We use carefully selected service providers who process personal data on our behalf as processors under data-processing agreements pursuant to Art. 28 GDPR. The main recipients are:
- Supabase: authentication and database hosting (account and application data), hosted within the European Economic Area (or the United Kingdom, which benefits from an EU adequacy decision).
- Stripe: payment processing and storage of payment-method data (Stripe Payments Europe, Ltd. / Stripe, Inc.).
- Vercel: hosting and content delivery of the website and application (Vercel Inc.).
- Tuta (Tutao GmbH): hosting of our email mailboxes (e.g. our support address): emails you send us are stored encrypted on Tuta’s servers in Germany.
- Resend: sending emails to customers and to our support mailbox, for example customer notices, messages from the contact form, and replies reported in the Veyllo app (Resend, Inc., United States). When a user reports a reply in the Veyllo app, we transmit the reported reply, the question it answered, which sources the reply drew on (such as web search or notes), the selected reason, any note, and the app version to our support mailbox, without a user identifier and without the rest of the chat; we do not store the report in our database.
- Cloudflare (Turnstile): protection of our forms (contact, registration, sign-in) against automated abuse. When you submit one of these forms, Cloudflare processes technical connection and browser data, including the IP address, to distinguish people from bots; processing in the United States cannot be ruled out.
- Vision capability: the images and related text inputs you submit are forwarded to an external AI model provider for processing; for users in the EEA, the UK, and Switzerland the contracting entity is established in the EU, and processing also takes place in the United States. Where we serve vision with open-weight models instead, processing runs on our own infrastructure within the EEA (self-hosted) or through an inference hosting provider based in the United States.
- Chat capability: your text prompts are processed with an open-weight model, either on our own infrastructure within the EEA (self-hosted) or through an inference hosting provider based in the United States. If that provider is disrupted, we automatically route requests through the AI Gateway of Vercel Inc. (United States) to inference hosting providers based in the United States that neither store inputs and outputs nor use them for training; the same model processes them.
- Chat capability, check for prohibited content: before a message reaches the chat model, in the Veyllo API as well as in chats and voice calls in the Veyllo app, we check the chat’s inputs and the model’s last answer for sexual content using OpenAI’s moderation service; for users in the EEA, the UK, and Switzerland the contracting entity is OpenAI Ireland Ltd., and processing also takes place in the United States. Only the text is transmitted, without name, email address, or account ID. If the check flags a message, it is not passed on to the chat model; we do not store its content. OpenAI does not use this data to train AI models and may store it for up to 30 days to detect and prevent abuse. In addition, with every request we transmit to the provider of the chat model a pseudonymous identifier of the account, a hash value that cannot be reversed, so that the provider can attribute violations to a single account. The legal basis is our legitimate interest in preventing abuse and in operating within the terms of use of our model providers (Art. 6(1)(f) GDPR).
- Transcription capability (STT): audio you submit for transcription is processed by a speech-recognition provider on infrastructure hosted within the European Union (EU regional endpoint); the resulting text is returned to you and the audio is not stored by us. The provider does not use the audio data to train AI models.
- Veyllo app, speech recognition and text-to-speech: as part of the voice features of the Veyllo app (voice messages and voice calls), audio data is transmitted to Deepgram, Inc. for speech recognition and processed on infrastructure within the European Union (EU regional endpoint). To generate speech output, the text to be read aloud is transmitted to Google (Gemini API). If Google is unavailable, OpenAI generates the speech output instead; for users in the EEA, the UK, and Switzerland the contracting entity is then OpenAI Ireland Ltd. With both text-to-speech providers, processing also takes place in the United States. Both may store the text for a limited period to provide the service and to detect and prevent abuse. The providers named do not use this data to train AI models. We do not store audio data or generated speech output. None of the providers named receives location data as a separate item: speech recognition receives only audio data, and text-to-speech receives only the text to be read aloud, such as answers and, during a trip, navigation, warning, and traffic notices, together with the requested speaking style; where that text names places or streets, they are included in it. Text-to-speech is exclusively part of the Veyllo app and not part of the Veyllo API.
