Privacy policy

Information on the processing of personal data (Art. 13 GDPR).

1. Controller

Beck & Sierig GbR
Represented by the partners Lena Beck & Max Sierig
Birkenweg 7
39167 Irxleben
Germany
Email: support@wecallio.com

No data protection officer has been appointed; we are not legally required to appoint one.

2. What data we process

• Demo requests: name, company, phone number, work email, country, company size and language, plus optional information about how you found us and your use case. These details are stored in our database and displayed in the protected admin area to handle your request and arrange a suitable time.
• Account data: optionally an email address and a password hash, the time of creation, the IP address at registration (protection against misuse), country, the plan booked and the subscription status.
• Call data (outgoing): the destination number you provide, the brief/prompt, the optional goal (objective), language, duration, time, status as well as a summary generated by the AI model and the result of the conversation.
• Call data (incoming): if a user forwards their own line to their personal number with us, the assistant answers calls arriving there. We then process the caller's number, the receiving number dialled, time, duration and status, plus a summary of the matter generated by the model. If the caller withheld their number, we store none.
• Forwarded lines: the number a user enters as their own line, and the time they confirmed it through a verification call.
• No verbatim recording: deliberately no verbatim transcript and no audio recording of the conversation is stored. The conversation audio is processed in real time only and discarded afterwards.
• Payment data: for a paid plan, a customer and subscription identifier from our payment provider Stripe. We do not receive or store card or bank details — those are processed exclusively by Stripe.
• Signing in with Google or Apple — only if you choose it: if you use one of those buttons, the provider sends us your email address, whether they have verified it, and an internal identifier for your account with them. No password is created. If you pick Apple's “Hide My Email”, we only receive the relay address Apple issues. If you sign in with email and password, no connection to either provider is made.
• Access and session data: a technically necessary session cookie after login and — if you use the MCP connector — access tokens for the connection between your AI assistant and this service.
• Server logs: opening the website produces technically necessary log data (IP address, time, address requested, status code, user agent).
• Our own usage statistics, without cookies: for every page view we count on our server which page was opened, which website you came from (only its domain) or which tagged link (utm parameters), plus language and device type (phone, tablet, desktop). To add up the views of one day, we derive a hash from IP address and browser identifier using a key that is created anew every day and deleted the following day. We do not store the IP address itself for this, and nobody can be recognised across days. Nothing is stored on your device for this. In the same way we count whether the consent banner was shown to you and whether you accepted or declined.
• Usage history of your account: if you have an account, we record its key steps with a timestamp, such as registration, email confirmation, logins, demo call, connecting the assistant, calls and plan changes, as well as when you were last active while logged in. On the day of registration we link them to the daily value described above to see how you found us.
• Heatmaps and session recordings with Microsoft Clarity, only with your consent: on the public pages of the website, mouse movements, clicks, scrolling and page layout, plus device type, browser, approximate location and a pseudonymous identifier from a cookie. Input in form fields is masked before transfer. Clarity does not run in the app after login or on the login pages.
• Usage data from audience measurement — only with your consent: a pseudonymous identifier from the analytics cookie, the pages opened, the referrer, approximate location (derived from the truncated IP address), device type, browser and language. If you do not consent, none of this is collected.
• Ad measurement data, only with your consent: the click identifier of a Google ad through which you reach us, and whether an enquiry, registration or booking follows. If you do not consent, none of this is collected.

3. Purposes & legal basis

• Art. 6 (1) (b) GDPR (performance of a contract): running the account, making the commissioned calls, showing the results, handling the subscription.
• Art. 6 (1) (f) GDPR (legitimate interest): preventing misuse and fraud (storing the registration IP, call and registration limits), technical operation and server security.
• Art. 6 (1) (c) GDPR (legal obligation): compliance with commercial and tax retention obligations for payment and invoicing.
• Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TDDDG: audience measurement with Google Analytics, to see which pages are used and where our service gets in the way. This consent is voluntary and is not needed to use the service; you can withdraw it at any time with effect for the future (see number 7).
• Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TDDDG: measuring whether our ads on Google lead to enquiries, registrations and bookings (Google Ads). Voluntary and revocable at any time (see number 7).
• Art. 6 (1) (f) GDPR (legitimate interest): our own usage statistics and the usage history of accounts, to understand how our service is found and used, where prospects drop off and where we can help customers with the setup. The statistics work without cookies and without storing the IP address. You can object to this processing at any time (Art. 21 GDPR), informally by email.
• Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TDDDG: heatmaps and session recordings with Microsoft Clarity, to see where using the website gets difficult. Voluntary and revocable at any time (see number 7).

