Privacy Policy

Internal note: This policy is a technical starting draft and does not replace legal advice. Please have it reviewed by a lawyer or data protection consultant before publication — especially the placeholder under Controller (Section 1) and the still-open contractual basis with Vapi (Section 5).

1. Controller

[ALEX: ENTER NAME/COMPANY NAME + STREET NO. + POSTAL CODE CITY, AUSTRIA HERE], email: info@ki-works.eu (hereinafter "ki-works", "we").

2. Who is responsible for what?

This policy covers two different roles:

Website visitors and prospects (e.g. the contact form on this page): here, ki-works is the controller within the meaning of the GDPR.
Guests of our restaurant/business customers who make phone reservations or orders: here, the respective business (e.g. the restaurant) is the controller; ki-works processes the data on its behalf as a processor (Art. 28 GDPR). The business informs its guests independently; ki-works provides the business with the relevant notices and the phone recording notice for this purpose.

3. What data we process

Category	Examples	Purpose
Website usage	Page views (no analytics cookies set)	Providing the website
Contact inquiries	Name, business, email, phone, message	Processing your inquiry
Guest data (on behalf of the business)	Name, phone number, reservation/order details	Taking reservations/orders
Raw call data	Call recording, transcript	Creating the reservation/order, quality assurance — deleted after 7 days
Customer login data	Login email, encrypted password	Access to the dashboard

4. Legal bases

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) for reservations/orders and customer inquiries; legitimate interest (Art. 6(1)(f) GDPR) in operating and improving the service, e.g. quality assurance of phone calls.

5. Recipients and processors

We use the following service providers to deliver our service:

Anthropic (Claude API), USA — Processing conversation content to create summaries and analyses.
Vapi Inc., USA — Technical handling of phone calls, speech recognition, recording.
Twilio Inc., USA/EU — Phone numbers and SMS delivery.
Contabo GmbH, Germany — Server hosting (database, application).
Email hosting provider — Sending notification emails.

For transfers to Anthropic and Twilio in the USA, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which automatically form part of the respective terms of use or data processing agreements. For Vapi, we are currently reviewing the corresponding contractual basis.

6. Storage period

Call recording and transcript: automatically deleted after 7 days.
Reservation and order data: stored for the duration of the business relationship or the respective business's statutory retention obligations.
Contact inquiries: deleted once processed, unless a statutory retention obligation applies.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Please contact info@ki-works.eu or — for guest data — the respective business directly. You also have the right to lodge a complaint with the Austrian data protection authority ( dsb.gv.at ).

8. Cookies

This website does not use analytics or tracking cookies. For technically necessary settings (e.g. your theme or language choice, your login to the customer dashboard) we use only local browser storage (localStorage) — unlike a cookie, this does not automatically send data to our server and therefore does not require consent. Via the cookie banner or the "Cookie settings" link in the footer, you can still choose between "necessary only" and "accept all" — as a precaution in case we use analytics or marketing services in the future. You can change your choice there at any time.

9. AI transparency

Conversations with our AI roles (e.g. taking phone reservations) are clearly identified to guests at the start of the call as automated, AI-powered communication (Art. 50 EU AI Act). ki-works provides the business with the corresponding notice text.