Privacy policy

Version: September 2026

This privacy policy informs you how Rylivo UG (haftungsbeschränkt) processes personal data — both when you visit this website and when you use the „rylivo“ service, the AI phone assistant for businesses.

1. Controller

Rylivo UG (haftungsbeschränkt)
Friedrichstr. 155, 10117 Berlin
Managing Director: Feyzullah Gölbasi
E-mail: [email protected]

For the processing of data on this website and for the management of customer relationships, rylivo is the controller within the meaning of Art. 4(7) GDPR. For the processing of call data within the service, the particular allocation of roles set out in section 8 applies.

2. Hosting (Google Cloud)

This website and the service are operated at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in the Frankfurt am Main data centre region (europe-west3). A contract on processing on behalf (Art. 28 GDPR) is in place with Google. The processing takes place in the EU; where data is exceptionally transferred to third countries, this is done on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

When the website is accessed, we process technically necessary connection data. Section 3 describes which data we process to protect against abuse and attacks.

Call recordings and the program download are held in the object storage of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. A contract on processing on behalf is also in place with Cloudflare; the transfer is based on the EU Standard Contractual Clauses, Cloudflare is certified under the EU-US Data Privacy Framework, and the recordings are contractually bound to EU jurisdiction.

3. Protection against abuse and attacks

The demo call immediately calls any number entered, forms send emails, and publicly accessible functions can be used automatically or abusively. To detect, limit and investigate abuse, nuisance calls, attacks and other security-related incidents, we process technically necessary security and connection data.

This may include in particular:

Access log: IP address, time of access, requested path without unnecessary query parameters, HTTP method, response status and browser identifier (User-Agent). These data are used exclusively for operation, IT security, error analysis and protection against abuse.

Demo call: Phone number, time, company name where applicable, internet connection (IPv4 address or IPv6 /64 prefix), country and language. We limit the number of possible demo calls per phone number and internet connection per day; blocked numbers are not called.

Rate limiting: To technically limit abusive requests, counters or pseudonymised values or values generated using HMAC may be processed per internet connection. Cloudflare may additionally limit requests based on IP address.

No visitor recognition without consent: For protection against abuse, we do not use advertising or analytics identifiers without your consent and do not perform browser fingerprinting to recognise visitors across pages or on repeat visits. Tracking identifiers, ad-click identifiers and comparable data are not stored for analytics or advertising purposes before consent.

In particular, before the relevant consent is given, no data about fonts, system voices, Canvas or WebGL values, graphics cards or comparable device characteristics are collected or stored for tracking purposes.

Ad-click identifiers: Identifiers such as gclid, fbclid, msclkid, ttclid or comparable advertising and campaign identifiers are not stored for advertising, attribution or conversion purposes or transmitted to advertising providers before consent to marketing.

Recipients: Where necessary for operation and security, Cloudflare, Inc. may be engaged as a processor. Security data are not used for personalised advertising or audience measurement.

Legal basis: Technically necessary security data are processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of our website and service and protection against nuisance calls, cost abuse, attacks and other abuse. Where access to information on a device is strictly necessary for a service explicitly requested by the user, it takes place in accordance with Section 25(2)(2) TDDDG.

Storage on or access to your device that is not technically necessary, in particular for analytics, measurement, recognition or advertising purposes, takes place exclusively with your consent under Section 25(1) TDDDG.

Retention period: Retention of security data is determined by the handling of specific errors, abuse reports or security incidents. For an incident, only the necessary data are to be retained until it is resolved and, where applicable, for establishing or defending legal claims. Statutory retention obligations remain unaffected. Deletion requests can be made using the contact details in section 1.

Objection: Where processing is based on Art. 6(1)(f) GDPR, you may object under Art. 21 GDPR. Contact details are provided in section 1.

4. Cookies, audience measurement and advertising on this website

Consent as a prerequisite

We use analytics, measurement and advertising services on public pages only if you have given your express consent beforehand.

