Privacy Policy

This is a convenience translation. Only the German version is legally binding. German version

Protecting your personal data matters to us. We process it exclusively in accordance with the General Data Protection Regulation (GDPR), the Austrian Datenschutzgesetz (DSG, Austrian Data Protection Act) and the Telekommunikationsgesetz 2021 (TKG 2021, Austrian Telecommunications Act 2021). This policy explains which data we process on callana.ai, for what purpose, on what legal basis, who is involved and what rights you have.

This policy applies to the website callana.ai. The Callana platform (app.callana.at) used by our customers is governed by the respective contract and the data processing agreement.

Controller

Innovationlab GmbH
Bahnhofstraße 41, 6300 Wörgl, Austria
Email: hello@callana.ai · Phone: +43 512 385015

Data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany · datenschutz@heydata.eu

Your Choice: Consent and Settings

On your first visit, we ask what the site may use beyond what is essential. Without your consent, we load no analytics or advertising services and not the voice demo. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page. Withdrawal takes effect for the future; it does not affect the lawfulness of processing carried out before then.

Hosting and Server Logs

The website runs on our own server. Whenever a page is accessed, the server processes technically necessary data: IP address, date and time, the requested address, amount of data transferred, browser and operating system (user agent) and the previously visited page (referrer). We need this data to deliver the site, find errors and fend off attacks.

Legal basis: legitimate interest in secure and stable operation, Art. 6(1)(f) GDPR.

Processor: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaka, Cyprus. The servers are located in a data center in Frankfurt am Main, Germany.

Retention period: Logs are kept for 90 days so that we can trace disruptions and attacks after the fact and maintain the quality of the site, and are then deleted automatically.

We serve the site’s fonts, images and scripts ourselves. No external font services or content delivery networks are used.

Browser Storage

We do not set any cookies ourselves. In your browser’s storage (localStorage), we store only:

• Your privacy choice (key “callana.einwilligung”) – necessary so that we do not ask you again on every visit. It remains stored until you clear your browser storage or change your choice.
• Anni’s conversation memory – only with your consent, see below.

Google cookies are set only once you consent to statistics or marketing (see “Google Tag Manager, Analytics and Ads”).

Voice Demo with Anni

On our website, you can talk to Anni, our AI assistant, directly in your browser. The widget loads only once you consent – via the banner, the settings or when you start your first conversation. Your microphone is used only during a conversation; your browser also asks for your permission separately.

Data processed: your speech (audio), text generated from it (transcript), technical connection data such as your IP address, and the page you are currently on, so that Anni can respond appropriately. If you share personal details yourself during the conversation, these are processed as well – please do not share any sensitive data.

Purpose: to show you how Callana sounds and works on the phone, to answer questions about Callana and to improve Anni’s quality.

Legal basis: your consent, Art. 6(1)(a) GDPR.

Services involved:

• Callana voice server, operated by us on servers of Hostinger International Ltd. (Cyprus) in Frankfurt am Main, Germany
• ElevenLabs for speech output and speech recognition: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA. By default, processing takes place in the USA on the basis of a data processing agreement with EU standard contractual clauses.
• Google for language understanding: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Anthropic for language understanding: Anthropic Ireland, Limited, 27/29 Orwell Road, Rathgar, Dublin 6, Ireland

In the process, data may be transferred to the USA. This is based on the adequacy decision for the EU-US Data Privacy Framework, insofar as the provider is certified, and on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Retention period: We store conversations with Anni (transcript and recording) for six months in order to review and improve Anni’s quality. After that, they are deleted or anonymized so that they can no longer be linked to you. Once you withdraw your consent, no new conversations take place; we delete conversations already stored upon request to hello@callana.ai.

Conversation memory (optional): Only if you additionally consent to this do we store a summary of your conversations exclusively in your browser for seven days, so that Anni can pick up where you left off on your next visit. This data leaves your device only when you start a new conversation. You can turn the memory off in the settings at any time; doing so deletes it.

Google Tag Manager, Analytics and Ads

We load Google Tag Manager only if you consent to statistics or marketing. It controls which of the following services run – each only to the extent you have consented to. For this we use Google’s Consent Mode: with each measurement, Google receives information on which purposes you have consented to.