4. Third parties on the line

During a call, the destination number you provided is called. At the start of the conversation the AI assistant expressly introduces itself as an AI and states that it is calling on someone's behalf. The phone number and the conversation content of the person called are processed — the latter in real time only; all that is stored is the summary generated by the model. The legal basis is Art. 6 (1) (f) GDPR: the legitimate interest of the person commissioning the call and of the person called in settling the matter at hand (for example arranging an appointment or asking a question).

The user commissioning the call is responsible for the lawfulness of that individual call — in particular for any consent required, for example for marketing calls (see terms). Calls to emergency, government and premium-rate numbers are blocked technically; a call is limited to a maximum of 10 minutes. Briefs that ask the assistant to conceal that it is an AI or to impersonate someone else are rejected automatically.

Objection: anyone who does not want to be called again can say so during the call — the assistant then blocks the number immediately — or enter it themselves at Did we call you?. The block is permanent and applies to all users of our service. For this we store the phone number, the time and the origin of the objection; that is at the same time our record that we acted on it.

Incoming calls. If a user has forwarded their own line to their personal number with us, the assistant answers there. It introduces itself as an AI with its very first sentence in that case too. All it does is take down what the call is about and pass that on to the user as a summary — it gives no information on the user's behalf and cannot promise anything. The caller's number and the conversation content are processed, the latter in real time only. The legal basis is Art. 6 (1) (f) GDPR: the legitimate interest of both sides in a call not running into the void and the matter reaching its addressee. Anyone who does not want to speak to an AI assistant can say so during the call; it then ends the conversation politely. Incoming calls are treated exactly like outgoing ones: no recording, no verbatim transcript, the same retention period (section 6).

5. Recipients / processors

We use the following service providers to make the calls and run the website:

• Google (Gemini Live): the language model for the conversation (real-time processing of the conversation audio, no storage by us). Provider: Google Ireland Limited or Google LLC, USA.
• OpenAI: misuse check of the brief before dialling. Only the text of the brief entered by the commissioning person is transmitted — not your phone number and no conversation content. The provider does not store the request in its response history. Provider: OpenAI Ireland Ltd. or OpenAI, L.L.C., USA.
• Telnyx: telephony/SIP provider for call delivery (phone numbers and connection data).
• Stripe: payment provider for subscription billing (Stripe Payments Europe Ltd., Ireland).
• Google and Apple (sign-in) — only if you choose it: clicking “Sign in with Google” or “Sign in with Apple” forwards your request to that provider, who thereby learns that you are signing in with us. The legal basis is Art. 6(1)(b) GDPR — the transfer is the action you initiated, so a consent banner would be the wrong instrument. The logos on the sign-in page are served from our own server; as long as you do not use one of the buttons, no connection to Google or Apple is made. Providers: Google Ireland Limited and Google LLC, USA; Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.
• Hosting: operation of the servers running the application and the database (netcup GmbH, Karlsruhe).
• Email delivery: delivery of transactional mail (registration, password, contract and cancellation confirmations) via Brevo GmbH, Berlin.
• Google Analytics 4 — only after your consent: audience measurement for this website. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA takes place. Google's script is only loaded after you have consented — before that no connection to Google is made. In logged-in areas we only measure single events such as registration, login or purchase, without the page address; the admin area is excluded.
• Google Ads, only after your consent: we run ads on Google. If you reach us through such an ad, Google learns whether an enquiry, registration or booking follows. Google Ads takes these events from Google Analytics; we do not load a separate advertising script. We do not use remarketing or personalised advertising. Google is itself responsible for measuring the ads (Google Ads Controller-Controller Data Protection Terms). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA takes place.
• Microsoft Clarity, only after your consent: heatmaps and session recordings of the public website. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; a transfer to Microsoft Corporation in the USA takes place. The script is only loaded after you have consented.

