Privacy Policy

1. Data controller

Vahti Technologies Oy (Business ID: 3643264-9)
Mechelininkatu 21 B 51, 00100 Helsinki, Finland
support@vahti.co

2. Data we collect

We collect the following data to provide the Vahti service:

Account data: Email address, password (encrypted), and name when you create an account.

Contact list: Phone numbers and names from your device contacts. These are synced to our servers to identify known callers. We store only names and phone numbers, no photos, addresses, or other contact fields.

Call data: For each call screened by Vahti, we store the caller's phone number, the caller's stated name and company, reason for calling, an AI-generated summary, an AI-generated transcript, call duration, and timestamp. We do not record or store the raw audio of calls.

Caller names remembered by Vahti: When a caller whose number is not in your contacts tells Vahti their name, we store, for your account only, the name the caller gave, their phone number, how many such calls the number has made, and the time of the first and the latest of those calls. Only the latest name is kept. This is used only for you: your call list, notifications and emails show the name when a call has no other name, and tell you if the same number later introduces itself with a different name. Vahti does not tell the remembered name to the caller and does not ask the caller about it, because a different person may call from the same number. Legal basis: legitimate interest (Art. 6(1)(f)). The entry is deleted automatically when your call-content retention period (default 30 days, adjustable from 1 to 90 days) has passed since the latest call in which the caller gave a name. If you shorten the retention period, older entries are deleted immediately. Entries are also deleted when you delete your account, and you can ask us to delete them at support@vahti.co.

Calendar data: When you connect a calendar (Google Calendar, iPhone Calendar, or Outlook Calendar), we access event start and end times (never titles, descriptions or attendees) to determine your availability for call routing. Google and Outlook calendar data is received via push notifications from Google/Microsoft. iPhone calendar events are synced from your device to our database.

Payment data: Payment processing is handled by Stripe. We do not store credit card numbers. We store your Stripe customer ID and subscription status.

Device data: Push notification tokens, device platform (iOS/Android), and app version for delivering notifications.

Technical data: IP address, device type, operating system, and basic usage analytics.

Vahti-apuri questions: When you ask the Member Care assistant Vahti-apuri a question, we store your customer identifier, the question text, the page you asked it on, the language, and whether the answer pointed you to support. We use them to improve our support and help content (legitimate interest, Art. 6(1)(f)). We do not store your email address, your Vahti number, or call transcripts with them. The questions are deleted after 12 months, and immediately when your account is deleted.

3. How we use your data

• Provide call screening: identify callers, route calls, generate summaries
• Route calls based on calendar availability (busy/free), quiet hours, and VIP contact status
• Send push notifications when a call has been screened
• Display call logs and summaries in the app and web dashboard
• Process payments and manage subscriptions
• Communicate with you about your account and service updates
• Improve our AI models and service quality

4. Legal basis for processing (GDPR)

• Contract (Art. 6(1)(b)): Processing call data, contacts, and account data is necessary to provide the service
• Legitimate interest (Art. 6(1)(f)): Service improvement, security, and analytics
• Consent (Art. 6(1)(a)): Calendar integrations, analytics cookies

5. AI and call processing

Vahti uses an artificial intelligence voice agent to screen calls. When an unknown caller reaches your Vahti number, the call is answered by an AI assistant, not a human. The AI identifies the caller and reason for calling and creates a text summary for you. Known contacts can ring through according to your settings. Before AI call answering is activated, the Vahti app shows you what data is shared and with whom, and asks for your permission; the same information is available at any time in the app settings.

Transparency (EU AI Act Art. 50): Callers are told at the start of the conversation, in plain language and in the language of the call, that they are speaking with an AI assistant and on whose behalf it is answering. That spoken disclosure is how we meet Article 50(1) of Regulation (EU) 2024/1689.

Processing of call-related personal data by the AI stack (speech recognition, language model, text-to-speech, and post-call text summary) is described in Sections 2–4 and 6. We do not store raw call audio, only text summaries, transcripts, and call metadata as set out in this policy.