Google Analytics (statistics): We learn which pages are visited, for how long, and through which channels visitors arrive, as well as which functions are used – for example, whether a conversation with Anni was started, an industry was selected in the industry finder, the calculator was used, the Help Center was searched or a form was submitted. This includes device and browser information, approximate location (derived from the IP address; Google Analytics does not store the IP address itself), page views and interactions. Cookies: “_ga” and “_ga_…”, up to two years. The data is deleted in Google Analytics after 14 months. Google Signals and sharing with advertising profiles are disabled in Google Analytics.

Google Ads (marketing): We measure whether visits via our ads on Google lead to inquiries (conversion tracking), and we can target ads more precisely. This includes click identifiers from ads, page views and the interactions mentioned above. Cookies: “_gcl_au” and other Google Ads cookies, up to 90 days.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. More information is available in Google’s Privacy Policy and under How Google uses information from sites or apps that use our services.

Withdrawal: If you turn off statistics or marketing in the “Cookie settings”, we notify Google immediately and delete the corresponding Google cookies in your browser.

Contact by Email or Phone

If you write to us or call us, we process your details (such as name, email address, phone number, company and your message) in order to respond to your inquiry.

Legal basis: initiation or performance of a contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in responding to inquiries, Art. 6(1)(f) GDPR.

Processor: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaka, Cyprus (email mailbox).

Retention period: three years after the last contact – this is generally the period within which claims can arise from a business relationship (§ 1489 of the Allgemeines Bürgerliches Gesetzbuch, ABGB, Austrian Civil Code), and it allows us to refer back to earlier conversations. If a contract is concluded, the statutory retention periods apply (generally seven years under § 132 of the Bundesabgabenordnung, BAO, Austrian Federal Fiscal Code).

Forms: Contact, Set up Callana and Partner Inquiry

If you send us one of our forms, we process the data entered (for example, name, email address, phone number, company and your message). The forms are received on our own server and sent to our mailbox hello@callana.ai.

For the “Set up Callana” form, this also includes your answers about the intended use (for example, tasks, call forwarding, systems, website, preferred availability) and – if you upload any – documents from which your agent is to learn. We use this information to prepare the setup for you; it is not passed on to any other system. Please upload only documents that do not contain sensitive personal data of third parties.

To protect against automated spam submissions, we check the forms technically without using any third-party providers. Our form log contains no IP addresses, only an identifier that changes daily and cannot be traced back.

Legal basis: initiation of a contract, Art. 6(1)(b) GDPR; for partner inquiries and for retention after the inquiry has been completed, our legitimate interest in the business relationship, Art. 6(1)(f) GDPR. You can object to this retention at any time.

Retention period: If no contract is concluded, we delete the details three years after the last contact. If a contract is concluded, the statutory retention periods apply.

Job Applications

We accept applications by email at hello@callana.ai. We process your details and documents exclusively for the application process.

Legal basis: initiation of an employment relationship, Art. 6(1)(b) GDPR.

Retention period: If no employment relationship results, we delete your documents no later than seven months after the process has been completed – this is the period within which claims can be asserted under the Gleichbehandlungsgesetz (GlBG, Austrian Equal Treatment Act). Longer retention, for example for future positions, takes place only with your consent.

Links to Other Websites

Our pages contain links, for example to the Callana platform, to partners or to tools we mention in articles. Data is transferred to the respective provider only when you follow a link; that provider is responsible for its own processing.

Disclosure and Transfers to Third Countries

We disclose your data only to the recipients named in this policy or if we are legally obliged to do so. We do not sell data and do not pass it on to third parties for advertising purposes. Transfers to countries outside the EU take place only on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or appropriate safeguards such as EU standard contractual clauses. You can check whether a US provider is certified on the Data Privacy Framework website.

Data Security

The connection to our website is encrypted throughout (HTTPS). We protect our servers with up-to-date technical and organizational measures, including strict security rules on which external content the site is allowed to load at all.

Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To do so, write to us at hello@callana.ai.

You also have the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at.

Changes

We update this policy when our website or the legal situation changes. The version published here at any given time applies.