Last updated: October 23, 2026

Privacy Policy

This policy explains what data GetHello collects, why we collect it, who helps us run the service, and the rights you have over your data. We wrote it to be read, not just linked at the bottom of a page.

1. Who we are

GetHello is an AI phone receptionist for small businesses, operated from Austria under the domain gethello.io. For anything privacy related, write to us at [email protected].

2. What data we collect

Account data:

• Email address (used as your login and for account notifications)
• Password (stored only as a salted hash, never in plain text)

Business data, what you give us when setting up your receptionist:

• Your business website URL
• The country your business operates in
• Your contact phone number

The on-site voice demo has two modes. In live mode your microphone audio is streamed to OpenAI to generate the agent’s replies; sessions are short and rate-limited, and we do not store the audio or transcripts. In browser mode speech is recognized by your browser’s own speech service and nothing leaves your device.

Calls handled for your business:

• Recordings and transcripts of calls your GetHello receptionist answers
• Call metadata such as duration, time, and caller number
• Summaries generated for you as the business owner

If you are a customer of a business that uses GetHello, your calls may be answered, recorded, and transcribed by the AI receptionist, and the business owner receives a summary. Callers are told they are talking to an AI. If you want a recording deleted, contact the business or email us and we will pass the request on.

Connected Google services. When you connect Google Calendar or Gmail in your dashboard, we access them with your consent and through your own Google account. Google Calendar is used to check availability and book appointments. Gmail is used with read, send, and label access, and no delete permission, so bookings arriving by email can be picked up. Disconnecting the service deletes the stored access tokens.

3. Why we process your data

• To deliver the service (account, business, call, and payment data): the legal basis is performance of our contract with you, Art. 6 (1) (b) GDPR.
• To keep the service secure and improve it (log data, abuse prevention): the legal basis is our legitimate interest in running a reliable, safe product, Art. 6 (1) (f) GDPR.
• Marketing emails (email): the legal basis is your consent, Art. 6 (1) (a) GDPR. Every email has a one-click unsubscribe.

4. Who else is involved

We do not sell your data. We share it only with providers that help us run GetHello, each bound by a data processing agreement:

• Cloudflare, content delivery and DNS. Keeps the site fast and protected.
• Twilio, telephony. Provides your phone numbers and routes the actual calls; during a call, the audio is streamed on to the AI provider below.
• Zadarma, backup telephony. Used only if the primary phone provider fails: fallback numbers forward calls to the business owner, and callback requests are dialed through it.
• xAI, runs the AI receptionist on phone calls: during a call, audio goes to xAI for speech recognition and for generating the spoken replies.
• OpenAI, runs the live voice demo on the site: your microphone audio is streamed there to generate the agent's replies.
• Google, connected features. If you connect Google Calendar or Gmail in your dashboard, those API calls run through your own Google account, not ours.
• Google Analytics, site usage analytics. Loads only after you accept cookies; we see aggregate stats, not individual profiles.
• Meta (Facebook Pixel and Conversions API), ad campaign measurement and retargeting. The Pixel loads only after you accept cookies. When you buy a plan, our server also sends the purchase confirmation to Meta so ad performance can be measured.
• Stripe, payments. Handles your card details; we never see or store them.
• Lava (lava.top), a second payment provider, used for paying in rubles when Stripe is not an option. We send Lava your order details and receive back the invoice and payment status.

Your account data, business data, and call recordings are stored on servers in Germany, at a hosting provider based in the EU, under our administrative control.

5. Data outside the EEA

Some of the providers above are based in the United States: xAI, OpenAI, Google, Meta, Stripe, and Twilio. When your data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework where the provider is certified, or on the Commission’s Standard Contractual Clauses. The storage of your core data in Germany (see section 4) does not change.

6. How long we keep data

• Account and business data: for as long as your account is active. After you request deletion, it is removed within 30 days.
• Call recordings and transcripts: at most 90 days, unless you as the business owner choose to keep them longer.

7. How we protect your data

The site and its APIs are encrypted in transit (TLS). Passwords are stored as salted hashes. Call recordings stay inside your signed-in dashboard. Access to production systems is limited to the people who operate the service.

If a data breach ever affects your personal data, we will notify the competent data protection authority within 72 hours where required, and inform you directly where the law requires it.

8. Your rights

Under the GDPR you have the following rights over your data. To use any of them, email [email protected] and we will respond within 30 days.

• Access: Ask for a copy of the data we hold about you.
• Rectification: Ask us to fix anything that is inaccurate or out of date.
• Erasure: Ask us to delete your data (see retention below).
• Restriction: Ask us to pause processing while something is disputed.
• Portability: Get your data in a machine-readable format to take elsewhere.
• Objection: Object to processing based on legitimate interest, including marketing.
• Withdraw consent: For marketing and connected Google services, at any time, without affecting past processing.

You also have the right to lodge a complaint with your local data protection authority. In Austria that is the Datenschutzbehörde.

9. Cookies

We use only what the site needs to work:

• Essential cookies (login session). Without them, signing in does not work.
• One consent cookie that remembers whether you accepted or declined the cookie banner, so we do not ask twice.
• Analytics cookies (Google Analytics, Meta Pixel) load only after you press Accept in the cookie banner, and never before. If you decline, nothing third-party runs in your browser: no ad networks, no cross-site profiling. The one exception is the server-side purchase event described in section 4, which happens when you buy a plan.

For a summary of our GDPR compliance, see our GDPR page.

10. Children

GetHello is a tool for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, email us and we will delete it.

11. Changes to this policy

When we change how we handle data, we update this page and the date at the top. If a change affects you materially, we will notify you by email before it takes effect.

Questions? [email protected]