1. Who is responsible and how to contact us
Zeus Voice is offered by Lukas Steinke – Steinke Systeme (sole proprietorship), c/o Postflex #9943, Emsdettener Str. 10, 48268 Greven, Deutschland. Contact for data-protection matters and data-subject requests: info@zeusvoice.de, telephone +49 162 3901189. Further provider details are in our legal notice.
We are the controller for this website, the management of our business customer accounts, our own communications and billing. When a company uses Zeus Voice to answer calls, that company generally determines the purpose of processing caller data; we process that data on its behalf. A trial involving real personal data is also subject to data-protection law.
This notice does not replace the privacy information tailored to the calling company's particular use. For questions about such a call, please contact that company first. If we receive a request concerning data processed on its behalf, we support the controller; data is not disclosed solely on the basis of an unverified claim of identity by telephone.
2. Website, operation and security
2.1 Hosting and technical access data
When you visit the website, your IP address, access time, requested page, browser and device information, referrer and technical error or security data may be sent to the hosting infrastructure. This serves delivery, troubleshooting and protection of the service. The legal basis is our legitimate interest in a functional and secure service (Article 6(1)(f) GDPR). Performance of a contract also applies to requested use of a customer account; for employees of a business customer we rely on this legitimate interest for necessary contact and access management.
2.2 Necessary cookies and local browser storage
Cookies and comparable browser storage support login, session continuity and security. Where access is strictly necessary for a service expressly requested, Section 25(2), point 2, of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies. The legal basis for processing personal data depends on its purpose, particularly performance of a contract or our legitimate interest in a secure service (Article 6(1)(b) or (f) GDPR).
On the public website we also store:
- Your cookie choice: The choice version, acceptance or rejection of statistics, and decision and expiry times in local browser storage under “zeus-public-consent-v1”. The choice is valid for 180 days and contains no visitor identifier. This lets us respect your decision without asking again on every page (Article 6(1)(f) GDPR; Section 25(2), point 2, TDDDG).
- Your chosen language: An expressly selected language is stored locally until deleted so the website can retain your choice (Article 6(1)(f) GDPR; Section 25(2), point 2, TDDDG).
These necessary storage functions are separate from optional Google Analytics statistics. The website and app work independently of your statistics choice. Technical access data described in Section 2.1 may still arise without Analytics.
2.3 Google Analytics 4: optional website statistics
Provider and purpose: With your express consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We evaluate use of known public marketing pages to improve our content and entry points to Zeus Voice. The legal bases are Article 6(1)(a) GDPR and, for access to your device, Section 25(1) TDDDG.
Data processed: The statistics include in particular:
- pseudonymous visitor and session identifiers;
- public marketing pages viewed, times and referring domains;
- selected button and contact clicks, opened FAQs and audio samples started;
- technical browser and device information and the IP address needed to connect to Google.
We do not send form entries, names, email addresses, telephone numbers, conversation content or customer identifiers to Google Analytics. Arbitrary URL parameters and fragments are not sent as page addresses. Customer accounts, login, registration and invitation pages are excluded. Our legal pages are also excluded from Google Analytics measurement. We do not enable Google signals, advertising personalisation, User-ID or session recordings.
Recipients and international processing: Google states that, for access from the EU, it uses IP addresses to derive regional information and deletes them before further processing, without logging or storing them in Analytics. The IP address is nevertheless initially processed technically; we do not describe the statistics as fully anonymous.
Data may subsequently also be processed by Google LLC and other processors in the USA. Transfer safeguards, particularly the EU-US Data Privacy Framework and standard contractual clauses, are subject to the applicable requirements described in Section 8. Further details are available in Google's privacy information, Google's data processing terms and Google's EU data collection information.
2.4 Statistics retention periods
- Analytics cookies: “_ga” and “_ga_…” store pseudonymous identifiers for no more than 180 days. Further visits do not automatically extend the expiry we configure.
- User and event data: Our Google Analytics property is set to two months of retention, without resetting the period on new activity. Aggregated standard reports may remain available for longer.
