is a translation; if it differs from the German version, the German version prevails.
1. Data Controller
The party responsible for data processing on this website is: Islam Aliev Sole proprietorship — AnrufPro is a trade name of Islam Aliev Feldbergstr. 100 81825 München Email: info@anrufpro.de
2. Collection and Storage of Personal Data
When you visit our website, information is automatically sent to our website server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until automatic deletion: • IP address of the requesting computer • Date and time of access • Name and URL of the retrieved file • Website from which access is made (referrer URL) • Browser used and, if applicable, the operating system of your computer • Name of your access provider The data mentioned is processed for the following purposes: • Ensuring a smooth connection to the website • Ensuring comfortable use of our website • Evaluating system security and stability
3. Appointment Booking and Contact
Contact: Our website does not contain a contact form. If you write to us by email at info@anrufpro.de, we store the data you provide (e.g., name, email address, phone number, message) for the purpose of processing your inquiry and for any follow-up questions. Appointment booking: Demo appointments are booked through our own booking system at app.anrufpro.de. The data you enter there (e.g. name, email address, phone number) is stored in our own application database, hosted by Railway Corporation on servers in Amsterdam, the Netherlands. No transfer to a third-party provider takes place for the purpose of appointment booking. We do not share this data with further third parties without your consent.
4. AI Phone Assistant
Our AI phone assistant processes phone conversations to answer calls, respond to customer questions, and book appointments. The following data is processed: • Spoken content of the phone call • Caller's phone number • Date and time of the call • Name and appointment details, if applicable Processing is based on Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(f) GDPR (legitimate interest). We use third-party AI services to provide this functionality (see Section 6). User data, including data obtained from Google APIs (such as Google Calendar data), is not used to develop, improve, or train generalized AI/ML models, and is not transferred to AI providers for any purpose other than answering the immediate user request.
5. Sub-processors and Data Sharing
To provide our service, we share the data required in each case with the following service providers. We do not sell user data, and we do not share user data for advertising purposes. • Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104 (USA) — hosting of our application backend and customer dashboard, including the database that stores customer account data, OAuth tokens, and configuration. The servers are located in Amsterdam, the Netherlands. Access from the USA, for example for operations and support, cannot be ruled out. Transfer mechanism: Standard Contractual Clauses under Implementing Decision (EU) 2021/914. • ElevenLabs (USA) — speech-to-text, text-to-speech and orchestration of the voice assistant. Receives call audio and generated text. Transfer mechanism: Standard Contractual Clauses under Implementing Decision (EU) 2021/914, Module 3. • Google (Gemini) — large language model used during the live call to understand and respond to callers. The call is made via ElevenLabs; Google is a sub-processor of ElevenLabs and not our direct contractual partner. Transfer mechanism: via the sub-processor ElevenLabs. • Twilio Inc. (USA) — telephony (phone numbers, call delivery). Receives phone numbers, connection data and call audio. Transfer mechanism: Standard Contractual Clauses under Implementing Decision (EU) 2021/914, Module 3. • SendGrid (Twilio Inc., USA) — sending of transactional emails (e.g., notifications). Receives the email address and the content of the respective message. Transfer mechanism: Standard Contractual Clauses under Implementing Decision (EU) 2021/914 (Twilio Data Protection Addendum). • Stripe — payment processing. Our contractual partner is Stripe Payments Europe, Limited (Ireland); payment data is also transferred to Stripe, LLC (USA). Stripe processes payment data partly as an independent controller (e.g., fraud prevention, legal obligations). Transfer mechanism: [TO BE VERIFIED] • Anthropic (USA) — post-call analysis (e.g., generating call summaries and extracting appointment and contact details) and workflow processing. Receives the call transcript. Transfer mechanism: Standard Contractual Clauses under Implementing Decision (EU) 2021/914, Module 3. • Vapi (USA) and Deepgram (USA) — voice agent orchestration and speech-to-text used in our development and testing environments only; not used to process production customer calls. • Google Calendar API — when a customer connects their Google account, we access the customer's Google Calendar solely to read availability and to create or update calendar events on the customer's behalf, in line with the customer's instructions. Use of Google user data. Data obtained from Google APIs is used only to provide the user-facing features the user has authorized. We do not sell, transfer, or use Google user data for advertising. Google user data is not used to develop, improve, or train generalized AI/ML models. Google user data is shared with AI sub-processors only to the extent strictly necessary to fulfill an immediate user request (e.g., suggesting an available time slot during a call). Our use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
6. Data Security
We protect personal data with appropriate technical and organizational measures, including: • Encryption in transit using TLS 1.2 or higher for all connections between users, our backend, and sub-processors. • OAuth refresh and access tokens (e.g., Google Calendar tokens) are stored with restricted access and can be revoked by the user at any time via their Google Account settings or by contacting us. • Access to production systems is limited to authorized personnel on a need-to-know basis and protected by strong authentication. • Secrets and API keys are managed via environment-level secret management and are not exposed in source code. • Sub-processors are selected based on their security posture and contractual data protection commitments. If you believe your data has been compromised, please contact us immediately at info@anrufpro.de.
7. Your Rights
You have the right to: • Obtain information about your personal data stored by us (Art. 15 GDPR) • Request correction of inaccurate data (Art. 16 GDPR) • Request deletion of your data stored by us (Art. 17 GDPR) • Request restriction of processing (Art. 18 GDPR) • Request data portability (Art. 20 GDPR) • Object to processing (Art. 21 GDPR) If you have connected a Google account, you can additionally revoke our access at any time via https://myaccount.google.com/permissions. Once access is revoked, we will stop accessing the affected Google APIs and delete associated tokens. To exercise your rights, please contact: info@anrufpro.de
8. Hosting
This public website is statically hosted. Our application backend and customer dashboard are operated by Railway Corporation (USA) on servers in Amsterdam, the Netherlands. The hosting providers collect the following data in so-called log files, which your browser automatically transmits: • IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request, HTTP status code, amount of data transferred, website from which the request comes, browser type, operating system and its interface, language and version of the browser software.
9. Cookies and Google Analytics
On your first visit we display a cookie banner. Technically necessary cookies (e.g., your language setting and your cookie choice) are set without consent. All other services are loaded only if you explicitly agree in the banner; you can also allow necessary cookies only. You can change or withdraw your choice at any time via the "Cookie Settings" link in the website footer. Google Analytics: Only if you consent to the "Analytics & Statistics" category do we load Google Analytics (provider: Google). Google Analytics sets cookies and processes usage data of your visit (e.g., pages viewed, time on page, device and browser, approximate location) under a pseudonymous identifier. The legal basis is your consent (Art. 6(1)(a) GDPR). Retention period at Google: [to be added]. Transfer mechanism for processing in the USA: [to be added].
10. Changes to This Privacy Policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.