Privacy Policy

The controller of your data is SALIMOV Monoprosopi I.K.E. (SALIMOV Single-Member Private Company), which operates the CITT platform:

• Legal representative: Wladimir Neuberger (CEO)
• Registered office: Katehaki Metochi 1, 71500 Ano Kalessa, Heraklion, Crete, Greece
• General Commercial Registry (GEMI) no.: 172274527000 · Greek tax number (AFM): EL802214800
• Phone: +30 698 5822367 · Website: www.salimov.de
• Email: office@salimov.de

For any matter relating to the protection of your personal data, contact us at: info@citt.gr or office@salimov.de

We collect the following categories of data:

• Account data: Name, business email, business name, phone number, industry sector
• Call data: Caller number, conversation transcript, summary, duration, call outcome, recording URL (where you have given consent)
• Appointments: Names and phone numbers of your customers who book appointments through your AI assistant
• Calendar data (optional Google connection): If you connect your Google Calendar, we store the email address of the Google account, the identifier of the selected calendar and an encrypted refresh token. From the calendar we read the events within a 180-day window from today, so that the AI assistant knows your availability. In addition, when the AI assistant books, changes or cancels an appointment, we create, update or delete the corresponding event in your Google Calendar — but only events the platform itself created; all your other events are only read (see section 6 for the access scope).
• Technical data: IP address, user agent, session cookies
• Payment data: We do not process card details. Payments are made by bank transfer; we retain only the invoicing details (company name, tax number (AFM), competent tax office (DOY), address) and the payment reference of the transfer

• Performance of a contract (Art. 6(1)(b)): We process your data to provide the CITT services you have signed up for
• Consent (Art. 6(1)(a)): Call recording and the sending of marketing emails take place only with your prior consent
• Legitimate interest (Art. 6(1)(f)): For the security of the platform and the prevention of abuse

• Providing, maintaining and improving the AI voice assistant services
• Call analysis to produce insights and reports
• Invoicing and subscription management
• Technical support and service notifications
• Marketing communications (only with your consent)

We do not sell your data. We share it only with the recipients below, and only as far as running the service requires:

• ElevenLabs (USA): Voice AI (processor) — the live call audio, the transcripts, the caller's number, the knowledge documents you upload and the recordings sent for transcription. The language model that handles the conversation is invoked through ElevenLabs and is operated by Anthropic (Anthropic PBC, USA). The transfer rests on the Standard Contractual Clauses in their DPA and on the EU-US Data Privacy Framework.
• Telnyx (USA): VoIP telephony infrastructure and storage of the call recordings (processor) — the audio of recorded calls stays on Telnyx infrastructure; the provider has not yet confirmed the processing region. SMS is routed via Telnyx only as a fallback
• seven.io (seven communications GmbH & Co. KG, Germany): SMS delivery (processor) — the recipient's number and the message text
• OpenAI (contract with OpenAI Ireland Ltd., processing by OpenAI, L.L.C., USA): AI text processing (processor) — call transcripts are sent for task extraction, translation, summarisation, CRM name extraction and contact-association suggestions, and improvement suggestions, as are the messages you send to support. The data is not used for model training.
• Resend (Plus Five Five, Inc., USA): Email delivery (processor) — the recipient address and the message content, which includes the caller's name, number and email address as well as the call summary
• DigitalOcean (USA): Application and database hosting (processor) — the application and the database we operate ourselves run in a Frankfurt (EU) data centre; data held by the other recipients listed here is at their location
• Sentry (Functional Software Inc.): Technical error tracking for the application and for your browser (processor) — technical error data; EU region (Frankfurt), no personal data sent by default
• Google (Google Ireland Ltd.): Google Calendar API — only if you voluntarily connect your calendar (processor). See section 6 for the Limited Use commitment.
• Systems you connect yourself (CRM, calendars, webhooks, partner platforms): If you connect your own system (Zoho Bigin, HubSpot, Airtable, Mews), connect your assistant to a partner platform (an order-intake platform, for example) or configure your own webhook, we transmit data there on your instruction — where the connection calls for it, that includes the full call transcript and the contact details the caller confirmed. Each such connection is switched on per account and bound per assistant. For those systems you are the controller.
• Viva.com (Viva Payments Single Member S.A., Greece): Card acceptance for topping up your credit (independent controller) — your e-mail address and name, the amount, and our order reference. No caller data and no call transcripts. Card details are entered on Viva's own payment page and never reach us.

