Privacy and data
Which data bhomy stores during a call, where it is processed, when it is deleted and which contracts apply.
On the phone, people share a lot: names, addresses, requests, sometimes health data. This page summarises how bhomy handles this data. The binding documents are the data processing agreement and the privacy policy linked below.
Roles
You decide what your agent is used for and which data it asks for. That makes you responsible for the calls with your callers. bhomy processes the data on your behalf, on the basis of the data processing agreement (DPA), which is part of your contract.
What is stored during a call
| Data | Stored | Purpose |
|---|---|---|
| Call audio | no | The call is not stored as an audio recording |
| Transcript | yes, 30 days | Reading it back in the call history, summary, automations |
| Data captured by the Context Extractor | yes, 90 days | Email, SMS and webhooks after the call |
| Connection data: numbers, time, duration | yes, for the duration of the contract | Billing and call history |
| Logs of SMS and emails | yes | Troubleshooting in the Logs tab |
| Telephony event messages | yes, 7 days | Troubleshooting connection problems |
Retention periods
bhomy deletes transcripts and captured data automatically when the periods above expire, without you having to do anything. You can delete individual calls yourself at any time via Delete call in the call history.
If a caller refuses recording, the Automatic transcript deletion on refusal setting in the Personality tab makes sure that no transcript is stored and no data is extracted for this call. We recommend leaving it switched on and specifying in the prompt how the agent should continue, for example: "If the caller refuses, offer a callback from the team."
When your contract ends, we delete all data in your account 30 days after our notification. Until then you can export it, see End of contract.
Where the data is processed
We run telephony, the agent and the database in data centres in Frankfurt am Main. For speech recognition, the language model and speech output, we work with specialised providers, some of them based in the USA. Which providers these are, what we use them for and on what basis data is transferred is set out in the list of sub-processors in the DPA.
Disclosure of AI
The templates for the greeting and the prompt already include the notice that an AI system is speaking. If you write your own prompt, keep this notice.
Professionals bound by secrecy
Medical practices, law firms, tax advisers and other professionals bound by professional secrecy receive a confidentiality undertaking from us under § 203 of the German Criminal Code (StGB). To request it, write to us at datenschutz@bhomy.ai.
Further safeguards
| Area | Implementation |
|---|---|
| Transmission | Connections between browser, dashboard and services are encrypted |
| API keys | We only store them as a hash. A lost key cannot be displayed, only created anew |
| Identity verification | Stripe checks the ID document. We do not retrieve images or ID data and only store whether the check succeeded |
| Support access | Only after your approval, for at most 24 hours, every change logged |
| Two-factor authentication | Available for every account, mandatory for partner accounts |
Contracts and documents
| Document | Content |
|---|---|
| Data processing agreement (opens in a new tab) | bhomy's obligations as processor, sub-processors, technical and organisational measures |
| App privacy policy (opens in a new tab) | Which data bhomy processes about you as a customer |
| Terms and conditions (opens in a new tab) | Contract terms, duration, cancellation |
Our team answers questions about data protection at datenschutz@bhomy.ai.
Was this page helpful?