# Privacy Policy

> How Deduxer S.R.L. handles personal data on the Onist website, the demo line, the app and the calls the receptionist answers.

_Deduxer S.R.L. · Onist · The short version_

- Customer data remains yours. We process it on your instructions using the configured providers and safeguards described in the Privacy Policy. Section 14 of the Terms is the processing agreement.
- Onist does not record calls. The caller's audio reaches the speech provider only while the call lasts and is not stored. Transcripts and summaries stay in the business's account until the business deletes them or the account.
- Some providers work from outside the EU. OpenAI, which runs the AI on calls, processes data in the United States under the Standard Contractual Clauses. Section 6 lists every provider, what it receives and where.
- Essential cookies keep you signed in and remember your language and display choices. Vercel counts page views without cookies. Optional product analytics stays off until you allow it, and you can change that on this page.

## 1. Who is responsible

Deduxer S.R.L., tax id RO50140604, registered office at București, România, makes and operates Onist. For everything in this policy where we decide why and how data is processed, we are the controller. Write to [legal@onist.ro](mailto:legal@onist.ro) for anything about your data.

This policy covers the Onist website, the demo line and callback requests, the chats on Onist's own WhatsApp number, the accounts of the businesses that use Onist, the calls, messages and bookings the receptionist handles for them, and the booking page. It applies from 31 October 2026.

## 2. Two roles: when we decide, and when a business decides

We act in two roles, and your rights depend on which one applies.

- We are the controller for the website, the demo line, the callback form, the guide on Onist's own WhatsApp number, the accounts and billing of our customers, our own marketing and support. Sections 3 to 12 apply in full.
- We are a processor when the receptionist answers a call to a business that uses Onist, books an appointment, sends an SMS or a WhatsApp message, or when someone books through that business's booking page. The business is the controller and decides what happens to the data. We process it on the business's instructions under the data processing agreement in our [Terms of Service](/terms#dpa).

If you called a business that uses Onist, here is what happened to your call. The receptionist told you at the start of the call that it is an AI. The call was not recorded. A transcript and a short summary went to the business, together with your phone number and what you asked for, so that the business can call you back, book you in or answer your question. The business can delete the call at any time. We do not keep your voice, we do not build a voice profile, and we do not contact you on our own behalf.

To exercise your rights over such a call, contact the business. If you cannot reach it or it does not answer, write to us and we will help.

If you write to Onist's own WhatsApp number and have no Onist account, you are talking to Onist's AI guide, and we are the controller. The guide tells you in its first answer that it is an AI. It answers your questions about Onist and, if you ask, opens an account for your business on that WhatsApp number, right in the chat, but only after you tap the button under the message that links to the Terms and this policy. We keep your WhatsApp number, the chat and what you tell the guide about your business, such as its name, trade, city and website and your first name, plus what the map search found about it. Send STOP and we never write to you again; START opens the chat again. If you stop replying in the middle of a conversation, the guide sends you at most one reminder, between 45 minutes and 3 hours later, and none after you tap "Not now", unless you ask for the account again. Section 8 says how long the chat is kept.

## 3. What data we collect

Customer account data includes contact and business information, services, staff, availability and configuration. The enabled phone, booking and messaging features process customer contact details, service or vehicle details, appointments, messages, consent evidence, and call transcripts and summaries. Call audio is processed while the call lasts and is not stored. Paddle handles payment credentials; Onist receives billing status and transaction references. Temporary authentication messages contain a verification link and expire from the delivery queue.

## 4. Why we use it and on what legal basis

| Purpose | Data | Legal basis |
| --- | --- | --- |
| Run the receptionist, the app, the calendar, the messages and the booking page for a business | Account and business details, calls, messages, bookings | Performance of the contract with the business (Art. 6(1)(b) GDPR); for callers' data, the business's instructions as controller |
| Run the demo line and call you back when you ask | Demo audio, phone number, IP address | Our legitimate interest in showing the product to people who ask for it (Art. 6(1)(f)); you start the call or the request yourself |
| Answer people who write to Onist's own WhatsApp number about Onist, and open an account in the chat when they ask | WhatsApp number, the chat, what they say about their business (name, trade, city, website) and their first name, what the map search found, the record of the tap that accepts the Terms | Steps taken at the person's request before entering into a contract (Art. 6(1)(b)); for answering questions about Onist, our legitimate interest in explaining the product to people who ask (Art. 6(1)(f)). The account is opened only after the person accepts the Terms and this policy with a tap |
| Assign and register phone numbers, verify forwarding | Business details, identity documents where required | Performance of the contract; legal obligation where the carrier's regulator requires identification (Art. 6(1)(c)) |
| Bill, invoice and keep accounts | Billing details, invoices, payment status | Performance of the contract; legal obligation under tax and accounting law |
| Keep the service secure and prevent abuse: rate limits, fraud checks, blocking spam | IP addresses, usage logs, call metadata | Legitimate interest in protecting the service, our numbers and our customers |
| Count visits to the website | Pages visited, referrer, country, browser and device type. Visitors are told apart by a hash that changes every day | Our legitimate interest in knowing which pages work (Art. 6(1)(f)). No cookies |
| Understand how the product is used and fix problems | Optional coarse navigation events, sanitized error reports | Consent for optional analytics; legitimate interest in diagnosing service failures. No caller content or advertising profiles |
| Answer support requests and disputes | Your messages, account details, the calls concerned | Performance of the contract; legitimate interest in defending claims |
| Comply with the law and requests from authorities | What the request requires | Legal obligation |

