Legal

Privacy Policy

NotebookLM

Open DPA in NotebookLM

Use Google NotebookLM to interactively work with all DPA documents and policies. Ask questions and get instant answers.

Open Now

Privacy Policy

Last updated: September 29, 2026

Introduction

We respect the privacy of our customers and other interested individuals and comply with applicable laws on the protection of your privacy, in particular the General Data Protection Regulation of the European Union ("GDPR") and the German Federal Data Protection Act (BDSG).

This Privacy Policy applies to the website www.famulor.io and the B2B web application available at app.famulor.io (the "Service").

The following categories of data subjects are covered by this Privacy Policy:

  • Website visitors
  • Users of the Famulor B2B web application
  • Recipients of test calls or interactions with the Famulor AI telephone assistant
  • Contacts and recipients of calls placed by our customers via the Famulor Platform (where Famulor acts as data processor)

The controller responsible for the processing of your personal data within the meaning of this Privacy Policy is:

BEK Service GmbH
Westendstr. 2A
D-87439 Kempten (Allgäu)
Germany
Email: support@famulor.io

This Privacy Policy explains:

  • the purposes for which personal data is collected and processed,
  • the categories of personal data concerned,
  • the legal basis for processing,
  • the processors and third parties involved,
  • transfers of personal data to third countries,
  • retention periods, and
  • your rights as a data subject.

1. What categories of personal data do we collect about you?

Depending on how you interact with the Service, we may process the following categories of personal data:

  • Identification data: first name, last name, salutation
  • Contact data: email address, telephone number, postal address
  • Company data: company name, position, VAT ID, billing address
  • Account data: login data, password (in hashed form), settings, configurations
  • Content and communication data: call scripts, prompts, audio recordings, transcripts, knowledge-base content, support requests, email correspondence
  • Usage data: access times, features used, API calls, error logs, IP address, browser, device, operating system
  • Marketing data: newsletter subscriptions, interactions with newsletters, conversion data
  • Payment data: invoice data, payment status (full payment data is processed by our payment service provider — see Section 6)
  • Google Calendar / Google Workspace API data (when you connect Google Calendar): Google account identity (email, and basic profile information such as name and profile picture via OAuth identity scopes), calendar list, free/busy availability, and calendar event data used for Famulor Calendar scheduling — see Section 5

2. How do we obtain personal data about you?

We obtain personal data:

  • when you fill in contact, demo or onboarding forms on our website,
  • by email at support@famulor.io,
  • when you create or use a Famulor account,
  • when you connect Google Calendar to Famulor Calendar via Google OAuth,
  • when you book an online appointment via Cal.com,
  • when you test our AI telephone assistant on the website,
  • when you subscribe to our newsletter,
  • via cookies and similar technologies on the website (subject to consent where required),
  • when third parties (e.g., partners or referrers) lawfully share your data with us.

3. Purposes of processing on the website www.famulor.io

3.1 Website hosting

Our website is built with Next.js and hosted by Vercel Inc. Website content is delivered through Vercel’s global network; application processing and content delivery can use different locations. The applicable service configuration and provider agreements determine the processing regions.

  • Data processed: technical information such as IP address, device, browser, log data, cookies.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision of the website); EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers to the U.S.
  • Processors involved: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.
  • Further information: Vercel Privacy Policy.

Vercel Web Analytics and Speed Insights. In addition to hosting, the website uses Vercel Web Analytics for aggregate visitor statistics and Speed Insights for loading and responsiveness metrics. They process page/route, referrer, browser/device, country and technical performance information. These integrations load independently of our analytics/marketing switches; we use them for the legitimate interest in understanding and improving website reliability and performance (Art. 6(1)(f) GDPR). Vercel describes Web Analytics as using a request-derived visitor hash rather than third-party cookies, with its visitor session discarded after 24 hours; Speed Insights does not reconstruct individual sessions. These are separate from advertising pixels and PostHog/Clarity replay. Web Analytics privacy information, Speed Insights privacy information.

