Privacy Policy

Last updated: October 16, 2026

1. Controller

Muntasir Alabdali, trading as BookedCall AI, Christian-Kruse-Str. 1, 24118 Kiel, Germany. Email: [email protected]. No data protection officer is appointed because none is legally required.

2. Data we process

• Business contacts (name, business email, phone, company, messages) when you contact us or we contact your business. Legal basis: Art. 6(1)(b) GDPR (contract/pre-contract) and Art. 6(1)(f) (legitimate interest in B2B communication). You can object at any time.
• Callers of our clients: phone number, voice, call recordings, transcripts, name, address, problem description and appointment details. We process these on behalf of our client (the business you called) as a processor under Art. 28 GDPR. Our client decides the purposes and is your primary contact.
• Demo line callers: the same data, processed by us to run and improve the demo. Legal basis: Art. 6(1)(f) GDPR.
• Website: this site uses no cookies, no analytics and no tracking. This website is hosted by Cloudflare, Inc. (Cloudflare Pages), 101 Townsend St, San Francisco, CA 94107, USA. When you visit the site, Cloudflare technically processes connection data (e.g. IP address, date and time, requested page, browser information) to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable website). Data may be processed in the USA; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. See Cloudflare's privacy policy.

3. Service providers (processors)

• Vapi (Vapi Inc., USA): voice AI, telephony, recordings and transcripts. AI speech and language models it uses may be operated by its sub-processors.
• Cal.com (Cal.com Inc., USA): appointment booking.
• Telegram (Telegram Messenger Inc. / FZ-LLC): internal alerts and call summaries to the business owner.
• Cloudflare (Cloudflare, Inc., USA): website hosting and delivery.
• Google (Google Ireland Ltd. / Google LLC): email (Gmail) and calendar notifications.

Some providers are located in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on EU Standard Contractual Clauses (Art. 46 GDPR).

4. Retention

Call recordings and transcripts are deleted after at most 90 days unless the client requests a shorter period or longer storage is legally required. Booking data is kept as long as the client relationship requires. Business correspondence and invoices are kept as required by German commercial and tax law (up to 8–10 years).

5. Your rights

Under GDPR you have the right to access, rectification, erasure, restriction, data portability and objection, and to lodge a complaint with a supervisory authority, e.g. the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Kiel. US residents may have similar rights under state laws (e.g. California); we honor such requests regardless of state. We do not sell or share personal information for advertising. Contact us at the email above.

6. Call recording notice

Calls answered by the assistant are recorded and transcribed. Callers are told at the start of the call that the call may be recorded.