Privacy Policy

Last updated: September 5, 2026

1. Data controller

Vahti Technologies Oy (Business ID: 3643264-9)
Mechelininkatu 21 B 51, 00100 Helsinki, Finland
tuomas@vahti.co

2. Data we collect

We collect the following data to provide the Vahti service:

Account data: Email address, password (encrypted), and name when you create an account.

Contact list: Phone numbers and names from your device contacts. These are synced to our servers to identify known callers. We store only names and phone numbers — no photos, addresses, or other contact fields.

Call data: For each call screened by Vahti, we store the caller's phone number, the caller's stated name and company, reason for calling, an AI-generated summary, an AI-generated transcript, call duration, and timestamp. We do not record or store the raw audio of calls.

Calendar data: When you connect a calendar (Google Calendar, iPhone Calendar, or Outlook Calendar), we access event times and titles to determine your availability for call routing. Google and Outlook calendar data is received via push notifications from Google/Microsoft. iPhone calendar events are synced from your device to our database.

Payment data: Payment processing is handled by Stripe. We do not store credit card numbers. We store your Stripe customer ID and subscription status.

Device data: Push notification tokens, device platform (iOS/Android), and app version for delivering notifications.

Technical data: IP address, device type, operating system, and basic usage analytics.

3. How we use your data

Provide call screening: identify callers, route calls, generate summaries
Route calls based on calendar availability (busy/free) and VIP contact status
Send push notifications when a call has been screened
Display call logs and summaries in the app and web dashboard
Process payments and manage subscriptions
Communicate with you about your account and service updates
Improve our AI models and service quality

4. Legal basis for processing (GDPR)

Contract (Art. 6(1)(b)): Processing call data, contacts, and account data is necessary to provide the service
Legitimate interest (Art. 6(1)(f)): Service improvement, security, and analytics
Consent (Art. 6(1)(a)): Calendar integrations, analytics cookies

5. AI and call processing

Calls are answered by an AI voice agent that:

Identifies the caller's name, company, and reason for calling
Creates a text-based summary — calls are not stored as audio recordings
Uses third-party AI services for speech recognition and synthesis (see Section 6)
Does not make decisions on your behalf — you decide whether to call back

6. Third-party services

We use the following third-party services to operate Vahti:

Supabase (EU) — Database, authentication, and user management
Telnyx (US/EU) — Telephony, phone numbers, and call routing
LiveKit (EU-Central) — AI voice agent hosting and session management
ElevenLabs — Text-to-speech synthesis (AI voice)
Deepgram — Speech-to-text recognition
Stripe — Payment processing and subscription management
Vercel (EU) — Web application hosting
Google — Google Calendar integration (OAuth)
Microsoft — Outlook Calendar integration (OAuth, Microsoft Graph API)
Apple — Push notifications (APNs), App Store distribution
Firebase — Android push notifications (FCM)
Resend — Transactional email delivery

7. Data retention

Call content (AI summaries and transcripts) is deleted automatically based on your retention setting: you choose 1–90 days (default 30 days) in the app settings or web dashboard. Lowering the setting deletes your older content immediately; a daily job deletes the rest. Call metadata (caller number, name, company, duration, tag, timestamp) is kept for history and billing as long as your account is active. Copies already sent to HubSpot, email, or push notifications before deletion are not recalled. Contact data is retained as long as your account is active. Upon account deletion, all personal data is deleted within 30 days. Payment records are retained as required by Finnish accounting law (6 years).

8. Data storage and security

All data is encrypted in transit (TLS) and at rest. Our primary infrastructure is hosted within the EU (Supabase EU, Vercel EU, LiveKit EU-Central). Access to personal data is restricted to authorized personnel only.

9. Cookies

We use essential cookies for authentication and session management. Analytics cookies are used only with your consent. You can manage cookie preferences through the cookie banner or your browser settings.

10. SMS and text messages

Vahti only forwards voice calls. Text messages, SMS verification codes (2FA), and other non-voice communications are never intercepted, forwarded, or accessed by Vahti in any way.

11. Your rights (GDPR)

As a user in the EU/EEA, you have the right to:

Access: Request a copy of all personal data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Request restriction of data processing
Portability: Receive your data in a machine-readable format
Objection: Object to processing based on legitimate interest

To exercise any of these rights, contact tuomas@vahti.co. We will respond within 30 days.

12. Children's privacy

Vahti is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.

13. Supervisory authority

If you believe your personal data is being processed in violation of data protection legislation, you may file a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman
PL 800, 00531 Helsinki, Finland
tietosuoja.fi

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email. The latest version is always available at vahti.co/privacy. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact

For questions about this privacy policy or your data, contact us at tuomas@vahti.co.