Servus KI privacy policy
This is a convenience translation. The legally binding version of this document is the German one.
1. Controller, scope and status
1.1 Controller
HerzensApp GmbH, Raiffeisenstraße 54, 8010 Graz, Austria. Email: [email protected].
1.2 Scope
This privacy policy applies to the AI phone assistant "Servus KI", to the associated web and app interfaces, to the AI test number and to functions provided through interfaces such as calendar and CRM connections. It describes which personal data is processed, for which purposes, on which legal basis, to whom data is passed on and how long it is stored.
1.3 Status
09.07.2025.
1.4 Data protection officer
No data protection officer has been appointed, as there is no legal obligation to do so. The contact address given in section 1.1 is available for all data protection matters.
2. Roles and responsibilities
2.1 Principle
As a rule Servus KI acts as its own controller within the meaning of Art. 4(7) GDPR for the provision and operation of the service. Customers such as medical practices are controllers in their own right towards their callers, who are the customers' customers. There is no joint controllership.
2.2 Test and demo hotline
For test or demo scenarios on behalf of a customer, Servus KI may act as a processor under Art. 28 GDPR. In that case a data processing agreement forms the basis.
2.3 Customers' consent and information duties
Lawful call recording, obtaining and documenting any consent required, and information duties towards callers are the customer's own responsibility.
2.4 Demo number
When the AI test number is called, processing and recording are assumed and carried out exclusively for demonstration purposes. The legal basis is consent, which is assumed through actively dialling the demo number.
3. Purposes of processing and legal bases
3.1 Operating the phone assistant and handling calls
Servus KI processes data to be reachable, to answer calls efficiently, to recognise the request, to transfer to staff where applicable and to produce call summaries where activated. The legal basis is Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR.
3.2 Transcription and AI processing
Servus KI uses speech recognition and language models to transcribe calls, understand content and generate answers. The legal basis is Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR.
3.3 Call recording
Recording takes place only if this function is activated by the customer. The legal basis is Art. 6(1)(a) GDPR.
3.4 Transactional SMS
Where needed, Servus KI sends transactional SMS, for example appointment confirmations. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
3.5 Billing and payment
Customer data is processed for contract handling and payment. The legal basis is Art. 6(1)(b) GDPR. For tax and commercial law obligations Art. 6(1)(c) GDPR applies.
4. Categories of personal data
4.1 Phone data and metadata
Processed data includes phone numbers, times and durations of connections, signalling data, technical identifiers, DTMF input as well as error and access logs.
4.2 Content data
Depending on the configuration, audio content is processed only where recording is activated. Independently of that, transcripts, voluntary statements and call summaries may arise.
4.3 Special categories under Art. 9 GDPR
Special categories of personal data are not deliberately collected. Where such information arises through statements made during a call, it is used only to handle the call. No profiling takes place.
4.4 Master data and communication
For contract handling, name, email and, where applicable, billing and delivery data are processed.
4.5 Integrations
Servus KI can optionally be connected to customer systems such as calendar, CRM or helpdesk applications.
5. Origin of the data
5.1 Directly from the caller
Data comes from the caller themselves, for example through the call, DTMF input or a reply by email or SMS.
5.2 From the customer
Data may be provided by the customer, for example appointment slots, CRM IDs or knowledge bases.
5.3 Technical logs
In addition, technical connection and error logs arise from operating the infrastructure.
6. Recipients and service providers
6.1 Hosting and compute
Servus KI uses hosting in the European Union at Hetzner Online GmbH in Germany.
6.2 Real-time media and streaming
Servus KI uses LiveKit in Germany and limits operation to the European Union through region pinning.
6.3 Telephony
Servus KI uses Twilio for the telephony connection (SIP trunking).
6.4 SMS
Transactional SMS are sent via Infobip with EU routing.
6.5 Speech recognition and speech synthesis
Deepgram with an EU endpoint is used for speech recognition. ElevenLabs can optionally be used for speech synthesis.
6.6 Language models
Servus KI uses Microsoft Azure OpenAI within the EU Data Boundary and EU Data Residency.
6.7 Payment
Payments are handled by invoice or through Stripe.
7. Third-country transfers and the EU-only option
7.1 EU-only operation
By default Servus KI uses EU regions for all core components.
7.2 Exception: ElevenLabs
If ElevenLabs is optionally used for text-to-speech, processing may take place outside the EEA. Customers can choose the EU-only option by deactivating ElevenLabs.
7.3 Legal instruments
Where transfers to third countries are necessary in individual cases, standard contractual clauses and, where applicable, the Data Privacy Framework are used.
8. Retention and deletion
- Billing and payment data: seven years
- Connection data (CDR, Twilio, logs): twelve months
- Transcripts and call summaries: ninety days
- Audio recordings in production: thirty days, only where recording is activated
- Demo recordings: fourteen days
- SMS logs: ninety days
- Server, error and access logs: one hundred and eighty days
9. Technical and organisational security
9.1 Technical measures
Servus KI uses transport encryption throughout (TLS, SRTP). Data at rest is encrypted. Access is role based with multi-factor authentication.
9.2 Organisational measures
Servus KI works with a roles and permissions concept on the need-to-know principle, with defined onboarding, offboarding and incident response processes.
9.3 Tenant separation
Data is logically isolated per customer through separate databases or schemas.
10. Rights of data subjects
10.1 Rights
Data subjects have the right to information, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.
10.2 Exercising rights
Requests can be addressed to [email protected].
10.3 Deadlines
Servus KI handles requests within one month as a rule.
11. Website and cookies
11.1 Hosting
Web content is hosted inside the EU.
11.2 Analytics and tracking
Google Analytics with Consent Mode v2 and the Meta Pixel are only set after consent through a cookie banner.
11.3 Usage analysis with Microsoft Clarity
After consent to analytics cookies, Microsoft Clarity is used, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Without that consent Clarity is not loaded.
Clarity records the visit to this website in order to understand how the pages are used and to improve them. It captures interactions such as mouse movements, clicks and scrolling, the pages viewed, the referring source, an approximate location based on the shortened IP address, and details of device, operating system and browser. Session recordings and heatmaps are produced from this data.
Input into form fields is masked by Clarity by default and is not transmitted in clear text. The phone number entered on this website for a callback is therefore not recorded by Clarity; it is processed solely for the callback itself (see section 12).
The legal basis is consent under Art. 6(1)(a) GDPR. Consent can be withdrawn at any time through the cookie settings; withdrawal takes effect from the next page view and does not affect the lawfulness of processing carried out until then. Microsoft may also process data in the United States; Microsoft is certified under the EU-US Data Privacy Framework. Further information is available in Microsoft's privacy statement at https://privacy.microsoft.com/en-gb/privacystatement.
11.4 Contact forms
Contact forms capture name, email, phone number and message in order to handle enquiries.
12. AI test number (demo)
12.1 Purpose
The AI test number serves to demonstrate how Servus KI works.
12.2 Legal basis
By actively calling the demo number, consent to the processing is assumed.
12.3 Deletion
Recordings of the demo number are deleted after fourteen days.
13. No automated individual decisions and no profiling
Servus KI makes no decisions based solely on automated processing that produce legal effects. No profiling takes place.
14. Contact and supervisory authority
14.1 Contact
14.2 Supervisory authority
Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna. Website: https://www.dsb.gv.at.