Data processing agreement
How we process your callers’ data for you, and what we owe you for it. This agreement is part of the customer terms.
This agreement is written in English. The German, French, Italian, Portuguese and Spanish versions are translations for convenience; where they differ, the English version governs.
Parties
This agreement is part of the Oraklo customer terms, between:
- the client (the “Controller”); and
- the provider named in our Impressum, trading as Oraklo (the “Processor”, “we”).
Provider address: being set up; contact us at support@oraklo.app.
Roles and law
Roles. For the personal data of your callers and website-chat visitors, you are the controller and we are your processor (DSG art. 5 lit. j and k; GDPR art. 4(7) and (8)).
Law. “Data protection law” means the Swiss DSG and DSV and, where it applies, the GDPR. The GDPR applies in particular to clients established in Liechtenstein and to data subjects in the EEA.
What we process, and why
The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1 (GDPR art. 28(3)).
Your instructions
What your instructions are. We process the data only on your documented instructions (GDPR art. 28(3)(a)). Your instructions are:
- the customer terms and this DPA;
- the configuration of your assistant;
- the settings you choose on your page, for example your message channel and level of detail.
This also applies to transfers abroad, which are made only as clause 9 describes.
Only what you could do yourself. We process the data only as you yourself would be allowed to (DSG art. 9 al. 1 lit. a).
- We do not use it for our own purposes.
- We do not use your callers’ conversations to train AI models.
- Quality checks of the assistant’s answers are done for you, to improve your assistant.
Unlawful instructions. If we think an instruction breaks data protection law, we tell you (GDPR art. 28(3), final subparagraph).
Legal duties. If the law obliges us to process data in another way (for example an order from an authority), we tell you before we do so, unless the law forbids it.
Confidentiality of our people
Everyone who can access your data is bound to confidentiality in writing, or by law, before access is granted (GDPR art. 28(3)(b)).
Professional secrecy (medical, dental, therapy and care practices, and other secret-bearers)
Scope. This clause applies if you, or the people working for you, are bound by professional secrecy. Examples: art. 321 of the Swiss Criminal Code (doctors, dentists, chiropractors, pharmacists, psychologists, physiotherapists and other health professions, and their auxiliaries), cantonal health law, or the law of Liechtenstein.
We act as your auxiliary. We act as your auxiliary (Hilfsperson) within the meaning of art. 321 no. 1 of the Swiss Criminal Code.
- We keep secret everything we learn about your patients or clients while providing the service.
- We use it only to provide the service to you.
- We disclose it to no one, except the sub-processors in Annex 2, to the extent each one needs it for its task, or where the law obliges us.
The same duty for everyone involved. We bind everyone who has access to the same secrecy, in writing. With our sub-processors we agree confidentiality terms that are at least as protective as this clause, as far as each provider’s terms allow.
Messages for secret-bearers. No call content goes to a message channel for secret-bearers: the choice of more detail is not offered to health businesses, and the customer terms forbid it to every other secret-bearer (customer terms clause 6.2). Messages after a call then contain only the caller’s number, the time, and whether a call back was asked for and whether the call is urgent.
Your own duty stays with you. Your own duty of secrecy, and the decision whether using Oraklo fits it, remain with you. That includes whether you must inform patients or clients or ask for their consent.
No time limit. This clause continues without time limit after the contract ends.
Health data and other sensitive data
Callers may tell the assistant about their health, religion or other matters. These are sensitive data (DSG art. 5 lit. c; GDPR art. 9(1)). We treat every call record as possibly containing sensitive data:
- it is kept only for the retention period in clause 13;
- it is used only for your service;
- it is protected by the measures in Annex 3.
It is your duty to judge whether you need a data protection impact assessment (DSG art. 22; GDPR art. 35). We help you with the information you need (clause 11).
Security
We take the technical and organisational measures described in Annex 3 (DSG art. 8; DSV art. 1 to 3; GDPR art. 32). We may improve them, but we may not lower the level of protection.
Sub-processors
Your authorisation. You authorise us in general to use the sub-processors in Annex 2 (DSG art. 9 al. 3; GDPR art. 28(2)). Annex 2 is also published, kept current, on our legal page.
New or replaced sub-processors. We tell you by e-mail at least 30 days before we add or replace a sub-processor that processes your callers’ data. You can object, with reasons, within those 30 days. If we cannot address your objection, you may end the contract free of charge before the change takes effect. For a short-notice change needed for security or continuity, the notice may be shorter, and we explain why.
The same obligations apply to them. We impose data protection obligations on each sub-processor in a contract, by accepting the provider’s data processing terms. Those obligations must be as protective as this DPA, as far as possible (GDPR art. 28(4)).
Transfers abroad
Where we transfer, and on what basis. We transfer personal data abroad only on one of these bases:
- to a country that the Swiss Federal Council lists as adequate (DSV art. 8 and Annex 1; DSG art. 16 al. 1); or
- with one of the safeguards in DSG art. 16 al. 2, for example standard data protection clauses recognised by the FDPIC, which are the EU standard contractual clauses with the Swiss adaptations; or
- for data under the GDPR, under GDPR art. 44 to 46.