3.2 Testing the AI telephone assistant

We provide a function on our website that allows you to test our AI telephone assistant. After entering the necessary details, you receive a call from our AI assistant. Test calls are recorded for quality-assurance purposes. Use of this feature may involve transfers to third countries.

  • Data processed: identification data, company, contact data, voice and other information you transmit.
  • Legal basis: Art. 6(1)(f) GDPR; EU-U.S. Data Privacy Framework; Standard Contractual Clauses.
  • Processors involved: LiveKit Inc. (USA), Twilio Ireland Ltd. (Ireland), Eleven Labs Inc. (USA), Deepgram Inc. (USA), OpenAI L.L.C. (USA), PostHog Inc. (USA), Microsoft Ireland Operations Ltd. (Ireland), AWS — A100 ROW GmbH (Germany).
  • Further information: please do not transmit special categories of personal data (Art. 9 GDPR — e.g., ethnic origin, political opinions, religion, union membership, genetic data, biometric data, health, sexual life). You can avoid the processing of your data by not using the test feature.

3.3 Contact via email

We publish a contact email address on our website to enable inquiries.

  • Data processed: email address, communication content.
  • Legal basis: Art. 6(1)(f) GDPR (responding to inquiries) or Art. 6(1)(b) GDPR (pre-contractual measures).
  • Further information: please do not transmit special categories of personal data (Art. 9 GDPR).

3.4 Newsletter

You can subscribe to our newsletter on our website to receive regular updates.

  • Data processed: identification data, contact data, interaction data, cookies.
  • Legal basis: Art. 6(1)(a) GDPR (consent); EU-U.S. Data Privacy Framework; Standard Contractual Clauses.
  • Processors involved: MailerLite, Inc., 548 Market St, PMB 98174, San Francisco, CA 94104-5401, USA.
  • Further information: MailerLite Privacy Policy and DPA. You may unsubscribe at any time via the link in each newsletter or by contacting support@famulor.io.

3.5 Online appointment booking

When you open the booking function, we load the Cal.com appointment interface. Details you have entered, such as name, email, phone, company, monthly call volumes and your free-text booking request, may be passed to Cal.com to prefill and complete the appointment. Technical connection data also reaches Cal.com. This is a functional booking transfer, separate from advertising consent; declining marketing does not prevent you from requesting a meeting. We process the requested booking under Art. 6(1)(b) GDPR and any optional consent-based features under Art. 6(1)(a). Cal.com Inc. is a US provider and international transfers can occur. Cal.com Privacy Policy. For an alternative, contact support@famulor.io.

3.6 Analysis of user behavior

We use the services below on our Famulor websites (famulor.io and famulor.de) and, where indicated, the web app at app.famulor.io to understand usage, improve the service and measure advertising. Advertising measurement can connect a visit or click to a later enquiry, registration or purchase and can support audience creation and remarketing. It is separate from processing your requests, bookings and payments.

Your choice and legal basis. In the EEA, United Kingdom and Switzerland, optional analytics and marketing require your consent (Art. 6(1)(a) GDPR; for storage/access on your device, section 25(1) TDDDG where applicable). If the country is unknown, these categories also start disabled. Outside these regions, our current regional settings enable them by default; you can disable them in cookie settings. Necessary storage for your choice and requested functions is separate. Consent is voluntary and can be withdrawn for the future without affecting processing already carried out lawfully. See the cookie section below.