- Veyllo app, recognising voices in voice calls: in voice calls, the app tells apart the voices of the people present. This takes place exclusively on the device, only in working memory and only for the duration of the call; it is discarded afterwards. On request, the app can remember a person’s voice (voice profile). A voice profile is only created if the person concerned has first expressly agreed to it in their own voice. It contains the name given and numerical values calculated on the device from the speech, but no audio recording. Voice profiles are stored exclusively on the device, are not included in backups and are not transmitted to us or to third parties. Matching a voice against the stored profiles also takes place only on the device. For each contribution to the conversation, the app transmits to the language model only a label for the voice (such as “A” or “B”) and, where the voice has been matched to a profile, the person’s name together with an indication of how certain the match is; the information on the chat function applies to this transmission. Voice profiles can be deleted individually in the app at any time; deleting the account or the app removes all voice profiles. Consent can be withdrawn at any time, with effect for the future, by deleting the profile.
- Veyllo app, creating and editing images: when the Veyllo app creates or edits an image, in the chat or in a chat app built by the agent, our server transmits the image description and, for an edit, the photos selected by the user to OpenAI; for users in the EEA, the UK, and Switzerland the contracting entity is OpenAI Ireland Ltd., and processing also takes place in the United States. Only photos that the user has selected in the chat or in the chat app are transmitted. Users agree to processing by AI providers when setting up the Veyllo app. Before an image is created, we check the description and the photos for prohibited content using OpenAI’s moderation service; prohibited requests are refused. OpenAI does not use this data to train AI models and may store it for up to 30 days to detect and prevent abuse. The resulting image is sent straight to the app; we store neither photos nor generated images. Generated and edited images contain machine-readable markings inserted by OpenAI that identify them as AI-generated. Image generation is exclusively part of the Veyllo app and not part of the Veyllo API.
- Veyllo app, improving our AI models: To improve its own AI models, Veyllo creates training data from chats and voice calls in the Veyllo app. Only chats from an unmodified Veyllo app are used; on Android, this is checked by the Play Integrity API of Google Ireland Limited. Personal and sensitive content is automatically removed beforehand; the data is pseudonymised, stored separately from all other data and deleted after 12 months. Training data is created only with consent that users expressly give when signing up or in the app’s settings (Art. 6(1)(a), Art. 9(2)(a) GDPR). It can be withdrawn there at any time; the data is then deleted. The Veyllo API is excluded and is not used for training purposes.
- Veyllo app, web search: where the agent of the Veyllo app performs a web search, our server transmits the search query to the Brave Search API of Brave Software, Inc. (United States). Only the search terms and information on the language, country, and settings of the search are transmitted; account data and users’ IP addresses are not transmitted. Where a search relates to the user’s location, only the name of the place is transmitted, not coordinates. Search results are returned to the Veyllo app and are not stored by us. Web search is exclusively part of the Veyllo app and not part of the Veyllo API.
- Veyllo app, notifications for automations: where users enable notifications for automations in the Veyllo app for iOS or Android, we store for the device concerned its push notification identifier (device token), a random identifier generated by the app for each automation, and the times at which the automation is due, each linked to the account and the signed-in session. At the time due, our server transmits the device token, the random identifier, and the time to the operating system’s delivery service, which delivers the notification to the device: on iOS the Apple Push Notification service of Apple Inc. (United States), on Android Firebase Cloud Messaging of Google Ireland Limited or Google LLC (United States). To register with the delivery service, the app on Android transmits an installation identifier (Firebase Installation ID) and information about the app version, operating system, and device to Google. The name, instructions, and results of an automation are neither transmitted for this purpose nor stored by us. The automation runs on the device; where it uses an AI model, the information on the chat capability applies.
- Veyllo app, location: where users of the Veyllo app allow access to their location, the app transmits the location data described in section 2 with every request to the chat model, including for voice messages and in voice calls; the information on the chat capability applies to its processing. The app transmits images without location information; embedded location data (EXIF) is removed before sending. For the map, places nearby, address lookup, routes, and traffic, the app on iOS transmits the precise location to the Apple Maps service of Apple Inc. (United States). On Android, the app shows the map and traffic with the Maps SDK for Android of Google Ireland Limited or Google LLC (United States); Google receives the map tiles loaded, which usually means the area around the location, as well as the IP address, device and operating system information, a pseudonymous SDK identifier, interactions with the map, and crash data. On Android, the app finds places nearby and addresses through the operating system’s location service (Geocoder), which on devices with Google services transmits the search term or the coordinates to Google. On Android, the app hands routes and turn-by-turn guidance, at the user’s request, to the Google Maps app with the destination and, where applicable, the starting point; Google is responsible for the processing there. The app retrieves weather, severe-weather, and earthquake information directly from the device, without any link to the account, from public services, transmitting a position rounded to about five kilometres: in Germany to Bright Sky (data from the German Meteorological Service), outside Germany to MET Norway, for locations in the United States additionally to the National Weather Service, and worldwide to the Euro-Mediterranean Seismological Centre (EMSC). The app requests traffic reports from Autobahn GmbH des Bundes without a position for the motorway being driven on, transmitting only its designation (e.g. “A8”); it downloads warnings from the NINA warning system and disaster alerts from the Global Disaster Alert and Coordination System (GDACS) in full, without transmitting a position. These retrievals do not pass through our servers.