## 5. AI, call audio and your voice

The receptionist says it is an AI at the start of every call. The caller's audio goes to the speech provider only while the call lasts, so the AI can understand the request and answer. On lines with Andrei's voice that provider is OpenAI. On lines set to another voice, Soniox turns the caller's speech into text, Anthropic's Claude writes the reply and Cartesia or ElevenLabs speaks it, depending on the voice; TypeSafe may check whether words picked up in the background were said to the receptionist. Onist does not record calls and does not store the audio. It keeps the transcript and a short summary.

On Onist's own WhatsApp number the replies are written by Claude, Anthropic's AI: the owner's assistant for an owner who linked their number, and the guide described in section 2 for anyone else. If we switch the owner's assistant on WhatsApp back to OpenAI, which runs the assistant in the app, OpenAI writes those replies instead; section 6 says what it then receives. The guide says it is an AI in its first answer and never claims to be a person. A photo or a PDF sent there is read by Claude, which writes a short description of it; Onist keeps the description, not the file. A voice note is transcribed by Kapso or, when Kapso sends no transcript, by OpenAI.

Someone who taps Call on Onist's own WhatsApp number talks to the same AI receptionist as on a phone call, and it says it is an AI the same way. Meta connects the call and LiveKit carries its audio while it lasts; Onist does not record it and keeps the transcript and a short summary, as for a phone call.

On WhatsApp the owner's assistant can remember what the owner tells it about themselves and the shop, such as a day off or who the mechanic is, so that later chats know it. Each memory is one short line in the owner's account, visible only to that owner and their assistant. The owner can ask the assistant to forget any of them; section 8 says how long they stay.

Onist does not use customer content to train AI models, and our providers may not use it to train theirs.

The receptionist is not an emergency service. A caller who describes an emergency in which a life is in danger is told to hang up and call 112.

## 6. Who we share data with

Each provider below receives only the data its job needs, under a contract that binds it to our instructions. Paddle is the exception: as merchant of record it sells the service in its own name and is a separate controller for payment data.