  • Google Analytics 4 and Google Ads (Google Ireland Limited): page views, interaction and conversion events, page/referrer information, device/browser data, approximate location and cookie or advertising-click identifiers are used for usage statistics, campaign attribution and advertising audiences. Google Tag Manager manages the tags and is not a separate audience database. Our website's shared tag container starts when marketing is enabled; analytics settings are passed separately to Google Consent Mode. Consequently, analytics consent alone currently does not start that website container. Data can be processed outside the EU. Google's use of partner data, privacy policy and ad settings. Where configured and enabled, Google Analytics 4 Measurement Protocol also sends confirmed purchase events from the server. This requires analytics consent and an actual GA client ID captured at checkout. The data includes that client ID, an associated current session ID and an account identifier where available, and the event/transaction identifier, amount and currency. The same transaction identifier is used for the purchase in the browser to help avoid duplicate counts. The marketing choice is sent separately as advertising consent; advertising-click identifiers are added only with marketing consent.

  • Meta Pixel and Meta Conversions API (Meta Platforms Ireland Limited): the browser pixel and server API measure visits and successful enquiries, registrations and purchases for Facebook/Instagram campaign attribution, optimization and audience matching when marketing is enabled. Depending on the event, we send an event ID/time/type, source URL, transaction value/currency, IP address, user agent and Meta browser/click identifiers (_fbp, _fbc). Available contact or customer identifiers are normalized and SHA-256-hashed for matching; these remain personal data, not anonymous data. Browser and server events use a shared event ID to avoid counting the same action twice. We do not include call recordings, transcripts or free-text enquiries in our conversion payloads. Meta Privacy Policy and Business Tools terms.

  • Microsoft Advertising UET and Microsoft Clarity / UET Insights (Microsoft Corporation / Microsoft Ireland Operations Limited): UET measures visits and conversions and builds remarketing lists. The linked Clarity integration produces behavioral statistics, heatmaps and session replays from page content and interactions such as clicks, scrolling and navigation, together with technical and online identifiers. The website also loads the linked Clarity project through Google Tag Manager. Because advertising and replay are linked in this setup, both analytics and marketing must be enabled on our website and app. Disabling either stops this browser integration on subsequent use; a page reload may be required. Form and booking areas have masking/blocking rules. Microsoft may use the data for its advertising and other purposes described in the Microsoft Privacy Statement. Where configured and enabled for the Famulor platform, the optional Microsoft Conversions API supplements browser measurement with server-side conversion events. It requires stored consent to both analytics and marketing. Depending on the event and available data, we send the event ID, type and time, transaction ID, amount/currency, source-page URL without query parameters or fragment, advertising-click ID (msclkid), IP address and user agent, together with normalized SHA-256-hashed email addresses and hashed account identifiers. Shared event and transaction identifiers support matching with browser events and avoiding duplicate counts. This server integration is not inherited by white-label custom domains. It sends no call content or free-text form content.

  • PostHog (PostHog Inc.): with analytics enabled, we use browser-based product analytics, heatmaps, session replay and error/performance diagnostics. Data includes page views, clicks, navigation, browser/device data, session and visitor identifiers and technical errors. On an enquiry or signed-in app session, email address, account/workspace identifiers and relevant usage properties may connect the website journey with app usage. We use the EU-hosted project; website requests pass through our own domain to PostHog. Replay masks inputs and blocks designated contact and Cal.com booking areas on the website. This is not an audio/call recording service. PostHog Privacy Policy and data processing terms.

  • LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company): when marketing is enabled, the website tag processes page visits, URL/referrer, timestamp, browser/device information, IP address and cookie identifiers for advertising measurement, audience matching and remarketing. LinkedIn may associate these signals with its members. LinkedIn Privacy Policy and advertising preferences.

  • Google Ads: server-side purchase measurement. Where configured and enabled, we send confirmed purchases to Google Ads through the Google Data Manager API. This requires the transaction's stored consent to both analytics and marketing and an actual captured advertising-click identifier (gclid, gbraid or wbraid). We send that click identifier, the event/transaction identifier, confirmed payment time, amount and currency to attribute the purchase to an advertisement. This transmission contains no email addresses or phone numbers; no historical customer lists are imported. Server-side measurement uses a separate secondary conversion goal. Stable transaction identifiers help recognize repeated uploads within that same goal and limit duplicate counts.

OpenAI Ads Measurement Pixel and Conversions API.

