İngilizce çeviri. Sadece Almanca metin hukuken bağlayıcıdır.
Pilot version, as of 03.10.2026.
ELEFUN! Inh. Gülnur Hilâl Mert, Lindenstraße 8, 74232 Abstatt, Deutschland, info@philoxa.com.
Philoxa is an AI assistant that makes phone calls, does research and handles tasks for you. For this we process the data you give us (name, phone number, Telegram ID, your requests, your saved memory) and the content of calls and chats with the assistant.
Performance of the contract (Art. 6(1)(b) GDPR) for everything needed to provide the service; your consent (Art. 6(1)(a)) for storing information in the assistant's memory and for security questions; legitimate interest (Art. 6(1)(f)) for security and abuse prevention and for conversations with third parties the assistant calls on your behalf. There are no automated decisions with legal effect (Art. 22 GDPR).
Our server is hosted by Hostinger in a data centre in Frankfurt am Main. For AI processing we use Anthropic (Claude, USA; EU standard contractual clauses) and ElevenLabs (voice and telephony, USA; standard contractual clauses), for telephony and SMS Twilio (Ireland and USA; EU-US Data Privacy Framework). Agreements under Art. 28 GDPR apply with these processors; they process data only on our instructions. Anthropic does not use data from our use to train its models. Payments are handled by Stripe (Stripe Payments Europe Ltd., Ireland; for transfers to the USA EU-US Data Privacy Framework); you enter card data only at Stripe, we never see or store card numbers. If you use Telegram, Telegram's privacy terms also apply to the transmission; Telegram is not our processor.
We only use technically necessary cookies for signing in to the app and for completing a sign-up. There are no analytics, tracking or advertising cookies and no embedded third-party services on the website; fonts are hosted on our own server. Our web server does not store access logs. To see how the website is used, we count page views and clicks without cookies and without storing IP addresses: only daily counters are kept (page viewed, link clicked, name of the referring website, device type phone or computer, approximate time on page in ranges, the tag of the ad someone came from). So that a visitor is counted only once per day, we derive a non-reversible check value from IP address and browser identifier together with a random value that changes daily; the random value and the check values are deleted after two days at the latest. Legal basis is our legitimate interest in a working, understandable website (Art. 6(1)(f) GDPR).
When the assistant calls someone on your behalf, it says at the start that it is an AI assistant. The content of the call is summarised for you. Audio recordings are not stored; the written transcript at ElevenLabs is deleted after 30 days. If you ask the assistant to put you through (for example to a hotline or an authority), it waits on hold and then connects the call to your phone.
If you request a demo call on the website, we use the phone number you enter only for this one call (consent, Art. 6(1)(a) GDPR). We only store an irreversible check value of the number and IP address to prevent abuse; it is deleted after 30 days. The call is handled by ElevenLabs and Twilio, where the transcript is deleted after 30 days.
If you connect your Google or Outlook calendar, we receive access to your calendar only, via the provider's official sign-in (OAuth): reading events to know your free time and adding appointments that you or your assistant arranged. Contacts and files are not requested. The assistant accesses your mailbox only if you additionally and explicitly allow it: reading (Outlook/Microsoft only, e.g. to find order, shipping or invoice emails; a Gmail inbox is never read) and sending emails whose exact text you approved beforehand; email content is not stored but only searched for the question at hand. The access token is stored encrypted with your own key; calendar content is not stored permanently but only fetched for the task at hand. You can disconnect at any time in the app (the token is then deleted and revoked with the provider) or revoke access in your Google or Microsoft account. The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is not used for advertising or for training AI models.
Apple (iCloud): Apple offers no separate sign-in for this. You create an app-specific password in your Apple account and enter it together with your Apple ID. We store both encrypted with your own key and use them only for your calendar (reading and adding events via caldav.icloud.com), not for email, contacts or files. You can revoke the password at any time at account.apple.com or disconnect in the app (it is then deleted).
If you enable WhatsApp in the app or in Telegram and send us the message “START …” yourself, we send you results, appointment confirmations, reminders and questions with reply buttons via WhatsApp. For this we process your WhatsApp number, your WhatsApp profile name and the content of these messages; number and name are stored encrypted with your own key. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing “STOP” or disconnecting WhatsApp in the app. Messages are sent via Twilio (processor) and WhatsApp Ireland Ltd. (Meta); data may be transferred to the USA, Twilio and Meta are certified under the EU-US Data Privacy Framework. On WhatsApp, Philoxa does not answer freely written messages with AI; you keep giving tasks via Telegram, the app or by phone. Delivery data (time, status) is deleted after 90 days.
At sign-up we confirm your mobile number with an SMS code (sent via Twilio) or by you calling us from that number or answering our call back on it. So that the free trial can only be used once per number, we store an irreversible check value of the number (not the number itself). This check value is kept even after the account is deleted to prevent abuse (legitimate interest, Art. 6(1)(f) GDPR).
If you ask the assistant to send an email or SMS, we process recipient and text and send the message only after your approval: emails via your connected mailbox (Google or Microsoft, only with your additional permission) or otherwise via our mailbox with a note that it is sent on your behalf, replies go to your email address; SMS via Twilio. For online reservations the assistant opens the provider's website in an isolated browser on our server and enters only the necessary details (name, phone number, email, date, number of people). It is submitted only after your approval; payment data and passwords are never entered. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
If you come via an invitation and store a payment method, we check whether this payment method was already used for a free period or belongs to the inviting person. For this we store an irreversible check value of the card attribute provided by Stripe (not the card number) and who invited whom. The legal basis is our legitimate interest in abuse prevention (Art. 6(1)(f) GDPR).
If a business uses Philoxa for its calls, we process the callers' data (name, number, request, call content, appointment request) on behalf of that business. The business is then the controller; our data processing agreement applies. The assistant says at the start of every call that it is an AI assistant. Voice messages after the tone are converted to text and forwarded to the business; the audio recording is then deleted.
When you sign up we store with your account which website you came from (only the name of the referring website as your browser sends it, e.g. instagram.com), campaign details from the link (utm parameters), whether you came through an invitation and, if you tell us, how you heard about us. Nothing is stored on your device for this. We use it only to understand which channels work (legitimate interest, Art. 6(1)(f) GDPR). The details are deleted together with your account.
Your data is stored encrypted with your own key. You can delete your account and all data yourself at any time (in the app or with the Telegram command /delete) or export it (/export). Call transcripts at ElevenLabs are deleted after 30 days. Deleted data disappears from our encrypted backups after 14 days at the latest. We keep billing data for the statutory retention periods.
Access, rectification, erasure, restriction, data portability, objection and the right to lodge a complaint with a supervisory authority (for us: the State Commissioner for Data Protection of Baden-Württemberg). Write to info@philoxa.com.