ControllerThe controller responsible for the processing is Sundartha, [OPEN: full company name, legal form and address for service — see Imprint]. Contact for all data protection matters: kontakt@sundartha.com. [OPEN: statement on whether a data protection officer has been appointed — under Section 38 BDSG (German Federal Data Protection Act) this is only mandatory once, as a rule, at least 20 persons are constantly engaged in automated processing; until then the sentence “No data protection officer has been appointed.” is sufficient]
What Hermes isHermes is a telephone assistant. Users receive their own phone number. The assistant answers incoming calls and also makes outgoing calls on the user’s behalf. It understands spoken language, answers by voice and then summarises the conversation. This necessarily means that data of the other parties to the call is processed as well, not only the user’s data.
Account dataWhen signing up, the following data is generated: email address, an identifier from the sign-in service, session data and the name the assistant states during calls. In addition, there is the assigned phone number, the chosen language, the country and — if the user provides one — a private mobile number to which call summaries can be sent by SMS. At the user’s request, call summaries are additionally sent by email to the account address and to up to five further email addresses; each further address must be approved by the recipient themselves via a confirmation link (double opt-in) and can be removed again via an unsubscribe link in every email. For this purpose, the address, the time of confirmation and an unsubscribe flag are stored.
Data from callsFor each call, the following data is generated: direction of the call, the phone numbers involved, time and duration, status, language, any name of the caller, the call instruction, a summary and the tasks and appointments derived from it. During the call, a verbatim record (transcript) is also generated. No audio recordings of the calls are stored in our system; what is processed is the text generated from what was said. At the provider of the conversation platform that conducts the call, audio recording is switched off; this was checked against the live configuration on 20 September 2026.
Usage and payment dataFor billing and cost control, the call minutes used and the associated costs are recorded. Payment data is processed by our payment service provider. Our system holds only references for this (customer, payment method and subscription identifiers), not full card details.
Purposes and legal basesWe process account, call and billing data to perform the contract (Art. 6(1)(b) GDPR). We base protection against misuse, fraud and cost control, troubleshooting and operational security — such as call limits, country restrictions for outgoing calls and budget limits — on a legitimate interest (Art. 6(1)(f) GDPR). We process invoice data that must be retained for tax purposes under Art. 6(1)(c) GDPR. We base the sending of call summaries by email on your consent (Art. 6(1)(a) GDPR); consent is given in the customer area, is never pre-ticked and can be withdrawn there at any time. Further recipients rely on their own consent, given via a confirmation link. We process data of the other parties to the call — phone number, name, what is said — on behalf of the user on the basis of the legitimate interest in conducting the call and recording it for the user (Art. 6(1)(f) GDPR); the assistant informs the other parties of the processing at the start of the call.
Other parties to the callOn outgoing calls, the assistant states unprompted at the start of the call that it is an AI assistant acting on behalf of the user and that the call will be summarised for the person who commissioned it. On incoming calls, the greeting is preceded by the sentence “Hinweis: Sie sprechen mit einer KI, das Gespräch wird transkribiert und zusammengefasst.” (Note: you are speaking with an AI; the call will be transcribed and summarised.) (or the English or French version). Both notices are fixed in the system, cannot be switched off and are not generated by the language model. The user who commissions a call remains responsible for the lawfulness of that call.
