Privacy Policy
This is an English translation of the Czech original. In case of any discrepancy, the Czech version prevails.
1. Who we are (controller)
The AI Recepce service (the “Service”) is operated by, and personal data is controlled by:
Roman Lexa
Company ID (IČO): 67605516
Registered office: Osadní 32, 170 00 Prague 7, Czech Republic
E‑mail: info@viamo.ai
The Service operates under the Viamo brand; technical and e‑mail infrastructure runs on the viamo.ai domain. We are not registered for VAT. We have not appointed a Data Protection Officer — please contact us at info@viamo.ai in all matters.
2. Two roles: when we are a controller and when a processor
The Service lets businesses (our customers) receive phone calls and messages handled on their behalf by a voice AI agent and a shared inbox. We therefore distinguish two levels:
- We are the controller — for data of our direct customers (businesses and sole traders using the Service): registration, billing, sign‑in, account operation.
- We are a processor — for the content of communication from end users (callers and writers), which we receive and process on behalf of the customer. The controller of that data is the customer (the business). If you called or wrote to a business that uses the Service, please exercise your rights primarily with that business.
3. What data we process
3.1 Data of Service customers (we are the controller)
- Identification and contact: name, e‑mail, phone, company ID, billing address.
- Sign‑in: e‑mail and a secured password (stored only as a cryptographic hash).
- Payment: payment and credit history. We neither process nor see payment card details — these are handled exclusively by the Stripe payment gateway.
- Operational: Service usage records, settings, security logs.
3.2 Content of end‑user communication (we are a processor on the customer’s behalf)
- Callers’ phone numbers.
- Call recordings and their transcripts.
- AI call summaries and sentiment / action‑needed assessments.
- Message content from channels: WhatsApp, Facebook Messenger, Instagram, Telegram, Viber, SMS, e‑mail and web chat.
- Booking data created during a call or chat (time slot, service, contact).
3.3 Technical data of web chat visitors
When the web chat widget is used, we process: IP address, approximate location derived from the IP address, browser type, operating system and device, language, screen resolution, time zone, referring page and entry URL. This gives the operator context and protects against abuse.
3.4 Push notifications
If you use the mobile app, we process a device token to deliver notifications (via Expo / APNs / FCM).
4. Why we process data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and administering the Service to the customer | performance of a contract — Art. 6(1)(b) |
| Processing calls, messages and recordings on the customer’s behalf | under a data processing agreement; the basis towards the end user is determined by the customer |
| Invoicing, accounting, taxes | legal obligation — Art. 6(1)(c) |
| Securing the Service, preventing abuse | legitimate interest — Art. 6(1)(f) |
Call recording: callers are informed about recording at the start of the call. The customer, acting as controller, is responsible for establishing an appropriate legal basis towards its own callers.
Processing by artificial intelligence: we pass call/chat content to a language model provider solely to process the specific request (transcription, summary, agent reply). We select providers and modes that do not use this data to train their models.
5. Who we share data with (processors)
We use vetted providers, each covered by appropriate contractual safeguards. Some are based outside the EU (mainly in the USA); such transfers rely on the European Commission’s Standard Contractual Clauses (SCC), or on EU‑US Data Privacy Framework certification. Transfers to the United Kingdom rely on the European Commission’s adequacy decision.
| Provider | Purpose | Region |
|---|---|---|
| Twilio Ireland Ltd. | telephony, numbers, SMS | EU / USA |
| Speechmatics (Cantab Research Ltd.) | speech recognition in phone calls | United Kingdom — processed in the EU region |
| Cartesia | speech synthesis, fallback speech recognition | USA |
| OpenAI | speech‑to‑text transcription of voice messages | USA |
| OpenRouter | language models (summaries, replies, sentiment) | USA |
| Cloudflare (R2) | storage of recordings, attachments and photo documentation | EU — guaranteed data residency |
| Stripe | payment processing | USA / EU |
| Postmark | sending and receiving e‑mail | USA |
| Google (Calendar, Drive, Play) | calendar bookings, knowledge base source documents from Drive, Android app distribution | USA / EU |
| Apple | iOS app distribution, push | USA / EU |
| Expo | push notifications, app builds | USA |
| Railway | application and database hosting | EU (Amsterdam) / USA |
| Meta Platforms Ireland | WhatsApp, Messenger, Instagram channels | EU / USA |
| smsbrana.cz | SMS delivery — only if the business selects this gateway | CZ / EU |
| Fakturoid s.r.o. | invoicing documents — only when Fakturoid mode is enabled | CZ / EU |
| Retino.cz s.r.o. | returns and complaints — only when the integration is enabled | CZ / EU |
| Anthropic PBC | Claude AI assistant — only when the customer activates the AI assistant (MCP) connection | USA |
| OpenAI | ChatGPT AI assistant — only when the customer activates the AI assistant (MCP) connection | USA / EU |
AI assistant connection (MCP): if a customer activates the optional connection to an AI assistant — Claude (claude.ai) or ChatGPT — in their account, they thereby instruct us to transfer data from their reception, including personal data of their own customers, to the operator of that assistant (Anthropic or OpenAI respectively) in response to their queries. Without activation, no data is transferred to these companies. For work involving personal data we recommend business plans only (Claude Team/Enterprise, ChatGPT Business/Enterprise) — these include a data processing agreement (DPA), standard contractual clauses for transfers outside the EU, and a no‑training commitment (these contractual protections may not apply on free and personal plans). The highest level of protection (managed retention and further controls) is offered by the Enterprise and Edu editions.
We do not sell data and do not share it for third‑party marketing. We may also disclose data to public authorities where required by law.
6. How long we retain data
- Account and settings: for the term of the contract and thereafter for the period necessary for settlement.
- Invoicing and accounting records: for the period required by law (accounting records generally 10 years).
- Recordings, transcripts and messages: for the period the Service is provided, according to the customer’s settings; we delete them on termination or on request.
- Web chat technical data and blocking records: for a limited period necessary for security.
7. How we protect data
We encrypt sensitive data and access keys (AES‑256‑GCM), separate data at the database level per customer (Row‑Level Security), and all communication runs over encrypted connections (HTTPS/TLS). Access to data is limited to the roles that require it.
8. Your rights
To the extent provided by the GDPR, you have the right to: access your data, rectification, erasure, restriction of processing, data portability, to object, and to withdraw consent. Submit requests to info@viamo.ai. If your data is processed on behalf of a business you called or wrote to, please contact that business first.
You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.
9. Cookies and similar technologies
The web chat widget stores a session identifier in the browser that is necessary for the conversation to work. The marketing website may use necessary cookies and, with consent, analytics cookies — see the Cookie Policy (Czech only).
10. Changes to this policy
We may update this policy. The current version is always available on this page with its effective date. We will notify customers of material changes by appropriate means.