We use the OpenAI Ads Measurement Pixel and server-side OpenAI Ads Conversions API when marketing is enabled under the regional choices explained above. The Pixel processes page views; for successfully submitted demo and enterprise enquiries, our server also sends conversion events to attribute them to ads in ChatGPT and to measure and optimize campaign performance. Depending on availability, these events may contain the event ID and type, source-page URL without query parameters or fragment, IP address, user agent, OpenAI attribution identifiers taken unchanged from the __oppref and __obref cookies, and normalized SHA-256-hashed email addresses or pseudonymous customer identifiers. We do not send raw email addresses, other form contents or conversation contents through the Conversions API. Our manually implemented Pixel event calls likewise contain no form contents. If automatic advanced matching is enabled in Ads Manager, the Pixel may detect supported contact information in recognizable forms, normalize it and hash it with SHA-256 in the browser. This feature does not send raw contact information to OpenAI.

For standard OpenAI advertising conversion measurement, Famulor and OpenAI act as independent controllers. OpenAI Ireland Limited processes EEA and Swiss data; OpenAI OpCo, LLC processes UK data. OpenAI Privacy Policy and OpenAI Ad Tools DPA.

The providers' terms distinguish processing on our behalf from processing for their own purposes. An EU contracting entity or EU hosting does not exclude access or onward processing in other countries, including the USA. Transfer safeguards and your rights are described below; hashing is not anonymization.

3.7 Display of third-party content via plug-ins and widgets

We have integrated social-media plug-ins and widgets (e.g., Facebook plug-ins, YouTube embeds) on our website to display content of interest, improve user experience and optimize advertising. Use may involve transfers to third countries.

  • Data processed: technical information (IP address), browser data, page-view and interaction data, location data, cookies.
  • Legal basis: Art. 6(1)(a) GDPR (consent); EU-U.S. Data Privacy Framework.
  • Processors involved: Meta Platforms (USA/Ireland), Google Ireland Ltd. (Ireland).
  • Further information: Facebook Plug-ins, Facebook Privacy, Google Privacy.

3.8 Google Fonts

We use the Google Fonts service to display fonts on our website.

  • Data processed: IP address, browser information, font usage, page-view data, cookies.
  • Legal basis: Art. 6(1)(a) GDPR (consent); EU-U.S. Data Privacy Framework.
  • Processors involved: Google Ireland Ltd. (Ireland).
  • Further information: Google Privacy Policy.

4. Purposes of processing in the B2B web application app.famulor.io

4.1 App hosting

The web application and API run on Vercel. Supabase provides the database, authentication and file storage, including configured recording storage. LiveKit Cloud provides real-time media transport and runs the voice-agent service. Our agent deployments include European and US regions; the region used depends on the service and routing configuration.

  • Data processed: IP address, browser/device information, authentication and account/workspace data, configurations, uploaded content, call data and technical logs as needed for the requested function.
  • Legal basis: Art. 6(1)(b) GDPR for providing the Service; Art. 6(1)(f) GDPR for security and reliability.
  • Providers: Vercel Inc., Supabase and LiveKit Incorporated. Hosting, storage, media and model inference have separate regional settings; international processing and transfers can occur under the applicable agreements.
  • Further information: Vercel Privacy Notice, Supabase Privacy Policy, Supabase DPA, LiveKit Privacy Policy.

4.2 Provision of the Service — configuring and managing AI voice assistants

  • Data processed: AI prompts and other AI-related data, configurations, technical access data (e.g., API keys), telephone numbers.
  • Legal basis: Art. 6(1)(b) GDPR.

Vercel, Supabase and LiveKit, together with the configured telephony and AI/speech providers described in Section 6. Processing regions depend on the selected service and configuration.

4.3 Customer relationship management (CRM)

  • Data processed: identification data, contact data, email correspondence data.
  • Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR (legitimate interest in customer relationship management).