Recipients and processorsWe use the following service providers, who process data on our behalf (Art. 28 GDPR). The list is derived from the actual integration in the system (as of September 2026). If one of the functions named below is switched off for your account, the transfer described for it does not take place for you; the recipient is nevertheless named so that this policy does not silently become incorrect as soon as the function is switched on. — Telephony: Telnyx LLC, Austin (USA); according to the provider, the contracting party for customers in the EU is Telnyx Ireland Limited, Dublin. Telnyx provides the phone number, sets up and ends the calls, carries the conversation and sends the SMS summaries. Data: phone numbers of both sides, the call audio during the call, connection data, content of the SMS. Telnyx uses its own sub-processors for operation; the provider maintains the list currently in force. — Speech recognition and speech output on the telephony path: on the Telnyx path, which today runs only as a fallback mode, Telnyx converts what is said into text during the call (speech recognition using Deepgram models, which according to Telnyx it operates on its own infrastructure) and on the same path generates the assistant’s voice using Microsoft Azure speech synthesis; Microsoft is listed as a sub-processor at Telnyx. Data: call audio of both sides, the verbatim record generated from it and the text we pass on for the assistant to speak on this path. — Conversation platform: Eleven Labs Inc., New York (USA). This provider conducts the call: it recognises what both sides say, has a language model respond and generates the assistant’s voice. For this purpose, the phone call is put through directly to this provider. Data: the call audio of both sides — that is, expressly including what the other parties to the call say —, the verbatim record generated from it, the call instruction, stored background information, the name of the person who commissioned the call, the phone number of the other party and the time zones used. — Language model in the call: the model that responds on the conversation platform is a sub-processor of that platform provider; the model set there is one from Anthropic. [OPEN: confirmation by the operator of which model is set in the platform provider’s live configuration and whether it is listed in that provider’s list of sub-processors — the operator checks this against the provider configuration and adds it here.] — Language model for summary and preparation: DeepSeek (as of September 2026). This model creates the summary after the call, prepares the call and derives tasks and appointments. Which of the two connected providers does this is a setting in the system and can switch back to Anthropic. Data: verbatim record, call instruction, name of the user and of the other party to the call, language. [OPEN: contracting party, registered office, place of processing, data processing agreement and exclusion of use for training purposes at the language model provider DeepSeek — the operator adds this information.] — Second language model provider: Anthropic (Anthropic, PBC, San Francisco, USA; the contracting party for customers in the EEA is Anthropic Ireland, Limited, Dublin). If the setting is Anthropic, this provider serves the same purpose as the item above. In addition, the preliminary research before a call, if it is active for your account, runs as a web search within this model call. Data: as for the language model for summary and preparation, and for the research additionally the search term formed from the call instruction. Under the terms of the Anthropic interface, this content is not used to train the models. — Look-up during the call: Exa. If the look-up function is active for your account, the question that arises during the ongoing call — which may therefore include what the other party says — is sent to this provider as a search query. Data: the text of this search query. — Sign-in and account management: WorkOS, Inc., San Francisco (USA). Data: email address, sign-in identifier, sign-in times. When the contract ends, we delete the user account there. — Payment processing: Stripe; the contracting party for providers in the EEA is Stripe Payments Europe, Limited, Dublin (Ireland), parent company Stripe, Inc. (USA). Data: payment method, email address, invoice amounts, reported call minutes. You enter card details directly with Stripe; we hold only identifiers. — Hosting and database: Render Services, Inc., San Francisco (USA). The application and database run in the Render region Frankfurt am Main. Data: all stored data named in this policy as well as the server logs. — Email sending: Brevo (Sendinblue SAS, Paris, France) for cancellation confirmations, the call summaries by email and the confirmation emails to further recipients; data: email address, subject and content of the email. As a fallback, we send via our own SMTP mailbox; in both cases the connection is encrypted. [OPEN: confirmation by the operator of which SMTP provider is set for the fallback path and where it processes data.] — Determining the country from the IP address takes place on our own server using a file stored there; no data is transferred to third parties in the process. — The connection to an AI assistant through which the service can be controlled is described in the following section. [OPEN: confirmation by the operator that the data processing agreement has been accepted with each provider named — for Telnyx, ElevenLabs, Anthropic, WorkOS, Stripe and Render, according to the provider it forms part of the terms of use and applies upon conclusion of the contract; for Brevo, the SMTP provider of the fallback path, DeepSeek and Exa, acceptance must be checked in the respective customer account.]
Connection to an AI assistantHermes can be controlled from within an AI assistant. The user establishes the connection themselves by connecting the service in their assistant. Once connected, the operator of that assistant receives: status and result of a call, the summary, the last lines of the verbatim record of both sides and — if the consultation function is active for your account — the question asked during the ongoing call. Audio is never transmitted via this connection; it transmits only text and status information. The user chooses which assistant to use for this; the processing there is governed by the privacy policy of the respective operator and not by this policy.