When you first visit our website, analytics and marketing services are initially not activated. In particular, before your consent, no corresponding tracking cookies or tracking identifiers are set, no analytics or advertising pixels are loaded, and no events are transmitted to advertising providers via server-side conversion interfaces.

In the consent dialogue, you can decide whether to consent to the Analytics and/or Marketing categories. Refusing consent does not affect your use of the technically necessary functions of our website.

Your consent is voluntary.

To store and demonstrate your choice, we process only the technically necessary information about your consent decision. This information is not used for advertising, audience measurement or profiling.

Legal bases

Where information is stored on or read from your device for analytics or advertising purposes, this takes place exclusively on the basis of your consent under Section 25(1) TDDDG.

Where personal data are processed in this context, processing is based on your consent under Art. 6(1)(a) GDPR.

You may withdraw or change your consent at any time with effect for the future via the Privacy settings available on the website.

Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before withdrawal.

Processing before consent

Until the relevant consent has been given:

• Google Analytics is not loaded;
• no Google Ads tags are activated;
• no advertising pixels from Meta, OpenAI, TikTok, Microsoft, LinkedIn, Reddit or X are activated;
• no events are transmitted to these providers via the associated Conversion or Events APIs;
• no tracking or measurement identifiers such as rl_measurement_v1 or rl_ads_attribution_v1 are created for analytics or advertising purposes;
• no advertising or click identifiers are stored for conversion or attribution purposes;
• contact enquiries, registrations, demo calls, appointment bookings, orders or purchases are not reported to advertising providers.

Simply visiting our website therefore does not, without your consent, cause your data to be processed by the analytics and advertising services described below through our integration of these services.

Processing after consent

If you consent to the relevant category, tracking and measurement data may be processed depending on your selection.

These may include:

• a random measurement or visitor identifier;
• ad-click identifiers;
• IP address;
• browser and device information;
• the page visited and the referring page;
• time of an event;
• event identifiers;
• information about contact enquiries, registrations, demo calls, appointment bookings, orders or purchases;
• for purchases, amount and currency.

Passwords, internal notes and call, calendar and portal content are not transmitted to the providers listed below for analytics or advertising purposes.

Server-side transmissions via Conversion APIs or comparable interfaces also take place only if the relevant consent exists at the time of the event concerned.

Google Analytics 4

After you consent to the Analytics category, we use Google Analytics 4 with measurement ID G-XY5GTG5JJR. The required script is loaded from www.googletagmanager.com.

Google Analytics is used for audience and usage measurement to help us understand how our website is used and how we can improve it.

After your consent, random identifiers may be stored in your browser for this purpose, in particular the cookies _ga and _ga_XY5GTG5JJR, each with a possible lifetime of up to two years.

In particular, the pages visited, time and duration of the visit, referring page, browser and device information and an approximate location derived from the IP address are collected.

If enabled, enhanced measurement may also collect interactions such as scrolling, clicks on external links, file downloads, form interactions, video interactions and page changes.

These data are pseudonymous, not anonymous. The identifiers used may in particular enable recognition of a browser.

Google signals and the use of Google Analytics data for personalised advertising are disabled in our configuration; we do not use Google Analytics advertising features.

Recipients and transfers to third countries: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data under the agreed data protection terms. A transfer to Google LLC in the USA may take place. Where applicable, this is based on the EU-US Data Privacy Framework or, additionally, the EU Standard Contractual Clauses.

Retention period: The above cookies may expire after two years at the latest. Data stored by Google are deleted in accordance with the retention periods set in our Google Analytics account.

Google Ads

After you consent to the Marketing category, we use the Google tag AW-18464034314 and, where applicable, server-side imports to attribute events to our advertisements and measure the effectiveness of advertising campaigns.

Google may also receive existing ad-click identifiers, event identifiers, timestamps and, for purchases, values and currency.

Cookies with the prefix _gcl_ may have a lifetime of up to 90 days after your consent.

Without your marketing consent, neither this storage nor corresponding server-side conversion transmissions are carried out by us.