4.4 Account creation and billing

Account registration uses Supabase Authentication through the web app and API hosted on Vercel. Processing locations follow the service-specific settings described under App hosting.

  • Data processed: company name, contact person, email address, telephone number, billing address, payment data.
  • Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (compliance with legal obligations, e.g., bookkeeping).

4.5 Usage data

The analytics and advertising services described above also cover the Famulor app where integrated: PostHog for consent-controlled browser product analytics and replay, Google for browser measurement and the optional server-side purchase measurement described above, Meta Pixel / Meta Conversions API, Microsoft UET with Clarity and the optional Microsoft Conversions API, and OpenAI Ads for conversion measurement. Microsoft and Google Ads purchase measurement through the Data Manager API require both analytics and marketing; the other advertising integrations require marketing to be enabled. Successful registrations, paid-plan activations and credit or manual phone-number purchases may produce conversion events; checkout consent and matching context can be carried forward to the server confirmation of that transaction. These events describe the conversion, not the content of customer calls. LinkedIn is described above as a website integration. The app's privacy link can be supplied by the workspace's branding; the Famulor platform links to this policy.

Operational service data. The following data and legal bases concern the operation of the Service, separately from optional browser analytics and the server-side PostHog events described below.

  • Data processed: login/logout times, feature usage, API calls, error logs.
  • Legal basis: Art. 6(1)(b) GDPR (provision of the Service); Art. 6(1)(f) GDPR (legitimate interest in security and improvement).

Server-side PostHog events from the app. Separately from browser analytics, the app sends account-linked events for registration (user_signed_up), social sign-in (user_logged_in), completed credit purchases (credits_topup_completed) and activated subscriptions (subscription_activated) to PostHog to analyze product and transaction activity. Depending on the event, these include user and workspace identifiers, the sign-in method, credit quantity, plan, billing interval, amount, currency, transaction identifier and platform/reseller billing context. These events are sent independently of the analytics and marketing switches; they are account-linked data, not anonymous statistics. They do not contain browser recordings or conversation content. Turning off optional browser analytics does not stop this separate server-side transmission. For MCP connections, server-side usage events also record the tool name, duration, success or error type, client information and account/workspace identifiers. Tool arguments, returned records, free-text requests, exception messages and conversation content are excluded from these analytics events.

Advertising conversion measurement is separate from operational usage analytics. With marketing consent, the OpenAI Ads Measurement Pixel and server-side OpenAI Ads Conversions API record successful registrations, paid plan activations and credit purchases on the Famulor platform domain. Transmitted data includes online identifiers and technical, event and transaction metadata such as event ID, conversion type, amount and currency, source-page URL, IP address and user agent, OpenAI attribution identifiers (__oppref and __obref) passed through unchanged, and normalized SHA-256-hashed email addresses or pseudonymous customer identifiers. Raw email addresses, other form contents and conversation contents are not sent through the Conversions API. Neither the Pixel nor the Conversions API is used on white-label custom domains.

4.6 Customer data uploaded to the Service (call recipients)

When you use the Famulor Platform, you may upload personal data of third parties (e.g., contact lists). With respect to this data, you act as the controller and Famulor acts as the processor pursuant to Art. 28 GDPR. The applicable Data Processing Agreement is available at https://www.famulor.io/dpa. You are responsible for ensuring the lawfulness of this processing, including consent and information obligations vis-à-vis your contacts.

5. Google Calendar / Google Workspace API data

Famulor Calendar integrates with Google Calendar through Google OAuth (authorization code flow with offline access / refresh tokens). This section describes specifically how we access, use, share, protect, retain, and delete Google user data obtained via Google Workspace / Google Calendar APIs.