- Cookie choice: The decision described in Section 2.2 is stored locally, separately from Analytics, for 180 days. We ask again after it expires. Deleting browser storage or using another browser may cause the prompt to appear earlier.
2.5 Changing or withdrawing consent
The cookie banner lets you accept, reject or specifically choose statistics. Without consent, we do not load the Analytics script, set Analytics cookies or send measurement signals to Google. This also excludes so-called cookieless measurement when statistics are rejected (Basic Consent Mode).
You can reopen your choice at any time using Cookie settings at the top of this page or in the footer. To withdraw consent for the future, turn off statistics and save your choice. We stop further measurement, remove the Analytics cookies we can access and may reload the page to unload Google code already loaded.
Withdrawal does not affect the lawfulness of earlier processing or retrospectively delete data already sent to Google. For questions about exercising your rights, contact info@zeusvoice.de.
2.6 Google Search Console
We use Google Search Console to review aggregated Google search queries, search-result clicks and indexing of our public website. This serves our legitimate interest in checking and improving the visibility of our service (Article 6(1)(f) GDPR).
We do not add a visitor script to your device or set additional Search Console cookies for this purpose. Search terms are not linked to your contact details through this tool. This is separate from optional Google Analytics statistics.
3. Registration, account management and support
We process the company, name and contact details you provide, login data, roles and permissions, plan and agent assignments, configurations and necessary technical identifiers. Login passwords are not made available in readable plain text. Emails are sent for requested login, account confirmation, password recovery and operational notices. If you sign in with Google, the identity data authorised for that purpose is processed.
Support requests through chat or email contain your statements and, where applicable, affected case, call and configuration data. Authorised persons may inspect data needed to handle the request. Reporting a problem with one call is not permission to analyse every conversation for another purpose. The legal bases for our own contract and support data are Article 6(1)(b) GDPR and, for company contacts, Article 6(1)(f) GDPR; customer-controlled data is processed under the customer's instructions in the DPA.
3.1 Optional AI support chat using Google Gemini
In the customer portal you may voluntarily use an AI support assistant for general help with the application. The Zeus Voice provider named in Section 1 is responsible for our own support. The data-minimising mode described here is separate from the telephone assistant and the separate website analysis.
To answer in context, we send your support question and up to eight preceding messages from that support chat (no more than 8,000 characters of history in total) through our backend to Google Gemini. Recognisable email addresses, telephone numbers and credentials are filtered before transmission; filtering takes place on the device and server. Free text may still contain unrecognised personal data: complete anonymisation is not guaranteed. Gemini also receives fixed, reviewed operating guidance and, where relevant, a general application-area key. Stored contacts, staff, telephone transcripts, agent and company data, calendar contents, profile and payment data are not loaded from the database or attached. Human support cases and local form drafts are not used as model history.
Recognised pasted telephone logs and data exports are rejected. The AI has no tools to read or change your business data. It can explain and offer a reviewed navigation path. The application may prepare local form drafts that you expressly request; data is saved only after confirmation in the relevant form. The separate website analysis outside the chat is described in Section 7. Please do not enter passwords, health data, telephone logs or unnecessary personal data about third parties into the chat. Unredacted messages remain in the visible history on your device; human support is a separate transmission.
Optional AI chat becomes available only after you confirm it in the chat. To the extent that your personal data is processed for this voluntary AI support function, the basis is your consent (Article 6(1)(a) GDPR). Login, security and personal support handling are separate and are governed by Sections 2 and 3. You may withdraw AI consent in the chat at any time for the future. This does not affect the lawfulness of processing already carried out. Human support remains available without AI consent. Before sending a request to human support separately, you can review and edit it; the message text you confirm is then transmitted to our personal support team.
Google receives the filtered support messages and limited support-chat context and generates replies. Technical API operating data also arises, for example for usage, authentication, security and billing of our API access. We therefore do not describe the entire process as anonymous or free of storage. For paid services, Google describes not using inputs and outputs to improve its products, while also describing time-limited logging for security, abuse detection and legal requirements. Processing outside the EEA is possible; Section 8 addresses transfer grounds and requests for information. Further information: https://ai.google.dev/gemini-api/terms and https://business.safety.google/adsprocessorterms/.