ChatGPT Ads (OpenAI)

After you consent to the Marketing category, the ChatGPT Ads pixel and the OpenAI Conversions API may be used to measure the events you have authorised.

OpenAI may in particular receive available click and browser identifiers, public page paths, event data, IP address and browser information.

This serves ad attribution, performance measurement and optimisation of our advertising campaigns.

Without your marketing consent, we do not activate the pixel or corresponding server-side transmissions.

Meta pixel and Conversions API (Facebook and Instagram)

After you consent to the Marketing category, we use the Meta pixel with ID 1706435847136860. The script is loaded from connect.facebook.net.

The purpose is to measure the performance of our advertisements on Facebook and Instagram and, where covered by your consent, to create audiences for further advertisements.

After your consent, the pixel may in particular store the identifier _fbp in your browser. If you reach our website through a corresponding advertisement, an _fbc identifier may also be used.

Among other things, the page visited, time, browser and device information and IP address may be transmitted to Meta.

Where marketing consent has been given, our server may also transmit the events described above via the Meta Conversions API. This may include _fbp/_fbc identifiers, IP address, browser information and event data.

Browser and server events may use a shared event identifier to avoid double counting.

Without your marketing consent, we neither activate the Meta pixel nor transmit corresponding events via the Conversions API.

Joint controllership: Where the conditions are met, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, are joint controllers under Art. 26 GDPR for the collection and transmission of certain data. Meta is responsible for subsequent processing by Meta. Details are set out in the Controller Addendum provided by Meta.

Data may be transferred to Meta Platforms, Inc. in the USA. Where applicable, the transfer is based on the EU-US Data Privacy Framework or, additionally, Standard Contractual Clauses.

TikTok, Microsoft Advertising, LinkedIn, Reddit and X

After you consent to the Marketing category, the following services may also be used:

TikTok Pixel and Events API, Microsoft Advertising UET and Conversions API, LinkedIn Insight Tag and Conversions API, Reddit Pixel and Conversions API, and X Pixel and Conversions API.

These services are used to measure the performance of our advertising, attribute events to advertising campaigns and, where covered by your consent, create audiences.

Depending on the service, identifiers such as _ttp/ttclid, _uetvid/_uetsid/msclkid, li_fat_id, _rdt_uuid/rdt_cid and _twclid may be used.

After your marketing consent, providers may receive available browser and click identifiers, public page URLs, event identifiers and timestamps, IP address and browser information.

Without your marketing consent, these pixels and tags are not activated and we do not transmit corresponding events to providers via server-side conversion interfaces.

Depending on the provider, processing outside the European Union, particularly in the USA, may take place. Details of data processing, recipients, transfers to third countries and retention periods are set out in the privacy policies of the respective providers.

Contact, registration and order data

Using our contact forms, registering, making a demo call, booking a demo, placing an order or making a purchase does not depend on your consent to analytics or marketing.

Regardless of marketing consent, we process the data required for the respective action exclusively for the purposes described in the other sections of this privacy policy and on the legal bases stated there.

Such events are additionally transmitted to advertising providers only if you have previously consented to marketing.

Your privacy settings and withdrawal

You can change your decision at any time via the Privacy settings available on the website.

If you withdraw previously given consent:

• withdrawal applies to further processing dependent on consent in the current session as well as on later visits;
• no further server-side tracking or conversion transmissions dependent on this consent will take place;
• tracking identifiers set by us that are no longer required will be removed where technically possible.

Withdrawal takes effect for the future. The lawfulness of processing carried out on the basis of your consent before withdrawal remains unaffected.

Withdrawal does not affect the lawfulness of past processing. Continued storage of personal data requires a legal basis of its own; a provider’s privacy policy alone is not sufficient. Without another basis, a right to erasure generally arises under Art. 17 GDPR. For processors, we are responsible for the corresponding instructions; independent controllers must establish their own basis for further processing. Data subject rights may be exercised against the respective controller.