5.1 What Google user data we access

When you connect Google Calendar to Famulor Calendar, we access the following Google user data, limited to the scopes you authorize (as shown in the Google OAuth consent screen):

  • Associate your Google profile with personal info / OpenID: via the OAuth scope openid (used to establish a secure signed-in Google identity for the connection)
  • Primary email address: your Google account’s primary email address, via the OAuth scope email (used to identify and link the connected Google account to your Famulor workspace)
  • Personal info / profile: basic profile information associated with your Google account, via the OAuth scope profile — this may include your name and profile picture (and, depending on your Google account settings, other publicly available profile fields such as preferred language). We use name/email to identify the connected account in Famulor; we do not use gender or other optional profile fields for Famulor Calendar features
  • See and download any calendar you can access using Google Calendar: the list of calendars you have subscribed to / can access, and their properties (e.g. title, description, default time zone), via https://www.googleapis.com/auth/calendar.calendarlist.readonly (used for the calendar picker)
  • See and edit events on all your calendars: create, update, and cancel calendar events on calendars you can access, via https://www.googleapis.com/auth/calendar.events, including optionally creating Google Meet links for bookings
  • View your availability in your calendars: free/busy availability data, via https://www.googleapis.com/auth/calendar.freebusy

We do not request access to Google user data beyond these scopes.

5.2 How we use Google user data

We use Google Calendar / Workspace API data solely to provide Famulor Calendar scheduling features that you (or your workspace) enable, including:

  • identifying the connected Google account (email / display name) within your Famulor workspace;
  • listing calendars so you can select which calendar(s) to use;
  • reading free/busy data to compute availability;
  • creating, updating, and canceling calendar events for appointment booking during calls or via booking flows;
  • optionally creating Google Meet links for bookings;
  • storing OAuth tokens so your workspace can keep the Google Calendar connection active.

AI agents: Famulor voice and chat AI agents may invoke calendar tools (check availability, book, reschedule, or cancel) using the connected Google Calendar on behalf of the workspace. Those agents act only as tools to perform the scheduling features described above. Google Calendar data is used only to provide the user-facing scheduling features the customer enabled.

No AI/ML training: We do not use Google user data (raw or derived) to train, improve, or create foundational or generalized AI/ML models.

5.3 Sharing, transfer, and disclosure of Google user data

  • We do not sell Google user data.
  • Google user data is processed within the customer’s workspace context to operate the Famulor Calendar integration.
  • Service providers / subprocessors may process Google user data only as needed to operate the Service (for example, hosting and infrastructure), under contracts, and not for their own advertising or model training.
  • We do not share, transfer, or disclose Google user data to third parties for advertising, or for training AI/ML models.

5.4 Data protection for Google user data

We protect Google user data and OAuth credentials with appropriate technical and organizational measures, including:

  • transmission over HTTPS/TLS (encryption in transit);
  • encryption at rest and access-controlled storage of OAuth tokens and credentials;
  • access limited to authorized workspace members and systems needed to operate the integration.

5.5 Retention and deletion of Google user data

  • OAuth tokens are retained while the Google Calendar connection is active.
  • When you disconnect Google Calendar in the product settings, or when the workspace/account is deleted, we revoke and/or delete the OAuth tokens and stop accessing Google Calendar.
  • Event metadata created by our booking flows may be retained in the workspace according to the workspace retention settings, until deleted by the customer, or until account closure, subject to legal retention where required.
  • You may request deletion of Google user data by contacting our privacy contact at support@famulor.io.

5.6 User controls

  • You can disconnect Google Calendar at any time in the product settings.
  • You can revoke Famulor’s access at any time in your Google Account under Third-party access (Google Account → Security → Third-party access).
  • You can request deletion of Google user data via support / privacy contact at support@famulor.io.

5.7 Limited Use compliance

Famulor’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs / scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Google user data is not used to train or improve generalized or foundational AI/ML models.

6. Third-party providers and infrastructure

To provide the Service, we work with various third parties. The most important categories are listed below.

6.1 Infrastructure & hosting

  • Vercel Inc. — website and app/API hosting, content delivery and configured file storage.
  • Supabase — database, authentication and storage for application data and files.
  • LiveKit Incorporated — real-time communications and voice-agent hosting; European and US agent deployments.
  • Twilio — communications API and telephony services via Twilio Ireland Ltd., Dublin.