Emergencies: If a caller clearly says there is a danger to life or that someone is trapped, the AI assistant tells them to call the emergency number 112 and the call is marked as urgent for you. Vahti never calls the emergency number itself, does not contact the authorities and does not promise help.

• The AI does not make decisions with legal or similarly significant effects on you or callers: you decide whether to call back
• Vahti does not perform emotion recognition, biometric categorisation, social scoring, or other high-risk AI practices listed in Annex III of the AI Act
• Vahti Technologies Oy is the provider and deployer of this limited-risk AI system for the purposes of the AI Act

Questions about our use of AI: support@vahti.co.

6. Third-party services

We use carefully selected processors to operate Vahti. Below we describe them by category, naming the key processors. Each processor is bound by a data-processing agreement (GDPR Art. 28) that provides the same or an equal level of protection for your data as this policy. A full list of sub-processors is available on request.

• Cloud hosting and database (Vercel, Supabase, EU): Application hosting (Vercel, Frankfurt region), authentication and storage of account, contact and call data (Supabase, Frankfurt, EU).
• Telephony and numbering (Telnyx): Provision of your Vahti phone number, call routing, and related telephony infrastructure. Data processed: call audio in transit, caller and destination phone numbers, and call metadata. Some processing may occur outside the EU/EEA under appropriate transfer safeguards (e.g. standard contractual clauses).
• AI voice and language processing (LiveKit, real-time call infrastructure and AI inference; Speechmatics, speech recognition; Google Gemma, language model; Cartesia, speech synthesis): When the AI assistant answers a call, live call audio is processed in real time through LiveKit: speech recognition turns it into text, the language model generates the assistant's replies, and speech synthesis speaks them. Backup providers used only if the primary one is unavailable: AssemblyAI and Deepgram (speech recognition), Google Gemini and OpenAI (language model). The AI agent runs in LiveKit's EU region. Speech recognition and speech synthesis are used through EU endpoints, and the language model Google Gemma runs on LiveKit's own service. The data of our LiveKit project (such as project settings and usage data) is located in the United States. Backup models may process data outside the EU: LiveKit may route requests to Google Gemini models to services outside the EU, and processing could not be restricted to the EU. Such transfers rely on standard contractual clauses or the EU-U.S. Data Privacy Framework (DPF). Data processed: live call audio (not stored), the conversation transcript, the caller's phone number, the known-caller name where available, and the knowledge base and agent instructions you have entered yourself. Vahti does not store raw call audio, and these processors do not retain it beyond real-time processing; for Speechmatics this is based on LiveKit's documentation. Some providers may process data outside the EU/EEA under appropriate transfer safeguards (e.g. standard contractual clauses).
• Call summaries and call details (OpenAI): After an AI-answered call, the transcript is sent to OpenAI's API to produce the summary, caller name, company, topic and urgency shown in the app. For customers who use Vahti as a real estate agent, the same transcript is also used to extract the property details of the call (e.g. seller or buyer, property, location, size, price or budget and timeline), shown to the agent. OpenAI may retain data sent to its API for up to 30 days to monitor abuse, after which it is deleted; it does not use the data to train its models. This also applies when OpenAI is used as a backup language model. OpenAI may process data outside the EU/EEA under appropriate transfer safeguards (e.g. standard contractual clauses).
• Correcting speech recognition errors in transcripts (OpenAI): After a call, likely speech recognition errors in the transcript (e.g. a misheard word) may be corrected. The transcript is processed through OpenAI's API in the same way as the call summaries. One OpenAI language model suggests corrections and a second, more accurate model reviews them. Only corrections that both accept are used. OpenAI may process data outside the EU/EEA under appropriate transfer safeguards (e.g. standard contractual clauses). The original transcript is kept unchanged; the corrections are stored separately, corrected words are marked in the app and the original can always be shown. The corrections are deleted together with the transcript (retention setting or deletion). Otherwise the OpenAI terms described above apply.
• Member Care assistant Vahti-apuri (Google Gemini): When you use the in-app assistant, your question and only the account facts the answer needs are sent to Google Gemini's paid API. Your email address is not sent, and the conversation is not used to train the model. Google may process the data outside the EU under the Standard Contractual Clauses (SCC).
• Transactional email (Resend): Account and service emails (e.g. confirmations, call summaries and notifications).
• Mobile push delivery (Expo, Apple APNs, Google Firebase Cloud Messaging): Delivery of push notifications and incoming-call alerts to your device.
• Error monitoring (Sentry, EU): Technical error reports from the website, without call content; phone numbers are removed and no user identities are sent.
• Website analytics (Vercel Web Analytics and Speed Insights): Anonymous visitor statistics and page performance measurements for the public pages of vahti.co (see Section 9).
• Stripe: Payment processing and subscription management (you interact with Stripe at checkout; we do not store card numbers).
• Google: Optional Google Calendar connection (OAuth), when you choose to connect it.
• Microsoft: Optional Outlook Calendar connection (OAuth / Microsoft Graph), when you choose to connect it.
• Apple: App Store distribution and iOS push notifications (APNs).
• HubSpot: Optional CRM sync, only if you connect it.

