Legal / Privacy

Privacy policy

Information on the processing of personal data (Art. 13 GDPR).

1. Controller

Beck & Sierig GbR
Represented by the partners Lena Beck & Max Sierig
Birkenweg 7
39167 Irxleben
Germany
Email: support@wecallio.com

No data protection officer has been appointed; we are not legally required to appoint one.

2. What data we process

• Account data: optionally an email address and a password hash, the time of creation, the IP address at registration (protection against misuse), country, the plan booked and the subscription status.
• Call data: the destination number you provide, the brief/prompt, the optional goal (objective), language, duration, time, status as well as a summary generated by the AI model and the result of the conversation.
• No verbatim recording: deliberately no verbatim transcript and no audio recording of the conversation is stored. The conversation audio is processed in real time only and discarded afterwards.
• Payment data: for a paid plan, a customer and subscription identifier from our payment provider Stripe. We do not receive or store card or bank details — those are processed exclusively by Stripe.
• Access and session data: a technically necessary session cookie after login and — if you use the MCP connector — access tokens for the connection between your AI assistant and this service.
• Server logs: opening the website produces technically necessary log data (IP address, time, address requested, status code, user agent).
• Usage data from audience measurement — only with your consent: a pseudonymous identifier from the analytics cookie, the pages opened, the referrer, approximate location (derived from the truncated IP address), device type, browser and language. If you do not consent, none of this is collected.

3. Purposes & legal basis

• Art. 6 (1) (b) GDPR (performance of a contract): running the account, making the commissioned calls, showing the results, handling the subscription.
• Art. 6 (1) (f) GDPR (legitimate interest): preventing misuse and fraud (storing the registration IP, call and registration limits), technical operation and server security.
• Art. 6 (1) (c) GDPR (legal obligation): compliance with commercial and tax retention obligations for payment and invoicing.
• Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TDDDG: audience measurement with Google Analytics, to see which pages are used and where our service gets in the way. This consent is voluntary and is not needed to use the service; you can withdraw it at any time with effect for the future (see number 7).

4. People who are called

During a call, the destination number you provided is called. At the start of the conversation the AI assistant expressly introduces itself as an AI and states that it is calling on someone's behalf. The phone number and the conversation content of the person called are processed — the latter in real time only; all that is stored is the summary generated by the model. The legal basis is Art. 6 (1) (f) GDPR: the legitimate interest of the person commissioning the call and of the person called in settling the matter at hand (for example arranging an appointment or asking a question).

The user commissioning the call is responsible for the lawfulness of that individual call — in particular for any consent required, for example for marketing calls (see terms). Calls to emergency, government and premium-rate numbers are blocked technically; a call is limited to a maximum of 10 minutes. Briefs that ask the assistant to conceal that it is an AI or to impersonate someone else are rejected automatically.

Objection: anyone who does not want to be called again can say so during the call — the assistant then blocks the number immediately — or enter it themselves at Did we call you?. The block is permanent and applies to all users of our service. For this we store the phone number, the time and the origin of the objection; that is at the same time our record that we acted on it.

5. Recipients / processors

We use the following service providers to make the calls and run the website:

• Google (Gemini Live): the language model for the conversation (real-time processing of the conversation audio, no storage by us). Provider: Google Ireland Limited or Google LLC, USA.
• OpenAI: misuse check of the brief before dialling. Only the text of the brief entered by the commissioning person is transmitted — not your phone number and no conversation content. The provider does not store the request in its response history. Provider: OpenAI Ireland Ltd. or OpenAI, L.L.C., USA.
• Telnyx: telephony/SIP provider for call delivery (phone numbers and connection data).
• Stripe: payment provider for subscription billing (Stripe Payments Europe Ltd., Ireland).
• Hosting: operation of the servers running the application and the database (— noch einzutragen —).
• Email delivery: delivery of transactional mail (registration, password, contract and cancellation confirmations) via — noch einzutragen —.
• Google Analytics 4 — only after your consent: audience measurement for this website. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA takes place. Google's script is only loaded after you have consented — before that no connection to Google is made. Logged-in areas and the admin area are excluded from measurement.

Data processing agreements under Art. 28 GDPR are in place with these service providers. Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on standard contractual clauses under Art. 46 GDPR. We run the voice and media routing (LiveKit) on our own servers; it is not disclosed to any third party.

6. Retention periods

• Conversation audio: not stored (real-time processing only).
• Call data (destination number, brief, summary, result, duration): 180 days from the call, so that you can see it in the dashboard. After that it is deleted automatically. On request we delete it earlier.
• Account data: until the account is deleted. You can delete it yourself at any time in the dashboard under “Delete your account” — or informally by email to support@wecallio.com.
• Registration IP: 90 days; after that it is removed automatically, because it is no longer useful for preventing misuse.
• Result of the misuse check (verdict, category, excerpt of the brief): 180 days, to detect repeated misuse and to keep blocks traceable.
• Blocked phone numbers (objection to further calls): permanently. Deleting the entry would cancel the objection and re-enable exactly the call that is no longer wanted.
• Cancellations via the cancellation button: 3 years, as a record that the declaration was received.
• Access tokens for the MCP connector: 30 days from issue; login codes 10 minutes.
• Payment and invoice data: until the statutory retention periods expire (up to 10 years, § 147 AO, § 257 HGB) — mostly held at Stripe.
• Server logs: kept only briefly for technical operation and attack detection.
• Usage data from audience measurement: 14 months from the visit; after that Google deletes it automatically. If you withdraw your consent earlier, collection stops immediately.

7. Cookies & audience measurement

Technically necessary are a session cookie that keeps you logged in and — in the admin area — a corresponding cookie for administration. No consent is required for these under § 25 (2) TDDDG. Also without consent, we remember your decision about audience measurement in your browser's local storage — otherwise we would have to ask you again on every visit.

Audience measurement with Google Analytics 4. If you consent, Google sets the cookies _ga and _ga_<id> with a lifetime of up to two years. They contain a random identifier used to count returning visits as the same browser — Google does not receive your name, your email address or any call data. Your IP address is truncated by Google before it is stored. We do not build advertising profiles from it: the advertising features of Google Analytics (“Google signals”, personalised advertising) are permanently switched off.

As long as you do not consent, nothing happens: no cookie is set and Google's script is not loaded at all — so your IP address never reaches Google. The website works exactly the same without consent.

Withdrawal. You can withdraw your consent at any time with effect for the future — via “Cookie settings” at the very bottom of every page. We delete the analytics cookies that were set. The lawfulness of processing carried out until then remains unaffected.

Transfer to the USA. Google may also process the data on servers in the USA. We have concluded the data processing terms with Google (processing under Art. 28 GDPR); the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 GDPR). Despite these safeguards it cannot be ruled out that US authorities access the data and that you have no legal protection comparable to that in the EU. By consenting you also consent to this transfer (Art. 49 (1) (a) GDPR).

8. Your rights

Access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority. Requests to support@wecallio.com.

The authority responsible for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragte für den Datenschutz Sachsen-Anhalt); you may also contact the supervisory authority where you live.

As of 9 August 2026 (version 2026-08-09c) · ← Back to the home page