Transfers to third countriesTelnyx, ElevenLabs, Anthropic, WorkOS, Render and the parent company of Stripe are based in the United States. The following may be transferred there: phone numbers, call audio during the call and the verbatim record (Telnyx), the call audio of both sides, the verbatim record generated from it and the call instruction (ElevenLabs), the verbatim record and the call instruction (Anthropic), email address and sign-in identifier (WorkOS), payment and invoice data (Stripe) and — for operation and support of the hosting — the data stored in Frankfurt (Render). The safeguard per provider is as follows: Telnyx LLC, Eleven Labs Inc., Stripe, Inc. and Render Services, Inc. are, according to their own statements, certified under the EU-U.S. Data Privacy Framework; for them, the European Commission’s adequacy decision of 10 July 2023 applies (Art. 45 GDPR). Anthropic and WorkOS hold no such certification; with them, the European Commission’s standard contractual clauses apply (Art. 46(2)(c) GDPR), which form part of their data processing agreements. The contracts of the certified providers also contain the standard contractual clauses as an additional safeguard. Brevo processes data in the EU; Brevo is additionally certified under the Data Privacy Framework for transfers to its US subsidiary. Telnyx and Render name the USA as their main place of processing; the operation of our application and of the database itself takes place in Frankfurt. We will provide a copy of the standard contractual clauses in force in each case on request to kontakt@sundartha.com. In addition, there are DeepSeek (verbatim record and call instruction), Exa (the search query arising during the call, if the look-up function is active for your account) and the operator of the assistant connection (summary, status and the last lines of the verbatim record). [OPEN: third-country safeguard per recipient — adequacy decision or standard contractual clauses — for DeepSeek, Exa and the operator of the assistant connection; the operator adds these.] [OPEN: check by the operator before publication that the certifications named are actively listed at dataprivacyframework.gov — the information is based on the providers’ legal pages, as of August 2026.]
Cookies and local storageThe website stores on your device only what is necessary for its operation: your language choice (entry “hermes.lang.v2” in the browser’s local storage) and your decision on cookies (“hermes.consent”, with the time of the decision and a randomly generated identifier). In the customer area, a session cookie is added that keeps you signed in after you sign in. This storage is necessary for the functions you have expressly requested and does not require consent (Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)). We do not currently use any analytics or marketing services that set cookies or access your device; should we introduce such services, they will only run after your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can change or withdraw at any time via “Cookie settings” in the footer of the website. So that we can demonstrate consent (Art. 7(1) GDPR), the website transmits every decision in the cookie notice — acceptance, rejection, change and withdrawal — to our server and stores there: the randomly generated identifier from your browser, the version of the notice, the categories selected, the time and the address of the website on which you made the decision. Your IP address, your browser identifier or a customer account are not stored in the process; the identifier can only be used to link your own decisions to one another. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. We delete these entries after three years. When pages are accessed, the server, for technical reasons, logs the IP address, time, requested address and browser identifier for operational security and troubleshooting (Art. 6(1)(f) GDPR). The website itself does not embed any fonts, scripts or images from third-party servers. [OPEN: retention period of the server logs at Render — the operator must enter the value applicable to the booked Render plan from the Render documentation on log retention.]
Retention periodThe verbatim record of a call is deleted as soon as the summary has been created; the summary, tasks and appointments are retained. If the summary fails, the verbatim record remains until the next regular deletion. Completed calls, notifications and completed tasks are automatically deleted after 30 days; the deletion run starts when the application starts and then runs regularly. We do not store verbatim quotations from calls. Account data remains stored for the duration of the contractual relationship; if the contract ends through cancellation, we release the phone number and delete the user account at the sign-in service. Confirmed additional email recipients remain stored until they unsubscribe or the user removes them. We retain invoice and accounting data for the statutory periods. Entries in the log of cookie decisions are deleted after three years. Independently of this, the provider of the conversation platform stores the call conducted there on its own. The retention set there was measured on 20 September 2026 and is set to unlimited (value -1); no automatic deletion currently takes place there. Deletion at the provider is therefore a separate step and is not covered by the periods of our system named above.
Your rightsYou have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on a legitimate interest. You can retrieve information about the data stored for your account within the service; this retrieval covers your calls including verbatim records, the tasks derived from them and the associated notifications, but not settings, profile, identity verification details and payment identifiers. On request, we delete your calls including verbatim records, the tasks derived from them, the associated notifications and the private phone number provided. Everything else is currently done manually and on separate request: the account at the sign-in service, settings, profile, calendar, usage figures and the calls stored at the provider of the conversation platform. Billing data remains stored for the duration of the statutory retention periods. There is no self-service route for deletion in the service. For access and erasure, contact kontakt@sundartha.com. You also have the right to lodge a complaint with a data protection supervisory authority, usually at the place of your residence.
Whether the information is requiredThe account, phone number and payment method details are required to use the service. Without them, no line can be provided and no call can be made. The private mobile number for summaries by SMS is optional.
Note on this textThis draft describes the processing as it actually takes place in the system. It does not replace legal advice and should be reviewed by a lawyer before use — in particular the information on third-country transfers and processing on behalf.
This is an informative English translation. Only the German version is legally binding. — Open as a separate page