Retention period

For our own tracking data, the relevant criteria are the validity of the identifier, handling of the associated event and withdrawal of consent. If the purpose or legal basis ends, the data must be deleted unless statutory retention or another valid legal basis applies. Expiry of an identifier in the browser is not the same as deletion of data already stored on the server.

The choice stored in the browser (rl_consent_v1) is treated as valid for up to 365 days. The measurement identifier rl_measurement_v1 is renewed after 365 days upon further use; information in rl_ads_attribution_v1 is reused for attribution for up to 90 days. Local-storage entries may remain in the browser until overwritten or deleted. These usage periods are not retention periods for server-side evidence.

The retention period for data already transmitted to external providers also depends on the respective provider's privacy and retention policies.

After withdrawal, we do not carry out any new tracking activities or transmissions that depend on consent.

5. Contacting us

If you contact us by e-mail or through a contact form, we process the data you provide (e. g. name, company, e-mail address, telephone number, content of the enquiry) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). We delete the data as soon as it is no longer required for handling the enquiry and no statutory retention obligations preclude deletion.

6. Customer account and dashboard

Customers receive access to a personal dashboard. For this we process master data (company, name, e-mail address, telephone number, package booked) and login data. The processing takes place in order to perform the contract (Art. 6(1)(b) GDPR). To secure the login we use a technically necessary cookie (HttpOnly, lifetime 30 days); the legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) GDPR. No reach measurement takes place in the logged-in customer area; the measurement described in section 4 is not embedded there.

Optional calendar connection (Google, Microsoft, Calendly, Cal.com, iCloud)

In the customer area you can connect a calendar. With Google Calendar and Microsoft 365 you authorise rylivo via the provider's own sign-in page (OAuth); rylivo receives no password. With Calendly and Cal.com you provide a personal access key, and with Apple iCloud an app-specific password for CalDAV access. All access credentials are stored encrypted in the application database operated at Google Cloud in Frankfurt and are never displayed again in any view.

rylivo uses the calendar list or event types for selection and free/busy times to compute possible appointments. No descriptions of other appointments are needed for the availability display. An appointment request is first stored as an enquiry (name, callback number, e-mail address where applicable, request, note, preferred time). Only after express confirmation by your team does rylivo create an appointment at the provider. On a manual status reconciliation this known appointment is read; on a cancellation it is deleted at the provider. rylivo creates no attendee list and sends no invitations of its own; Calendly and Cal.com do, however, send their own notifications on a booking in accordance with their privacy terms.

In addition, rylivo stores the identifier and name of the selected calendar, your appointment rules, and the recorded enquiries with their appointment identifiers and status. The necessary calendar queries and confirmed appointment data are transmitted between rylivo and the respective provider (Google Ireland Ltd., Microsoft Ireland Operations Ltd., Calendly LLC (USA, EU Standard Contractual Clauses), Cal.com Inc. (USA, EU Standard Contractual Clauses), Apple Distribution International Ltd.). If you separately enable the calendar function for the phone assistant, it can name possible times and take enquiries; it cannot confirm or cancel appointments.

Google user data (Limited Use): data that rylivo receives through Google interfaces (the Google Calendar API as part of the Google Workspace APIs: calendar list, free/busy times and the appointments confirmed by your team) is used by us exclusively for the calendar function described in this section, which you enable and see for yourself in the customer area. The language model of the phone assistant receives from it only the free time slots computed for the call in question, never the contents of other calendar entries. This data is not sold, used for advertising or passed to third parties, whether raw, aggregated or derived, except where necessary to provide the function (processors under section 8) or to comply with legal obligations. It is not used to create, train or improve general AI or machine learning models. rylivo staff read this data only with your agreement (for example in the case of a support request), to prevent abuse or security incidents, or where a legal provision requires it.

Google API Services and Google Workspace APIs – Limited Use statement: rylivo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. rylivo does not use, transfer or sell Google user data – raw, aggregated or derived – to create, train or improve foundational or generalized machine learning or artificial intelligence models. The AI model that runs the phone conversation only receives the free time slots computed for the current call so that it can offer them to the caller; it never receives the contents of other calendar entries.