The visible chat history and message drafts are kept in your browser's session storage so you can continue the chat. Withdrawal resets the currently open AI history; it does not automatically erase histories in other tabs or human support requests sent separately. Server-side technical usage and protection data and records of your choice are created, associated with user and organisation, time, notice version and decision. Consent records serve our duty to demonstrate compliance (Article 6(1)(c) together with Article 7(1) GDPR). They are kept only while their purpose or an applicable duty to retain evidence exists; no automatic deletion period is promised for them. You can request deletion at the contact in Section 1. The periods intended for telephone logs do not automatically apply to the support chat.
4. Payments, subscriptions and invoices
We use Stripe for checkout, payment processing, subscription management and the payment portal. Data processed includes contact details, billing address, company and tax details, plan, transaction and subscription identifiers, amount, currency and payment status. Payment-status messages are used to activate or manage booked plans and minutes. Full card details are collected by Stripe during payment; they are not kept as Zeus Voice's own card file. Payment references in our account can be linked to individuals and are not anonymous.
Depending on the activity, Stripe acts as a processor or as an independent controller, for example for legal payment, fraud-prevention and financial obligations. See https://stripe.com/de/privacy. The applicable Stripe contracting entity for European customers depends on the relevant contract; our provider register distinguishes these roles.
The legal bases are performance of a contract or legitimate interests in conducting business, and statutory invoicing, tax and record-keeping duties (Article 6(1)(b), (f) and (c) GDPR).
5. Data processed during an AI telephone call
The voice assistant answers calls, processes speech technically and generates replies. Depending on configuration it can record contact and callback requests, complaints and service-related matters, manage appointments and transfer calls. In particular, this creates:
- audio streams for ongoing speech recognition and speech output;
- telephone numbers, names, email addresses and matters disclosed voluntarily;
- transcripts, summaries, extracted contact and appointment data, and tasks;
- time, duration, connection status, routing, error, usage and quality data;
- customer configurations, business information, knowledge content, transfer destinations and necessary conversation context.
Technical processing of speech is not the same as a stored sound recording. The standard offering described here does not provide for permanent audio recording. Transcripts, summaries and related metadata, however, are stored in Zeus Voice and made available to authorised users of the relevant customer. The specific storage settings of participating providers must be considered separately; not recording audio does not mean that no data or operating logs arise there.
The AI nature of the interaction should be clearly recognisable from the start. Identifying the AI does not replace a legal basis for the specific processing or information about stored conversation content. The controller must provide information appropriate to its use case. If you do not wish to speak with the AI, you can end the call or use another contact route offered. Transfer to a human is possible only if the relevant company has configured it and someone is available.
The company receiving the call determines the legal basis for caller data, for example pre-contractual steps requested by the caller, legitimate interests following a balancing exercise, or consent where required. The SaaS contract between Zeus Voice and the company is not automatically a legal basis for processing every caller's data.
6. Sensitive information and limits of automation
The standard offering is intended for administrative business matters, not targeted collection of health data, diagnoses, biometric identification or other special categories of data, medical advice, emergency-call handling or automated risk assessments with significant legal effects. Sensitive sectors and uses require separate assessment and approval before use.
Unsolicited sensitive details may nevertheless be processed technically when spoken and included in text output. We therefore ask that such details not be disclosed in standard use. A contractual prohibition is not an automatic filter. Controllers must minimise accidentally received information and arrange its deletion where necessary.
The application supports automated conversations, summaries, appointments and transfers. This does not mean that a human reviews every output before it is produced. AI outputs may be wrong. The standard offering is not intended for solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR; customers must review relevant decisions with a human. Future use for such purposes requires separate assessment and revised information.