Transfers to processors outside the EEA rest on the Standard Contractual Clauses (Article 46 GDPR). The following are additionally certified under the EU-US Data Privacy Framework (Article 45 GDPR): ElevenLabs Inc.; Telnyx LLC; Anthropic PBC; Plus Five Five, Inc. (dba Resend); DigitalOcean LLC. The following are not certified, so the Standard Contractual Clauses are their only basis: OpenAI, L.L.C.. For the following there is no transfer outside the EEA: seven communications GmbH & Co. KG; Functional Software, Inc. (dba Sentry).

Our platform's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request exactly one calendar permission, beyond identification:

• calendar.events — reading and writing events. This single permission covers both of the things your assistant needs, which is why we do not ask for a second one:
  • Read: your assistant reads your existing events so that it knows when you are busy and does not offer a time slot that is already taken.
  • Write: when the assistant books an appointment on the phone, it records it in your calendar; when the customer cancels, it removes it or marks it as cancelled. We write exclusively to events created by the platform itself — we do not modify and do not delete events created by you or by third parties.

The openid and email permissions serve solely to identify which account was connected. We do not request access to your calendar list; synchronisation always targets the connected account's primary calendar.

We expressly commit that your Google Calendar data:

• is used exclusively so that your own AI assistant knows when you are available and can offer or book appointments — and to sync to your calendar only the appointments created by the platform
• is not used for advertising and is not transferred to advertising networks or data brokers
• is not sold to third parties
• is not used to develop, improve or train non-personalized artificial-intelligence or machine-learning models — Google Workspace APIs data is not used to develop, improve or train non-personalized AI and/or ML models
• is accessible only to the account that made the connection; human access takes place only with your explicit permission, for security purposes, or where required by law

You can revoke the connection at any time from the platform settings or directly at myaccount.google.com/permissions. Upon revocation we delete the stored refresh token and the cached events of your calendar.

• Call records: The transcript, summary, insights, caller number and metadata are deleted automatically 365 days after the call. The period is the same for all accounts.
• Call recordings: Audio recordings are kept at our voice and telephony providers for operating and securing the service until they are deleted, independently of the call record. Customers have no access to audio recordings by default. The CITT administrator enables access only after the customer has accepted the extended usage agreement; otherwise the customer receives only the transcript and the summary.
• SMS text: Deleted automatically after 90 days; the delivery record remains.
• SMS delivery records: Deleted automatically after 365 days.
• Webhook events: Deleted automatically after 90 days.
• Integration debug logs and provider communication logs: Deleted automatically after 14 days.
• Other records derived from calls: Caller details on appointments, caller memories, tasks, uploaded contact lists, integration delivery records, transfer notifications, e-mail delivery records and screening sessions are retained until you delete them or your account.
• CRM records: Kept as your business history, independently of how long calls are kept. Archiving changes visibility only.
• Account data: Retained until you delete your account.
• Audit logs: Kept for accountability.
• Invoicing data: Retained for the period required by tax and accounting law.

You have the following rights regarding your personal data:

• Right of access (Art. 15): Obtain a copy of all your data — available from Settings → GDPR → Data Export
• Right to rectification (Art. 16): Edit your details from Settings → Profile
• Right to erasure (Art. 17): Delete your account and all your data — from Settings → GDPR → Delete Account
• Right to data portability (Art. 20): Receive your data in JSON format
• Right to object (Art. 21): Withdraw your consent to marketing at any time

To exercise your rights, contact us at info@citt.gr. We respond within 30 days.

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Encrypted storage of API keys
• Role-based access control (RBAC)
• Automatic deletion of the data classes with a stated period (section 7)
• Audit logging of all actions

We use only cookies that are necessary for the operation of the service (authentication). We do not use tracking or advertising cookies. The option to accept or decline cookies is shown on your first visit.

You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) if you believe that the processing of your data does not comply with the GDPR.

www.dpa.gr

We may update this Privacy Policy. We will notify you by email or in-app notification of material changes at least 30 days before they take effect.