Data processing agreements under Art. 28 GDPR are in place with these service providers. Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on standard contractual clauses under Art. 46 GDPR. We run the voice and media routing (LiveKit) on our own servers; it is not disclosed to any third party.

6. Retention periods

• Conversation audio: not stored (real-time processing only).
• Forwarded lines: until you remove them in the dashboard, at the latest until your account is deleted.
• Call data (outgoing: destination number and brief; incoming: the caller's number; both with summary, result and duration): 180 days from the call, so that you can see it in the dashboard. After that it is deleted automatically. On request we delete it earlier.
• Account data: until the account is deleted. You can delete it yourself at any time in the dashboard under “Delete your account” — or informally by email to support@wecallio.com.
• Registration IP: 90 days; after that it is removed automatically, because it is no longer useful for preventing misuse.
• Result of the misuse check (verdict, category, excerpt of the brief): 180 days, to detect repeated misuse and to keep blocks traceable.
• Blocked phone numbers (objection to further calls): permanently. Deleting the entry would cancel the objection and re-enable exactly the call that is no longer wanted.
• Cancellations via the cancellation button: 3 years, as a record that the declaration was received.
• Access tokens for the MCP connector: 30 days from issue; login codes 10 minutes.
• Payment and invoice data: until the statutory retention periods expire (up to 10 years, § 147 AO, § 257 HGB) — mostly held at Stripe.
• Server logs: kept only briefly for technical operation and attack detection.
• Usage data from audience measurement: 14 months from the visit; after that Google deletes it automatically. If you withdraw your consent earlier, collection stops immediately.
• Google Ads cookies: up to 90 days. Google keeps the reports in Google Ads according to its own retention periods.
• Our own usage statistics: 13 months, then deleted automatically. The daily key for the hash is deleted the following day.
• Usage history of an account: until the account is deleted.
• Microsoft Clarity data: recordings 30 days, analyses up to 13 months; after that Microsoft deletes them automatically.

7. Cookies & audience measurement

Technically necessary are a session cookie that keeps you logged in and — in the admin area — a corresponding cookie for administration, plus, during registration, a cookie that lets the waiting page know whose confirmation it is waiting for. No consent is required for these under § 25 (2) TDDDG. Also without consent, we remember your decision about audience measurement in your browser's local storage — otherwise we would have to ask you again on every visit.

Audience measurement with Google Analytics 4. If you consent, Google sets the cookies _ga and _ga_<id> with a lifetime of up to two years. They contain a random identifier used to count returning visits as the same browser — Google does not receive your name, your email address or any call data. Your IP address is truncated by Google before it is stored. We do not build advertising profiles from it: “Google signals”, remarketing and personalised advertising are permanently switched off.

Google Ads. If you consent and reach us through one of our ads on Google, Google stores its click identifier in the cookies _gcl_au and _gcl_aw for up to 90 days. This lets Google attribute a later enquiry, registration or booking to the ad. We do not pass on your name, your email address or any call data for this.

As long as you do not consent, nothing happens: no cookie is set and Google's script is not loaded at all — so your IP address never reaches Google. The website works exactly the same without consent.

Withdrawal. You can withdraw your consent at any time with effect for the future — via “Cookie settings” at the very bottom of every page. We delete the analytics and ad cookies that were set. The lawfulness of processing carried out until then remains unaffected.

Transfer to the USA. Google may also process the data on servers in the USA. We have concluded the data processing terms with Google (processing under Art. 28 GDPR); the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 GDPR). Despite these safeguards it cannot be ruled out that US authorities access the data and that you have no legal protection comparable to that in the EU. By consenting you also consent to this transfer (Art. 49 (1) (a) GDPR).

Microsoft Clarity. If you consent, Clarity sets the cookies _clck (lifetime one year) and _clsk (one day), and on the domain clarity.ms the cookie MUID. They link the page views of one session. The transfer to the USA is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Microsoft is certified. You can withdraw as described above via “Cookie settings”; we then delete these cookies as well.

8. Your rights

Access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority. Requests to support@wecallio.com.

The authority responsible for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragte für den Datenschutz Sachsen-Anhalt); you may also contact the supervisory authority where you live.

As of 4 October 2026 (version 2026-10-04b) · ← Back to the home page