Privacy Policy

1. Data controller

The data controller under the GDPR is Callwave GmbH, c/o Factory Berlin, Rheinsberger Str. 76/77, 10115 Berlin, Germany.

Privacy contact: privacy@callwave.ai

2. Overview

Callwave is a SaaS product for AI-powered phone reception. We process personal data only where necessary for operation, contract fulfilment, security and legal obligations.

This policy applies to callwave.ai, the customer dashboard and related services.

3. Categories of data processed

• Account and contact data (name, email, company, phone number)
• Setup and configuration data (website URL, prompts, opening hours, knowledge base)
• Call metadata (time, duration, status, caller number where transmitted)
• Conversation transcripts and content captured by the assistant (e.g. appointment requests)
• Technical log data (IP address, browser, device, timestamps)
• Billing and contract data for paid plans

4. Purposes of processing

• Providing and operating the AI reception service
• Setting up and managing customer accounts
• Appointment booking and call routing per customer configuration
• Support, error analysis and product improvement
• Billing and contractual obligations
• IT security, abuse prevention and legal retention

5. Legal bases

• Art. 6(1)(b) GDPR — contract performance and pre-contractual steps
• Art. 6(1)(f) GDPR — legitimate interests (operation, security, improvement)
• Art. 6(1)(a) GDPR — consent where required (e.g. marketing cookies)
• Art. 6(1)(c) GDPR — legal obligations

6. Retention periods

We retain account and contract data for the duration of the business relationship and beyond as required by law.

Call transcripts and metadata are kept for 90 days by default unless the customer chooses a shorter or longer period in settings. After contract end, customer data is deleted within 30 days unless legal retention applies.

7. Hosting & location

Customer data (transcripts, settings, knowledge base) is processed in data centres within the European Union. We primarily use Supabase in the EU region (Frankfurt).

The application is deployed via Vercel; configuration and edge data may be processed in EU-adjacent regions.

8. Subprocessors

We use carefully selected processors to deliver our service:

• Twilio — telephony and voice transport
• OpenAI — speech and dialog processing (API, configurable)
• Supabase — database, authentication, EU hosting
• Vercel — hosting and web application delivery
• Stripe — payment processing (paid plans)

9. Sharing with third parties

Personal data is shared with third parties only when necessary for contract fulfilment, required by law or with your consent.

We do not share data for third-party advertising purposes.

10. Your rights

Please contact privacy@callwave.ai. You also have the right to lodge a complaint with a supervisory authority.

• Access to stored data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent (Art. 7(3) GDPR)

11. Cookies & tracking

We use strictly necessary cookies for login, language and security. Optional analytics cookies are used only with consent.

Details on individual cookies can be viewed in browser settings or requested from us.

12. Security

We implement technical and organisational measures (TOMs) to protect your data — including encryption in transit (TLS), access controls, tenant isolation and regular updates.

Absolute security cannot be guaranteed; we respond to incidents according to a documented process.

13. Changes to this policy

We update this privacy policy when law, product or subprocessors change. The current version is always available on this page.

For material changes we notify registered customers by email or in the dashboard.

14. Contact

Callwave GmbH · privacy@callwave.ai · hello@callwave.ai · +49 30 12345678