Where a service requires you to sign in or connect an account (calendar, payments, CRM), that provider's own privacy policy also applies to data processed in their systems.

7. Data retention

Call content (AI summaries and transcripts) is deleted automatically based on your retention setting: you choose 1–90 days (default 30 days) in the app settings or web dashboard. Lowering the setting deletes your older content immediately; a daily job deletes the rest. Call metadata (caller number, name, company, duration, tag, timestamp) is kept for history and billing as long as your account is active. Copies already sent to HubSpot, email, or push notifications before deletion are not recalled. Caller names remembered by Vahti follow the same retention as call content (see Section 2). Contact data is retained as long as your account is active. Upon account deletion, all personal data is deleted within 30 days. Payment records are retained as required by Finnish accounting law (6 years). Vahti-apuri questions are deleted after 12 months.

8. Data storage and security

All data is encrypted in transit (TLS) and at rest. Our primary application and database infrastructure is hosted within the EU. Some telephony and AI processors may process data outside the EU/EEA; in those cases we rely on appropriate transfer safeguards (see Section 6). Access to personal data is restricted to authorized personnel only.

9. Cookies and website analytics

We use essential cookies for authentication and session management. Analytics cookies are used only with your consent. You can manage cookie preferences through the cookie banner or your browser settings.

Vercel Web Analytics and Speed Insights: To understand how our public website is used and how fast it loads, we use Vercel Web Analytics and Vercel Speed Insights. They do not use cookies or store anything on your device, and they do not collect personal data that identifies you. Vercel acts as our processor. Collected data:

• Web Analytics: the page address without any query parameters or fragments, the referring website, country, and device, browser and operating system type
• Speed Insights: page loading and performance metrics (such as Core Web Vitals), the page address without query parameters, and device and browser type

Visits are counted only in aggregate, without a persistent identifier, and you are not tracked across other websites. Pages behind sign-in (the web app, dashboard and admin), password reset and invitation links and the post-purchase page are not measured at all. The legal basis is our legitimate interest in maintaining and improving the website (Art. 6(1)(f)).

10. SMS and text messages

Vahti only forwards voice calls. Text messages, SMS verification codes (2FA), and other non-voice communications are never intercepted, forwarded, or accessed by Vahti in any way.

11. Your rights (GDPR)

As a user in the EU/EEA, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request restriction of data processing
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest

To exercise any of these rights, contact support@vahti.co. We will respond within 30 days.

12. Children's privacy

Vahti is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.

13. Supervisory authority

If you believe your personal data is being processed in violation of data protection legislation, you may file a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman
PL 800, 00531 Helsinki, Finland
tietosuoja.fi

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email. The latest version is always available at vahti.co/privacy. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact

For questions about this privacy policy or your data, contact us at support@vahti.co.

16. Google API Services

Vahti's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Vahti does not use Google user data to develop, improve, or train generalized or foundational AI/ML models. We request only read-only calendar access and process only event start and end times together with an all-day flag; event titles, descriptions and attendees are not requested or stored.