These providers use cloud infrastructure and subprocessors under their respective agreements. Processing regions differ by service and configuration; see Section 4.1 and the AI/speech section.

6.2 AI and speech providers

The provider and processing region depend on the selected model, enabled feature and workspace configuration. Supported model integrations include OpenAI (including realtime models), Google Gemini, Anthropic Claude, Groq and Microsoft Azure OpenAI. Speech recognition and synthesis can use providers such as ElevenLabs, Deepgram, Cartesia, AssemblyAI, Speechmatics, Soniox, Gladia, Fish Audio, Inworld, Rime and xAI, as well as OpenAI, Google or Microsoft. Requests may be routed through LiveKit Inference or Vercel AI Gateway, or directly to the configured provider; this does not mean that every provider receives every request.

The data needed for the chosen function can include prompts, conversation text, audio, transcripts, supplied knowledge and technical metadata. Hosting and inference regions are separate settings; processing may take place in the EU or other regions, including the USA. The configured service, available regional routing and applicable provider agreement determine the processing location, retention and any model-training restrictions.

The applicable processing agreement and current provider information govern the specific service. You may request details for your configuration at support@famulor.io. This AI/speech processing is distinct from the advertising and analytics described above.

6.3 Analytics

  • Analytics and advertising: Google Analytics 4 / Google Ads / Google Tag Manager, Meta Pixel / Meta Conversions API, Microsoft Advertising UET / Microsoft Clarity, PostHog, LinkedIn Insight Tag, OpenAI Ads Measurement Pixel / Conversions API, and Vercel Web Analytics / Speed Insights. Purposes, recipients, consent settings and transfer information are detailed in Section 3.6 and the hosting section.

6.4 Payments

  • Stripe Payments Europe Ltd. — payment processing via European subsidiary in Dublin, Ireland.

A complete and current list of our processors and sub-processors can be obtained free of charge by sending a written request to support@famulor.io.

7. Disclosure of personal data

We may disclose personal data to:

  • service providers and processors (hosting, AI/voice, email, analytics, payments — see Section 6);
  • our professional advisors and auditors;
  • competent authorities and courts where required by law;
  • acquirers in the context of corporate transactions, subject to appropriate confidentiality safeguards.

We do not sell your personal data to third parties. For Google user data specifically, see Section 5.

8. Transfer of personal data to third countries

Personal data may be transferred to countries outside the European Economic Area when stored or processed by our providers. In such cases we ensure an adequate level of data protection by:

  • relying on adequacy decisions of the European Commission (e.g., EU-U.S. Data Privacy Framework where applicable),
  • entering into the EU Standard Contractual Clauses (SCCs) under Implementing Decision (EU) 2021/914, and
  • implementing supplementary technical and organizational measures where necessary.

A copy of the safeguards used can be requested from support@famulor.io.

9. Retention periods

As a general rule, we retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy:

  • Website usage data and log files: generally up to 12 months;
  • Contact form data: up to 24 months after the inquiry is closed;
  • Account data: for the duration of the contract plus statutory retention periods (in particular 6 years under § 257 HGB and 10 years under § 147 AO);
  • Payment and accounting data: 10 years (§ 147 AO);
  • Newsletter data: until your unsubscribe;
  • Test-call recordings: as required for quality assurance purposes, generally up to 90 days;
  • Customer-uploaded data (controller data): in accordance with the DPA and your instructions; deletion within 30 days after termination of the contract;
  • Google Calendar OAuth tokens and related Google user data: as described in Section 5 (retained while the connection is active; revoked/deleted on disconnect or account deletion).

After expiration of the retention period, we delete or anonymize your personal data unless we are subject to a longer statutory retention obligation or another legal basis.

10. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, loss or destruction, including encryption in transit and at rest, access controls, secure storage of credentials (including OAuth tokens), regular reviews, employee training, and contractual safeguards with our processors. For Google user data specifically, see Section 5.

11. Your rights as a data subject

You have the following rights:

  • Right of access (Art. 15 GDPR) — to receive information about the personal data we process about you;
  • Right to rectification (Art. 16 GDPR) — to have inaccurate personal data corrected;
  • Right to erasure (Art. 17 GDPR) — to request the deletion of your personal data, subject to the conditions of the GDPR;
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to object (Art. 21 GDPR), in particular against processing based on legitimate interests or for direct marketing;
  • Right to withdraw consent (Art. 7(3) GDPR), with effect for the future;
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in your country of residence, your place of work or the place of the alleged infringement. Our competent supervisory authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 27, 91522 Ansbach, Germany.

To exercise your rights, please contact us at support@famulor.io. We will respond within the legally required period (generally one month, extendable by two months for complex requests).

12. What happens if you do not provide personal data?

If you choose not to provide personal data or object to its processing, we will respect this choice in accordance with our legal obligations. However, we will then not be able to perform the actions necessary to achieve the purposes described in this Privacy Policy (e.g., we cannot create an account or provide the Service). If you do not connect Google Calendar, Famulor Calendar features that depend on Google Calendar will not be available for that workspace connection.

13. Cookies

Necessary storage for your selected preferences, authentication and requested functions is based on Art. 6(1)(b) or (f) GDPR and, where applicable, section 25(2) TDDDG. The optional analytics and marketing choices above remain separate.

Use the cookie-settings control in the website footer or the app's consent settings to change analytics, marketing and functional preferences or reject optional categories. Where displayed, “Do Not Sell or Share” disables marketing. Browser cookie controls and the provider choices linked above offer additional controls; they do not replace changing your Famulor preferences.

We store your selection in the cookie-consent cookie (up to one year) and local storage. Subdomains of the same Famulor domain can share that cookie; famulor.io and famulor.de do not share a single browser cookie. Provider cookies/local storage may hold visitor, session and advertising-click identifiers. Withdrawing consent affects future collection; it does not automatically erase data already received by providers. You can request deletion using the contact below. For form handoff, an entered email can remain in the current tab's session storage for up to 15 minutes and is removed when consumed; this is separate from tracking.

14. Automated decision-making and profiling

The Service may use AI models to generate voice and text responses. This is not "automated individual decision-making" within the meaning of Art. 22 GDPR with legal effects on you. To the extent your contacts interact with our AI assistants, you (as the controller) must inform them of the use of AI as required by Art. 13/14 GDPR and the EU AI Act. For how AI agents may use connected Google Calendar data as scheduling tools (and that Google user data is not used to train generalized AI/ML models), see Section 5.

15. Data Protection Officer

For questions regarding the processing of your personal data or this Privacy Policy, please contact our Data Protection contact at:

Email: support@famulor.io Postal address: BEK Service GmbH, Westendstr. 2A, D-87439 Kempten (Allgäu), Germany.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, e.g., to reflect changes in legislation or our processing activities. The current version is always available at https://www.famulor.io/privacy. Material changes will be communicated by email or through the Service.

17. Contact

For any other questions about data protection at Famulor:

BEK Service GmbH
Westendstr. 2A
D-87439 Kempten (Allgäu)
Germany
Email: support@famulor.io

Further Famulor companies:

BEK SERVICE LTD
20-22 Wenlock Road
London, England, N1 7GU
United Kingdom
Company number: 12590587

Famulor AI L.L.C
Office A-28, Sheikh Suhail Maktoum Building
Port Saeed, Deira, Dubai
United Arab Emirates

Data Processing Addendum (DPA)

For companies that wish to enter into a Data Processing Agreement with Famulor, we provide a standardized Data Processing Addendum.

Request Data Processing Addendum (DPA)

Through the form, you can enter your company details and will receive the agreement for review and signing via email.