| Provider | What it does | Data | Where | Safeguard |
| --- | --- | --- | --- | --- |
| Supabase | Database, sign-in and file storage | Account data and all customer data: contacts, bookings, messages, transcripts, summaries, files | EU, Frankfurt | Stored in the EU. Standard Contractual Clauses for support access from the United States |
| Vercel | Hosts the website and the app, and counts page views without cookies | Requests and the data they carry, IP addresses, page views | Functions in the EU, Frankfurt. Global edge network, including the United States | Standard Contractual Clauses |
| Railway | Runs the phone agent that connects each call to the AI | Call audio while the call lasts, transcripts, tool requests | EU, Amsterdam | Processed in the EU. Standard Contractual Clauses for support access from the United States |
| LiveKit | Carries the live audio of phone calls, of WhatsApp calls to Onist's number and of the website demo | Call audio while the call lasts, phone numbers | EU | Processed in the EU. Standard Contractual Clauses for support access from the United States |
| Telnyx | Phone numbers, call routing and SMS | Phone numbers, call audio in transit, call records, SMS text, the business documents a carrier asks for | United States, with points of presence in the EU | Standard Contractual Clauses |
| OpenAI | The AI that listens and speaks on calls, call summaries, the assistant in the app, reading a business's website during setup, web search during calls, finding a business on the web when the map search finds nothing, transcribing the voice notes sent to Onist's WhatsApp, and the owner's assistant on WhatsApp if we switch it back from Claude to OpenAI | Call audio while the call lasts, transcripts, the business's configuration, assistant chats, WhatsApp voice notes, content from connected apps, the business name and place searched for. If the owner's WhatsApp assistant is switched to OpenAI, also the owner's WhatsApp messages with Onist and what the assistant remembers | United States | Standard Contractual Clauses |
| ElevenLabs | Voice for the website demo when the main AI is unavailable, the voice on lines set to an ElevenLabs voice, and the backup voice when Cartesia is unavailable | Demo and call audio while the conversation lasts, the text of the replies it speaks | United States | Standard Contractual Clauses |
| Cartesia | Speaks as Corina or Claudiu on calls and in the website demo | The text of the replies it speaks | United States | Standard Contractual Clauses |
| Anthropic | Claude, the AI that writes the replies on lines set to an ElevenLabs or Cartesia voice, answers on Onist's WhatsApp (the owner's assistant and the guide for new businesses) and reads the photos and documents sent there | Transcripts, the business's configuration, the results of the receptionist's lookups, WhatsApp messages with Onist and the photos and documents in them, what the owner's assistant remembers, content from connected apps | United States | Standard Contractual Clauses |
| Soniox | Turns the caller's speech into text on lines set to an ElevenLabs or Cartesia voice | Call audio while the call lasts, the business's names and services as vocabulary | United States | Standard Contractual Clauses |
| TypeSafe | Checks whether words picked up in the background (a TV, other people) were said to the receptionist. When enabled, also reads the business name and description given during onboarding, to suggest the trade and the questions to ask | The caller's latest words as text and the receptionist's last sentence. During onboarding: the business name and description, without email addresses or phone numbers (no personal data) | United States | Standard Contractual Clauses |
| Google | Places API, which finds a business on the map from its name | The business name and place searched for | United States | Standard Contractual Clauses |
| Kapso | WhatsApp messaging platform: sends and receives the WhatsApp messages and transcribes voice notes | Phone numbers, the text of WhatsApp messages, and the photos, PDFs, voice notes and locations sent in them | United States | Standard Contractual Clauses |
| Meta (WhatsApp) | Delivers WhatsApp messages and connects WhatsApp calls | Phone numbers, message text, and the photos, PDFs, voice notes and locations sent in them; the audio of a WhatsApp call while it lasts | EU and United States | Standard Contractual Clauses |
| Composio | Connects the apps a business chooses to connect, such as email, calendar and messages | Access tokens for those apps, what they return or send to Onist (such as new emails, messages and bookings), and what the business approves sending through them (such as emails, replies, events and rows) | United States | Standard Contractual Clauses |
| Resend | Sends email, such as sign-in codes and notices | Email addresses and email text | United States | Standard Contractual Clauses |
| Paddle | Checkout, payments, invoices and sales tax, as merchant of record | Name, email, billing address, transaction records. Card details stay with Paddle | United Kingdom | European Commission adequacy decision for the United Kingdom |
| Sentry | Error reports | Technical error details with caller content removed | EU, Frankfurt | Stored in the EU. Standard Contractual Clauses for support access from the United States |
| PostHog | Recordings of visits to the public pages and the signup page; optional product analytics in the app, only after you allow it; error reports from every page | Scrolls, pointer movement and clicks on the page with every form field masked; coarse page and button events; for error reports, the error type, a message with addresses and numbers removed and where in our code it happened. No cookies, no IP address, no call content | EU, Frankfurt | Stored in the EU. Standard Contractual Clauses for support access from the United States |
| Meta (Ads) | Measures whether a visit from a Facebook or Instagram ad led to an action on the site | The ad click id, IP address, browser and the action's name (30 seconds on the site, a start button, a demo, an account opened) | EU and United States | Standard Contractual Clauses |
| TikTok (Ads) | Measures whether a visit from a TikTok ad led to an action on the site | The ad click id, IP address, browser and the action's name (30 seconds on the site, a start button, a demo, an account opened) | EU, Singapore and United States | Standard Contractual Clauses |

When you choose to sign in with Google or Apple, or to connect a Google or Apple calendar, that company receives what the connection needs, under its own terms, as a service you picked. The same goes for the apps a business connects through Composio, such as Gmail, Outlook, Google Sheets, Google Drive, Instagram, Facebook pages and Calendly: each receives what the assistant asks of it and what the owner approves sending through it, and nothing is sent or saved there until the owner approves a confirmation card that shows it in full. We give data to authorities only when the law requires it.

## 7. Where data is stored and transferred

The database, the files, the phone agent, error reports and optional analytics are in the European Union: Supabase in Frankfurt, Railway in Amsterdam, LiveKit's EU region, and Sentry and PostHog in Frankfurt.