- Veyllo app for Android, text recognition: the app recognises text in scanned PDF documents that users attach on the device, with ML Kit of Google Ireland Limited or Google LLC (United States). Neither the document nor the recognised text is transmitted to Google for this; the app transmits the recognised text to the chat model like other input. ML Kit transmits to Google technical information about the device, operating system, and app, performance and error data, and an identifier for each installation.
- Veyllo app, trial period: before a trial period is granted, our server checks that the request comes from an unmodified Veyllo app on a genuine Apple device (App Attest of Apple Inc.) and asks Apple whether a trial period has already been used on the device (DeviceCheck of Apple Inc.); once granted, this is recorded there. Apple stores this information, not we. To limit abuse, we store for 24 hours a check value of the network the request came from, formed with a secret key (the IP address shortened to its network part); we do not store the IP address itself for this purpose. Beyond that, we only store whether and when a trial period was granted.
- Veyllo app, purchases through the App Store and Google Play: Apple (iOS) and Google (Android) process purchases and subscriptions in the Veyllo app as the seller; we do not receive payment details. So that a purchase is assigned to the right account, the app records the identifier of the Veyllo account with the store when the purchase is made. To credit the subscription allowance, we receive signed transaction information from Apple or through the app. For Google Play, the app sends us the purchase token; we use it to look up the purchase with Google and to acknowledge it there. We do not store the purchase token itself, only a hash value derived from it. In both cases we process transaction and order identifiers, product, term, status, renewals, refunds, and the store offer used, such as the discount for new customers with a partner code. We link this information to the account and store it as billing data; a subscription applies to the Veyllo account on every device on which the user is signed in with it.
- Partner program: Anyone applying to the partner program sends us their country of residence or registered office, the links to their own channels, a short description, a requested code and whether, and with which advertising partners in AI, they already work; we also store the account’s email address and the version of the partner terms accepted. For partners, we process the partner code, the attribution of referred accounts (which account was referred through which code, and when) and the commissions calculated from it. Of referred customers, we process only the attribution and the amounts of their payments for this; partners see only numbers, times and totals, no names and no accounts. We do not record clicks or visits; attribution rests solely on the code entered. The legal basis is Art. 6(1)(b) GDPR (application and partner contract) and, for the attribution of referred customers, Art. 6(1)(f) GDPR (legitimate interest in settling the partner program, whose code the customer enters themselves). We delete rejected applications 90 days after the decision. If an admitted applicant declines the conditions, we keep the account identifier, email address and date on a block list so that they do not apply again (Art. 6(1)(f) GDPR), until we remove the entry or the account is deleted; we keep commission data as accounting records for the statutory retention periods.
Which of the recipients listed above are involved in processing depends on the manner of use. The following cases are to be distinguished:
- Veyllo app for Android and iOS: when the Veyllo app is used, data is transmitted, in addition to the other recipients, to the recipients designated “Veyllo app” (speech recognition, text-to-speech, creating and editing images, improving our AI models, web search, notifications for automations, the map services, public weather and warning services, text recognition, and the device check for the trial period).
- Veyllo API for developers: text-to-speech and web search are not part of the Veyllo API. When the Veyllo API is used, no processing in connection with text-to-speech or web search takes place; only the information on the chat, vision, and transcription capabilities applies.
- Veyllo Agentic Framework (VAF) with self-hosted models: VAF is operated on the users’ own computers or servers. Where self-hosted models are used, processing takes place exclusively on that infrastructure; no data is transmitted to us or, through us, to the recipients named in this section. Where VAF is connected to the Veyllo API, the information on the Veyllo API applies. Where VAF is connected to another provider’s interface, processing is governed by that provider’s privacy terms.
We disclose the identity of the AI model and inference providers we use on request; data subjects receive it as part of an access request under Art. 15 GDPR.
We only disclose data to other third parties (e.g. authorities) where we are legally obliged to do so or where it is necessary to assert, exercise, or defend legal claims.
Veyllo