Privacy Policy

This policy explains how we process personal data in connection with the odbiera.ai product and the website presenting it (the "Landing"). We state exactly what we collect, why, whom we entrust it to, and where it is physically stored.

1.Two roles: controller and processor

odbiera.ai is a multi-tenant service used by medical clinics and property-management firms, housing communities and cooperatives (the "Clients"). Depending on the type of data, we act in one of two roles:

• Controller — for the data of Landing visitors, people requesting a Demo call, Client User accounts, and correspondence with us.
• Processor — for the data of persons contacting the Client (patients, residents, vendors) processed in odbiera.ai on the Client's behalf. Here the Client is the controller, and our basis is a data processing agreement (DPA).

If you are a patient, resident or vendor and wish to exercise your rights regarding data handled in odbiera.ai, direct your request to the relevant Client (the controller); you may also write to us at hello@awesomeworks.ai and we will forward it.

2.Data we process as controller

a) Landing visitors

Technical data needed to display the site and keep it secure (including IP address, browser type, server log data).

b) Demo call

When you request a demonstration conversation with an AI agent, we process the phone number you provide and your device's IP address — to place the call and enforce abuse-prevention limits.

c) Client User accounts

Email address and a secured (argon2id-hashed) password, workspace memberships and roles, and technical login records (email and IP of a login attempt) for security purposes.

d) Correspondence

Data you provide when contacting us (e.g. by email at hello@awesomeworks.ai).

3.Data processed on the Client's behalf

While handling messages and calls for the Client, the following may be processed, depending on the content of the contact:

• phone numbers and email addresses of contacting persons;
• message content (phone, SMS, email) and voicemail content;
• transcripts of voice conversations (browser and phone) and voicemail;
• call recordings from the AI voice agent (stored at the voice-platform provider — see section 6);
• case data entered or generated during handling (e.g. unit number, report history, reply drafts, priority reasons).

The scope and purposes of this processing are determined by the Client as controller. Where the Client is a medical clinic, processing may involve health data (a special category, Art. 9 GDPR) — the Client is responsible for the appropriate legal basis. We do not use this data for our own purposes.

4.Purposes and legal bases (data for which we are controller)

• Displaying and securing the Landing, preventing abuse — Art. 6(1)(f) GDPR (legitimate interest).
• Placing a Demo call at your request — Art. 6(1)(a) (consent) and (f).
• Creating and maintaining User accounts, providing the Service to the Client — Art. 6(1)(b) (contract) and (f).
• Handling correspondence and complaints — Art. 6(1)(f), and (c) for complaints.
• Establishing or defending claims, tax and accounting obligations — Art. 6(1)(c) and (f).

5.Automation and artificial intelligence

odbiera.ai uses AI models to classify messages, set priorities, transcribe speech and prepare reply drafts. These are assistive — outbound communication requires human approval on the Client's side. We do not make decisions about data subjects based solely on automated processing that would produce legal or similarly significant effects on them within the meaning of Art. 22 GDPR.

6.Recipients and subprocessors

To provide the Service we use trusted providers to whom we entrust processing under data processing agreements. Key subprocessors:

• OpenAI — language models (classification, reply drafting), speech transcription (Whisper) and vector embeddings. Transfer outside the EEA is safeguarded by Standard Contractual Clauses (SCC) and a DPA.
• ElevenLabs — speech synthesis and the voice-agent platform; this provider stores call recordings. It provides data residency and a DPA.
• Telnyx — telephony (numbers, routing of calls and messages). Data is processed in Germany (EU). DPA in place.
• Twilio — SMS delivery (internal escalation notifications). Transfer outside the EEA safeguarded by SCC and a DPA.
• Hetzner Online GmbH — hosting of the application infrastructure and database. The server and database are located in Germany (Nuremberg data centre, EU).

A full list with data categories and processing locations is in the Subprocessor List. Data may also be disclosed to bodies authorised by law and, to the necessary extent, to our advisers.

7.Transfers outside the EEA

Some subprocessors (OpenAI, Twilio) process data outside the European Economic Area (including in the USA). In such cases the transfer relies on Standard Contractual Clauses (SCC) with additional safeguards. The hosting infrastructure (server and database) and Telnyx telephony remain within the EU (Germany). You can obtain information about the safeguards used by writing to hello@awesomeworks.ai.

8.Retention periods

• Voice call records (metadata and transcripts in the Service) — as a rule up to 30 days.
• Demo call data (phone number, IP) — up to 30 days.
• Login attempt records — about 24 hours.
• Call recordings — per the retention settings of the voice-platform provider (ElevenLabs).
• Client account, message and case data — for the term of the agreement; afterwards deleted or returned per the DPA.
• Billing data and documentation — for the period required by law and until claims are time-barred.

9.Your rights

You have the right to: access your data, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and — for data processed based on consent — to withdraw it at any time (without affecting the lawfulness of processing before withdrawal).

• For matters where we are the controller, direct requests to hello@awesomeworks.ai.
• For contacting persons' data (where we are the processor), the controller is the Client — direct your request to them; we will support its fulfilment.

You also have the right to lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

10.Cookies

The Landing uses cookies and similar technologies necessary for its operation and security and, with your consent, for analytics. You can manage cookie settings in your browser.

11.Data security

We apply technical and organisational measures appropriate to the risk, including: hard isolation of each Client's data at the database level (Row-Level Security), password hashing (argon2id), session tokens, restricting operator-panel access to a private network only, no publicly exposed database ports, and keeping access keys to external services server-side.

12.Changes to this policy

We may update this policy (e.g. when the scope of the Service, the law or the subprocessor list changes). The current version and its effective date are published on the Landing; we will inform Clients of material changes. Use of the Service is governed by the Terms of Service.