7. Optional website analysis and calendar connections
At a customer's request, the website-scan function analyses publicly accessible website content through an AI API to suggest company details, services, opening hours and FAQs. Names and contact details remain personal data even when published openly. Clicking to start the function requests that function; it does not automatically provide valid consent on behalf of everyone named on the website. The customer must check its authority to use the information and review the results. This scan is separate from the models used in the voice service.
When a Google Calendar is connected, the authorised calendars, necessary account information and access and refresh tokens are processed. Depending on configuration, appointments are read, created, changed or deleted. Appointment time, service, name, contact details, staff assignment and notes may be transmitted. The customer should avoid unnecessary and sensitive details. Granting Google access is not consent from callers. Disconnecting in Zeus Voice and revoking access in the Google account are distinct steps; appointments already transferred are not automatically deleted. The privacy information and contracts for the relevant Google account also apply.
8. Recipients and international processing
Depending on the functions used, providers for hosting and delivery, database and login, voice AI and underlying models, telephony, website analysis, email delivery, payments and customer-connected calendars receive the data each needs. Within a customer account, access follows configured permissions. Where necessary, competent authorities, courts or advisers bound by professional confidentiality may also receive data under legal requirements or for the pursuit of legal claims.
The primary Zeus Voice database is in Frankfurt am Main. This does not guarantee that all providers, function executions, support access and model processing take place exclusively in Germany or the EEA. International voice and AI, payment and infrastructure services in particular may involve processing outside the EEA.
Transfers to third countries are subject to the applicable conditions of Articles 44 et seq. GDPR. An adequacy decision applies only to the covered recipient and processing; a data-privacy framework applies only where an appropriate valid certification exists. Standard contractual clauses require the necessary assessment and, where applicable, supplementary safeguards. An EU database region or a planned upgrade does not replace these requirements.
Specific recipients, services and applicable transfer grounds are listed in the customer provider register associated with the DPA. You may also request information about recipients and a copy of relevant safeguards from info@zeusvoice.de; data-subject rights are not limited to paying or registered users. Security-sensitive details and information about other people may be redacted where necessary.
9. Retention, deletion and data security
Our own contract and account data is needed to perform and wind up the business relationship. Invoices must generally be retained for eight years; other tax and commercial records may have different periods. The start of a period and statutory extensions depend on the applicable provision. Where data is needed for legal claims, it is retained for that purpose until the need ends and then deleted.
A regular maximum period of 365 days is intended for call transcripts, summaries and related conversation metadata unless the customer arranges earlier deletion or a specifically documented statutory or legal exception prevents it. Complete raw technical post-call webhook data and general system and delivery logs are intended to be deleted or reduced to necessary structured information after 30 days in normal circumstances. These periods will be described as implemented in production only after the relevant deletion jobs have been activated following a preview and controlled test. The duration of a subscription alone does not justify indefinite storage. Deletion in the customer account, deletion by providers and expiry of backups are separate processes. Return and deletion under the DPA apply after processing ends; cancelling one agent differs from closing the entire customer account.
We use risk-appropriate access restrictions and safeguards for processing. Detailed technical and organisational measures are provided with the DPA. We do not promise an absence of all risk, exclusively European processing or future backup functions that have not yet been activated. Zero Retention is activated for the voice agent used in production. According to the voice provider's current product description, it does not store call recordings, transcripts or conversation metadata containing personally identifiable information after a call. Necessary post-call data is transferred to Zeus Voice and processed there for the purposes described.
10. Your rights
Subject to statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw it at any time for the future; this does not affect earlier lawful processing.
Where processing relies on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time. We assess an objection under the statutory requirements.
You may complain to a data-protection supervisory authority, particularly in the place where you live or work or where the alleged infringement occurred. The North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information is generally the authority for our company: https://www.ldi.nrw.de.
Required account and contract data is necessary for the requested use; optional integrations can remain disconnected. Without the caller data needed for a particular request, automated handling may be limited. Please use another contact route provided by the company where appropriate.
11. Updates
We adapt this information to actual changes in processing and in the law. The published version shows its date. Updating privacy information does not replace any separate contractual acceptance or consent that may be required.