Security and privacy at finditX
The questions data protection officers and careful owners ask, with the answers from our privacy policy. The privacy policy itself is binding.
Privacy policy as of November 10, 2026 · Read the privacy policy
Where data is stored
Where is the data stored?
Database and uploaded files are stored with Amazon Web Services in Ireland. Railway Corporation (USA) runs our API in a data centre in the Netherlands, and Vercel Inc. (USA) delivers the website from data centres in the EU. All connections are encrypted with TLS.
Who is involved in a call?
A call passes through these providers.
| Provider | Role |
|---|---|
| Twilio Inc. (USA) | Provides the phone number, routes calls and WhatsApp messages |
| finditX | Our own voice system controls the call in real time |
| AssemblyAI, Inc. (USA) | Turns speech into text |
| OpenAI (Ireland, USA) | Writes the answers |
| ElevenLabs (USA) | Generates the voice |
| Meta Platforms Ireland (Ireland) | Operates WhatsApp |
| Vapi (USA) | Controls the call, only for numbers set up before November 2026 |
| Deepgram, Inc. (USA) | Turns speech into text, only for numbers set up before November 2026 |
How does data get to the US?
If a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise we agree the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
What is stored
What does finditX keep from a call?
Phone number or account name, time, duration, the call or chat history as text, a summary and captured requests such as reservations or callback requests.
How long is data kept?
Call and chat histories are kept as long as the business keeps them in finditX or until its account is deleted. A deleted account is removed for good after 7 days. Anything we must keep for tax or commercial law is blocked until the period ends.
Is AI trained on the calls?
Under OpenAI's terms, data sent through the API is not used to train models. The other providers' own terms apply to them.
Roles and contracts
Who is responsible for the data?
You as the business are responsible for your customers' data. finditX processes it on your behalf and on your instructions (Art. 28 GDPR). Finditly Solutions UG is responsible for your own account.
Is there a data processing agreement?
Our service providers are contractually bound to our instructions (Art. 28 GDPR). For a data processing agreement with your business, write to support@finditx.com.
Is there a data protection officer?
We are not legally required to appoint one. We answer data protection questions at support@finditx.com.
Callers, sign-in and payments
Does the caller learn they are talking to an AI?
Yes. The AI says so at the start of every call, as the EU AI Act requires.
How is sign-in protected?
Sign-in is provided by Clerk, Inc. (USA). Passwords are stored there only as a hash, never in plain text.
How are payments handled?
Through Stripe (Stripe Payments Europe, Ireland). You enter your card details directly at Stripe. We only receive the payment status, the payment method with its last digits, your billing address and the invoices.
Still have a question?
Write to support@finditx.com. We answer with facts, not marketing.