Annex 2 names the country of each sub-processor.
Data from the EEA. For data from Liechtenstein or the rest of the EEA, we process in Switzerland and Germany. Switzerland is recognised as adequate by the European Commission (Decision 2000/518/EC). Onward transfers to the United States are made only on one of the bases in clause 9.1.
Channels you choose
If you instruct us to deliver messages after a call to a channel you choose (Telegram, or your e-mail address), we deliver them there on your instruction.
- Telegram Messenger Inc. is the controller for what happens on Telegram, and it is not our sub-processor.
- Telegram offers no data processing agreement for these messages.
- Its messages are not end-to-end encrypted.
- Copies in your chat are outside our deletion.
What we deliver:
- By default: only the caller’s number, the time, whether the caller wants a call back and whether the call is urgent, and a link to your dashboard.
- Only if you choose it, and never for secret-bearers (clause 5.4): a short reason or a short summary.
We store only your chat ID and the delivery status.
Assistance
Requests from data subjects. If a data subject asks us directly to exercise their rights, we pass the request to you within 5 working days and do not answer it ourselves, unless you instruct us to. We help you answer, using the dashboard or by hand (GDPR art. 28(3)(e); DSG art. 25 ff.).
Your other duties. We help you with security, breach notification, impact assessments and prior consultation of the authority (DSG art. 22 to 24; GDPR art. 32 to 36), with the information available to us.
Cost. Assistance beyond what the dashboard does can be charged at an hourly rate, if we agree it with you in advance. Assistance needed because of our own breach is free.
Sentence for your own privacy notice. You may use it as it stands:
“When you call us, your call may be answered by an automated assistant from our provider Oraklo. The call is transcribed (not recorded as audio) so that we receive your message. The transcript, your number and the time of the call are deleted after 30 days. Oraklo processes these data on our behalf, with service providers in Switzerland, the EU and the United States; the list is at oraklo.app/legal#subprocessors.”
Data breaches
We tell you without undue delay, and we aim to do so within 48 hours of becoming aware of a breach of data security that affects your data (DSG art. 24 al. 3; GDPR art. 33(2)).
The notice gives, as far as known at the time:
- the nature of the breach;
- the data and the people affected;
- the likely consequences;
- the measures taken or proposed.
Missing information follows as soon as it is available (DSV art. 15; GDPR art. 33(3) and (4)).
Deletion and return
During the contract. Call records (transcript, time, caller number, message) are deleted automatically 30 days after the call, and website chat records 30 days after the last message.
When the contract ends. The remaining call records are deleted at the latest 30 days after the end. Encrypted backups can keep a copy for up to 35 more days, after which it is overwritten. You can ask us for a copy of your records before the end, and we delete earlier if you ask (GDPR art. 28(3)(g)).
Number registration. When the contract ends, we ask Twilio to delete your number registration, unless Twilio must keep it by law.
Legal retention. We keep data longer only where the law obliges us to.
Information and audits
We make available the information you need to show that this DPA is complied with (GDPR art. 28(3)(h)):
- this DPA;
- Annex 2 and Annex 3;
- once a year, answers to your reasonable written questions.
You may have an on-site audit carried out:
- at your own cost;
- at most once a year, unless there has been a breach;
- with 30 days’ notice;
- by an independent auditor bound to confidentiality, during working hours, and without access to other clients’ data.
Record of processing
We keep a record of the processing we carry out for you (DSG art. 12; GDPR art. 30(2)).
Liability
Liability under this DPA follows clause 11 of the customer terms. Liability towards data subjects that cannot be limited by law (for example GDPR art. 82) is not limited by the customer terms.
Term and precedence
This DPA runs as long as we process your data. Clauses 5, 13 and 16 continue after the contract ends.
If this DPA and the customer terms conflict, this DPA prevails on data protection.
Annex 1: Description of the processing
Data subjects:
- people who call your assistant;
- visitors who use your website chat (if offered);
- your staff, where named in your assistant’s configuration.
Types of data:
- the caller’s phone number (caller ID), and the number called;
- call audio, in transit only, not stored;
- the transcript of the call;
- date, time and duration of the call;
- the name, the reason for the call and the wanted time, as the caller gives them;
- the message and the booking request;
- website chat text.
Sensitive data: possible. Callers can say things about their health or other sensitive matters (clause 6).
Nature of the processing:
- real-time speech recognition, language-model response and speech synthesis;
- storage of the call record;
- display in your dashboard;
- deletion;
- delivery of the message after a call to the channel you chose;
- translation of a summary where you chose summaries.
Purposes:
- answering your calls;
- taking messages and booking requests;
- showing you the records;
- checking the quality of your assistant’s answers for you;
- delivering messages to you.
Duration: the term of the customer terms, plus the deletion periods in clause 13.
Annex 2: Sub-processors
This list is generated from the same source as the list on our legal page, so the two are always the same. It names every third party that can process data for the service, what it does, where it runs and which data it receives. Some of them receive none of your callers’ data, as their row says. Telegram is listed so that nothing is hidden; it is not our sub-processor (clause 10).
