AI phone agents · Last updated: 26 October 2026
A GDPR-conscious AI phone agent, with the paperwork published
What the voice agent does
- Answers calls in German and English, around the clock or outside your opening hours.
- Takes bookings and requests and writes them into your calendar or system.
- Answers common questions from information you approve.
- Forwards the caller to a person when needed, and sends confirmations by SMS or email where you want that.
A GDPR checklist for any AI voice agent
- A data processing agreement (Art. 28 GDPR) with the provider.
- A list of sub-processors, where each processes data, and the legal basis for any transfer outside the EU.
- A privacy notice for callers and AI disclosure at the start of the call.
- Retention limits for recordings, transcripts and customer data.
- Business API access to language models, not consumer apps.
The longer version: is AI automation GDPR compliant?
Sub-processors, in English
This is an English summary of Anlage 2 of our AVV. The services used for your project are marked in your own AVV; not every project uses all of them.
| Service | Purpose | Where data is processed | Transfer basis |
|---|---|---|---|
| Vapi (Vapi Inc.) | Runs the phone agent: call handling, conversation flow, recording, transcript | USA | Standard contractual clauses (Vapi DPA) |
| ElevenLabs (Eleven Labs Inc.) | Voice output (text to speech) | USA, EU data residency depending on contract | EU-US Data Privacy Framework and standard contractual clauses |
| Twilio (Twilio Inc. / Twilio Ireland Ltd.) | Phone number, call forwarding, SMS | USA, EU | EU-US Data Privacy Framework and standard contractual clauses |
| OpenAI (OpenAI Ireland Ltd.) | Language model for the conversation | USA | Standard contractual clauses (OpenAI DPA) |
| Anthropic (Anthropic PBC) | Language model for texts, summaries, assistants | USA | Standard contractual clauses (Anthropic DPA) |
| Transcription (Deepgram or Gladia, per project) | Speech to text | USA or EU, depending on the provider | Standard contractual clauses where needed |
| Supabase (Supabase Inc.) | Database for bookings, orders and call logs | EU (Frankfurt region) | Standard contractual clauses for support and operations from the USA |
| Vercel (Vercel Inc.) | Hosting of web pages, dashboards and interfaces | EU and USA | EU-US Data Privacy Framework and standard contractual clauses |
| Make (Celonis s.r.o.) | Automations such as notifications and calendar entries | EU | Not needed |
| Google Workspace (Google Cloud EMEA Ltd.) | Email, calendar, documents | EU and USA | EU-US Data Privacy Framework and standard contractual clauses |
Digiflowhub runs no servers of its own. Language models are used through business API access, whose inputs the providers say are not used for training.
Caller notice and AI disclosure
Every call starts with the agent saying that it is an AI (EU AI Act, Art. 50). Your privacy notice for callers explains the recording and processing. Staff who work with the system get a short introduction, as the AI Act expects (Art. 4).
Retention and deletion
Retention is set per project in the AVV. The default in our template is 30 days for recordings and transcripts and 90 days for reservation and order data, then deletion unless you instruct otherwise. When the contract ends, all personal data is deleted or returned within 30 days at the latest.
Pricing
- Build: from EUR 499, one-time, for the design, setup and testing of your phone agent.
- Scale: from EUR 299 a month, including 1,000 call minutes a month, then EUR 0.20 per minute. Cancel anytime.
- Discovery is free. See all plans on the AI automation agency page.
Frequently asked questions
Is an AI phone agent GDPR compliant in Germany?
It can be, when there is a data processing agreement (AVV) under Art. 28 GDPR, a documented list of sub-processors and transfer bases, limited retention, a privacy notice for callers, and AI disclosure at the start of each call. Digiflowhub provides all of these and publishes the AVV template. Whether your setup is compliant also depends on how you use it, so we recommend a quick review with your data protection officer or lawyer.
Where is call data processed?
In the EU where possible. The database for bookings, orders and call logs runs in the EU (Frankfurt region), and Make runs in the EU. Some services, such as the call platform Vapi and the language models from OpenAI and Anthropic, process data in the USA under standard contractual clauses or the EU-US Data Privacy Framework. Voice output (ElevenLabs) and telephony (Twilio) run in the USA or the EU depending on the contract. The services used for your project are marked in your AVV.
Do callers have to be told they are talking to an AI?
Yes. Under Art. 50 of the EU AI Act, people must be told when they interact with an AI system. Our phone agents say so at the start of every call.
Do you sign an AVV / DPA?
Yes. Every client gets a data processing agreement under Art. 28 GDPR. The template is published in German at digiflowhub.com/avv.
How long are call recordings kept?
You decide. The default in our AVV template is 30 days for recordings and transcripts and 90 days for reservation and order data, after which they are deleted unless you instruct otherwise.