Security & data
Your data stays under your control
What exactly we do with data, where it lives and who can access it. No marketing shortcuts.
EU hosting
The application and the database run in the European Union (Supabase database in an EU region, application servers in the EU).
GDPR kit
Export of all data about one customer, erasure on request and a configurable conversation retention period (e.g. 180 days).
AI answers only from your verified facts
Prices, services and opening hours come from material you have checked. If it doesn't know, it says so and hands the question to a person.
Human takeover
Take over any conversation with one tap. The AI goes quiet and you carry on yourself.
“Pause AI” kill switch
One switch stops the AI instantly in every channel. Messages keep coming to you.
Official WhatsApp Business API
We connect WhatsApp only through Meta's official interface. No unofficial tools that put your number at risk of being blocked.
Sub-processors
The list follows our GDPR documentation. We notify you of changes in advance.
| Sub-processor | What it processes | Region |
|---|---|---|
| Supabase Inc. (database) | Application data: conversations, contacts, settings | EU (Frankfurt) |
| Hetzner Online GmbH (application hosting) | Data in transit, operational logs | EU (Germany / Finland) |
| LLM provider (Google Gemini API / Anthropic / OpenAI – as configured) | Message text and conversation context to generate a reply | Per provider agreement; paid API, no training on data |
| Meta Platforms Ireland (WhatsApp, Instagram, Messenger) | Identifiers and message texts in those channels | EU / US |
| Telegram | Identifiers and message texts in Telegram | Outside the EU |
| Viber (Rakuten) | Identifiers and message texts in Viber | EU |
| Twilio / Retell AI (phone, only if enabled) | Phone number, call recording and transcript | US (standard contractual clauses) |
Messengers (Meta, Telegram, Viber) are only used if you switch them on – their terms apply to conversations in that channel.
Data processing agreement (DPA)
We send an Art. 28 GDPR data processing agreement on request – including the sub-processor list, technical measures and the incident procedure.
Request the DPACertifications
We do not hold certifications such as ISO 27001 or SOC 2 and do not claim otherwise. We're happy to explain how we protect data: HTTPS, hashed passwords, signed webhooks, least-privilege access.