5 of these have a processing region we have not confirmed yet. Until we have, treat them as outside the EU.
| Provider | What it does | Where it runs | Data |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting and storage | Frankfurt, Germany (eu-central-1) | Everything the service stores: account data, assistant configuration, call and chat records. |
| Amazon SES (AWS) | Sending the emails the service owes you | Frankfurt, Germany (eu-central-1) | Your email address, your business name, and the single-use link that signs you in to your own page. That link IS the credential, which is why this entry matters more than its size suggests. |
| LiveKit | Real-time audio transport | Self-hosted on the AWS instance above | Live call audio in transit. Not stored by this component. |
| OpenAI | Language model that composes the assistant’s replies | United States | The conversation text of a call or chat, plus the assistant’s instructions. |
| Microsoft Azure OpenAI | Backup language model, used when OpenAI does not answer in time | Region not confirmed | The conversation text of a call or chat, plus the assistant’s instructions — only when the backup is used. |
| Microsoft Azure Speech | Speech to text | Switzerland North | Caller audio, converted to text. |
| Microsoft Azure Speech (text to speech) | Voice of German and Portuguese assistants, and backup voice of English assistants | Switzerland North | The text the assistant is about to speak. For an English assistant, only while the backup voice is on. During the setup of a German or Portuguese assistant, also the greeting preview: your business name and your assistant's name. |
| Deepgram | Backup speech recognition, used when Azure Speech stalls; being removed before the first client | United States | Caller audio, converted to text — only when the backup is used. |
| Cartesia | Voice of English assistants, and backup voice of German and Portuguese assistants | United States | The text the assistant is about to speak. For a German or Portuguese assistant, only while the backup voice is on. |
| Twilio | The phone line that carries calls to the assistant: the Swiss (+41) number, and the SIP trunk to our server (contracting entity: Twilio Ireland Limited) | Ireland (IE1) for call routing; account data in the United States (Twilio's default region US1) unless the IE1 data region is enabled | Call audio in transit, and the caller’s and the called number. |
| Telnyx | Legacy test line: the phone line of our one US test number, which reaches the demo assistant | Region not confirmed | Call audio in transit, and the caller’s and the called number — only for calls to that test number. No client call and no Swiss (+41) number goes through Telnyx. |
| Stripe | Payments | United States (Stripe Payments Europe is the contracting entity) | Your name, email, business name, VAT or UID number if you give one, and your card — which Stripe holds; we never see it. |
| OpenRouter | Routes the onboarding reader of your website, and of the files you add, to its language model | United States | The public text of your own website, read once during onboarding, and any price list, menu or flyer you add during the setup, to fill in your assistant’s facts. |
| Anthropic | Language model that reads your public website, and the files you add, during onboarding | United States | The public text of your own website and the files you add during the setup (price list, menu, flyer), once, during onboarding. |
| Google (Places API) | Looks up your business’s public listing during onboarding | United States | Your business name and town, once, during onboarding. |
| TypeSafe | Checks whether the facts read from your website look plausible and complete, during onboarding, while this check is switched on | Region not confirmed | Your business name and country, and the opening hours, services, phone number, address and description read from your website — once per website read, during onboarding. |
| Telegram | Alerts to the operator; and, only if you connect it, the message to you after a call | Not stated by Telegram (Telegram Messenger Inc., established outside the EEA) | Operator alerts: your business name, plan, country, trial end date and our record number; for a demo visitor, the business name, business type and language. Operator alerts never carry your email address, your phone number or the content of a call. Only if you connect Telegram for call messages (off until you do): for each real call, the caller’s phone number, the time, whether the caller wants a call back and whether it is urgent, and a link to your dashboard; never the transcript. Only if you choose it, and never for health businesses: also a short reason, or a short summary of the call, which can name the caller. These messages are not end-to-end encrypted, and the copy in your chat stays there under Telegram’s rules after we delete the call record. Telegram offers no data processing agreement for these messages; you choose this channel. |
| Microsoft Azure AI Translator | Translates the short call summary in the message to you, only if you choose the summary level (never offered to health businesses) | Switzerland or the EU (region set by AZURE_TRANSLATOR_REGION) | The short call summary (up to 600 characters; it can name the caller and what was said), once per real call, only for a client who chose the summary level and whose language is not English; never the transcript. According to Microsoft’s documentation, text sent for translation is not stored. |
Annex 3: Technical and organisational measures
We list here only measures we have confirmed. We add others when they are confirmed.
- Location: everything the service stores is on our server at Amazon Web Services in Frankfurt, Germany.
- Data minimisation: calls are not recorded as audio; messages after a call are minimal by default; the choice of more detail is not offered to health businesses.
- Deletion: call records are deleted automatically after 30 days; encrypted backups are overwritten after at most 35 more days.
- Access: you sign in to your page only with a single-use code or link sent to your e-mail address.
- Incidents: we handle breaches of data security within the timelines of clause 12.