Where your data lives and who touches it
What happens to a call, an SMS and the data in your account: where it lives, who touches it, how we protect it and where our limits are. Every sentence below can be verified in code or in the supplier's public terms. What we cannot verify we do not write, or it is listed under What we cannot do yet.
Updated 1 November 2026.
The database is in the EU, the call partly leaves Europe
The database with your account, transcripts and summaries is in the EU. The call itself, however, travels part of its way outside it. We put this at the top on purpose, because it is easily lost behind the phrase "data in the EU".
Stays in the EU
- Account, numbers, call records, transcripts and summaries: Upstash, Frankfurt.
- Website, portal and API: Vercel, Frankfurt.
- Call control and recordings of our own voice engine: Hetzner, Germany.
- Speech-to-text of the caller on our own engine: Soniox, European endpoint.
- Primary language model of our own engine: Scaleway, France.
Goes outside the EU, to the USA
- The agent's voice on our own engine: Cartesia.
- Language model fallback when the primary fails: Anthropic, then Google Gemini.
- Call summary and goal evaluation: Anthropic.
- Agents on the standard platform: the whole call, including recordings, at ElevenLabs.
- SMS on the SMS number add-on: Twilio.
Where the data lives
| What | Where | Who runs it |
|---|---|---|
| Account, numbers, call records, messages, transcripts and summaries | Frankfurt (region eu-central-1), a single region with no replica outside it | Upstash |
| Website, portal and API | Frankfurt (fra1) | Vercel |
| Our own voice engine (call control, media layer) | Two nodes in Germany (Falkenstein and Nuremberg) | Hetzner |
| Recordings of calls handled by our own engine | Germany (Hetzner Object Storage, Falkenstein) | Hetzner |
| Recordings of agents on the standard platform | USA | ElevenLabs |
Sub-processors
Suppliers that touch the data of callers or SMS senders:
| Supplier | Purpose | Country | Terms |
|---|---|---|---|
| Odorik | phone numbers, call connection, SMS delivery | Czech Republic | service terms (Czech) |
| Hetzner | servers of our own engine and recording storage | Germany | supplier's terms |
| Soniox | speech-to-text on our own engine | EU | supplier's terms |
| Cartesia | speech synthesis on our own engine | USA | supplier's public DPA |
| Google Cloud Text-to-Speech | speech synthesis for older agents | EU | Google Cloud DPA |
| ElevenLabs | agents on the standard platform, fallback voice | USA | supplier's public DPA |
| Scaleway | primary language model of our own engine | France | supplier's terms |
| Anthropic | language model fallback, call summary and goal evaluation, weekly quality review on pseudonymised transcripts | USA | supplier's public DPA |
| Google (Gemini) | second language model fallback | USA | we rely on the supplier's safeguards |
| Upstash | database | EU (Frankfurt) | supplier's public DPA |
| Vercel | hosting of the website, portal and API | EU (Frankfurt) | supplier's public DPA |
| Twilio | SMS number (add-on) and the engine health-check call | USA | supplier's public DPA |
| DIDWW Ireland Limited | calls and SMS number | Ireland | privacy notice |
The links lead to the suppliers' public documents. A data processing agreement is sent on request, see Legal documents.
Other suppliers handle e-mail, payments, address autocomplete, operational alerts and ad measurement (only with your consent). Their purpose, country and retention are in the privacy policy, section 5. Changes to this list are recorded here and the update date at the top changes.
Separate from the suppliers above: if you connect a webhook, a calendar (Google or Apple), invoicing (Fakturoid, ABRA Flexi) or an assistant (ChatGPT, Claude) through OAuth or an API key, data flows there on your instruction and your account is responsible for that recipient. The same applies to a third-party agent you connect over SIP.
How long we keep data
- Call recordings: deleted 90 days after the call. Recording can be switched off per agent.
- Transcripts and summaries: for the life of the account. After cancellation we delete phone numbers, transcripts and message content within 30 days.
- SMS received on the SMS number: 90 days from receipt. The copy at Twilio is deleted roughly 24 hours after handling.
- Transcripts for the weekly quality review: the original form for 14 days, the pseudonymised form for 8 weeks.
- Invoices and accounting documents: as long as the law requires.
Security
Only what is verifiable in code, in the service configuration and in our policies:
- All communication with the service runs over HTTPS. The HSTS header is valid for 2 years and the pages cannot be embedded in a foreign frame.
- The portal calls our own voice engine over mutually authenticated TLS (mTLS) with a client certificate from our own certificate authority.
- Passwords are stored only as an irreversible hash (scrypt). API keys are kept in the database only as a fingerprint; you see them in readable form once, when you create them.
- Integration credentials are stored encrypted (AES-256-GCM), and so are the OAuth tokens for Google Calendar.
- The connection to the database is encrypted (TLS).
- Besides you, our support can access a recording when handling a specific problem with that call with you. The quality review works only with pseudonymised transcripts.
What we cannot do yet
- We do not present the certifications of our suppliers as our own.
- Automatic pseudonymisation of transcripts for the quality review can occasionally miss something.
- We do not publish an incident history yet.
Service status
The current status of the portal, the phone network, the voice agents and our own voice engine is on the Service status page. The checks are real (database, carrier availability, voice agents, an hourly test call to the engine) and the page refreshes at most once a minute.
Legal documents
A data processing agreement under Art. 28 GDPR is sent on request to podpora@volai.cz.
Operator and contact
volai is operated by ANOVIA Finance s.r.o., company ID (IČO) 01757237, registered office Na Zámku 636, 250 81 Nehvizdy, Czech Republic, entered in the commercial register kept by the Municipal Court in Prague, section C, file 266323. VAT payer. For your account data we are the controller. For the data of people who call your numbers we are the processor and you are the controller.
Data protection, data subject requests, the data processing agreement and security reports: podpora@volai.cz.