Some data leaves the European Economic Area. The AI on calls runs on OpenAI's global service in the United States, and ElevenLabs, Cartesia, Anthropic, Soniox, TypeSafe, Telnyx, Google, Kapso, Composio, Meta, Resend and Vercel's edge network also process data there. Each of these transfers relies on the Standard Contractual Clauses adopted by the European Commission, in the provider's data processing terms. Paddle processes payment data in the United Kingdom, which the European Commission recognises as giving adequate protection.

Write to [legal@onist.ro](mailto:legal@onist.ro) for a copy of the safeguards that apply to a provider.

## 8. How long we keep it

- Call audio is not stored. It exists only while the call lasts.
- Transcripts, summaries, bookings, contacts and messages stay while the business's account exists, unless the business deletes them sooner. The owner can delete the whole account from the app, which removes this data at once. When a business stops using the service, the data stays available for export for at least 30 days.
- The owner's conversation with the assistant, in the app and on WhatsApp, is kept as the assistant's chat history: each message is deleted 90 days after it was written, and so is each confirmation card. The messages an owner sends to Onist's WhatsApp number also wait in a queue until the assistant answers; that copy is deleted 14 days after the message arrived. Both are deleted at once with the account.
- What the owner's WhatsApp assistant remembers stays until the owner asks it to forget or deletes the account. Each owner keeps at most 200 memories; past that, the one saved longest ago is deleted.
- Chats with the guide on Onist's WhatsApp number from people without an account are deleted after 90 days without a new message. After a STOP, the chat and what the guide noted are deleted 90 days later and only the number is kept, marked as opted out, so that we never write to it again. If the person opens an account in the chat, the chat and what the guide noted are deleted together with the account. If that number sent STOP, the opt-out mark stays, without the chat or anything the guide noted, so that STOP still holds. Otherwise, a later message from that number starts a new chat with the guide, under the same rules.
- Technical records of how a call was connected are deleted after 30 days.
- Sign-in emails: the contents expire within one hour, the delivery record after 30 days.
- Invoices and accounting records stay as long as tax law requires.
- A deleted account leaves an audit entry that it existed and the record of which legal terms were accepted. Both hold identifiers only.
- Database backups roll off on a fixed schedule. If one is ever restored, the deletions made since then are applied again before access reopens.

## 9. Security

Database policies keep each business's data apart. Files are private and open only through links that expire. Changes are audited and application logs leave out caller content. Data is encrypted in transit and at rest. No call audio is stored. Keeping data in the EU does not remove international transfers, which section 7 describes.

## 10. Your rights

Under the GDPR you can ask us to:

- tell you what data we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it, or object to a use based on legitimate interest;
- give it to you, or to another provider, in a machine-readable form;
- withdraw a consent you gave; that does not affect what was done before.

Write to [legal@onist.ro](mailto:legal@onist.ro). We may ask you to confirm who you are. We answer within one month; if a request is complex we may take up to two more months and we tell you. Exercising your rights is free.

If you called a business that uses Onist, send your request to that business, which is the controller. If you cannot reach it, write to us and we pass the request on and help.

You can complain to a supervisory authority. In Romania that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, [dataprotection.ro](https://www.dataprotection.ro). In Italy it is the Garante per la protezione dei dati personali, [garanteprivacy.it](https://www.garanteprivacy.it). You can also complain to the authority of the country where you live.

## 11. Cookies

Essential cookies keep you signed in, remember your language and display choices, and remember for 30 days an offer link you arrived through. Vercel Web Analytics counts page views and a few button clicks without cookies. On the public pages and the signup page, PostHog hosted in the EU records without cookies how you move through the page (scrolls, clicks), with every form field and your own words in the demo masked, so we can see where visitors stop; the app behind sign-in is not recorded. Optional product analytics in the app stays off until you allow it and never captures form contents, call audio, messages or booking receipt tokens. If you decline analytics on this page, your visits are not recorded either. If you arrived from a Meta ad, our server sends Meta the click id, your IP address and browser when you spend 30 seconds on the site, press a start button, start a demo or open an account, so we know which ads bring customers.

## 12. Children

The website, the demo and the app are for adults acting for a business. We do not knowingly collect data from anyone under 18. A minor may still call a business that uses Onist; in that case the business is the controller and the call is handled like any other. If you think we hold data about a child without a valid basis, tell us and we delete it.

## 13. Changes to this policy

We update this policy when the service or the law changes. The date at the top tells you which version you are reading. For changes that matter, we email our customers before they take effect.

## 14. Contact

Deduxer S.R.L., București, România. Tax id RO50140604, trade register J2024003862236. Email [legal@onist.ro](mailto:legal@onist.ro). Phone [+40 745 077 209](tel:+40745077209).

---

[HTML](https://onist.ro/en/privacy) · [https://onist.ro](https://onist.ro/en)