Using „Disconnect“ in the customer area removes the stored connection data at rylivo. Appointments already created at the provider are not deleted by this; you can additionally revoke the authorisation granted at the provider there. rylivo automatically deletes completed, discarded or cancelled appointment enquiries 90 days after the end of the appointment; enquiries still open remain stored until they are resolved. For earlier deletion, please use the contact options named in this privacy policy.

Demo appointment via the website

If you book a demonstration appointment via the website, we store your name, company, e-mail address, telephone number and the time selected in order to hold and confirm the appointment (Art. 6(1)(b) GDPR, pre-contractual measure). We send the confirmation via Brevo (Sendinblue GmbH, Berlin). We delete these bookings 90 days after the appointment.

7. Invoice and contract data

We process contract and billing data in order to perform the contract (Art. 6(1)(b) GDPR) and retain it within the framework of commercial and tax law retention obligations (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB).

We use Stripe to bill our own subscriptions. This involves the contact, contract, transaction and payment data required for payment and invoicing. Depending on the activity, Stripe acts as a processor or an independent controller, particularly for its own legal and fraud-prevention obligations. This processing concerns customer billing, rather than handling caller data on behalf of the business. Our billing is based on Art. 6(1)(b) GDPR; legally required retention is based on Art. 6(1)(c) GDPR.

Details of the relevant Stripe entities, their roles and international transfers: Stripe Privacy Center · Stripe Data Processing Agreement · Stripe Data Transfers Addendum.

8. The service: processing of call data on behalf of the businesses

Categories of data processed

• The caller's telephone number (where transmitted) and the time and duration of the call
• Conversation content as an audio recording and written record (transcript), including the details given by the caller such as name, callback number, request and preferred appointments

When handling calls, we distinguish processing the live conversation, real-time transcription, storage of a transcript and summary, and storage of an audio recording. These activities have different purposes and requirements. Notice of AI use does not replace consent to an audio recording.

Information for callers and legal basis

The respective business is responsible for the legal basis for handling its calls. Depending on the enquiry, Art. 6(1)(b) GDPR may apply to contractual or pre-contractual requests and Art. 6(1)(f) GDPR to necessary organisational handling. Real-time transcription and ongoing storage must each be assessed separately for necessity and a legal basis.

Audio recording generally requires informed and unambiguous consent before recording begins (Art. 6(1)(a), Art. 7 GDPR), for example an explicit yes or a keypress. Simply continuing a conversation after an announcement is not such consent. The responsible business must ensure evidence of consent and a practical contact option without audio recording. No audio recording may take place without the required consent.

Notice of interaction with an AI assistant is given at the beginning of the call. If special categories of personal data, such as health data, are processed, an applicable condition under Art. 9 GDPR must also be met. A general legal basis under Art. 6 GDPR is not sufficient on its own.

Sub-processors

We use the following sub-processors to provide the service. Contracts under Art. 28 GDPR are in place with all of them; transfers to third countries are safeguarded by EU Standard Contractual Clauses (SCC) and supplementary measures:

Storage period

The responsible business determines retention and deletion according to the particular enquiry and its documented instructions. Audio recordings, complete transcripts, summaries and connection data must be assessed separately. Relevant criteria are completion of the enquiry, an outstanding callback or appointment, necessary evidence and statutory retention obligations. The subscription term alone does not justify keeping every conversation for the entire contractual relationship.

rylivo assists the business with export and deletion on instruction. After processing on behalf of the business ends, data must be returned or deleted at the business’s choice unless statutory retention is required. Deletion instructions must also cover associated audio objects, attachments and copies. Further details are governed by the data processing agreement.

You can request information about the safeguards used for a transfer and a copy of the applicable Standard Contractual Clauses using the contact details in section 1.

WhatsApp conversations and attachments

Conversations and attachments are stored with restricted access in your workspace to handle customer enquiries. As the responsible business, you determine which data are still needed for that purpose. Our support team assists with deletion or export instructions; statutory retention obligations and data subject rights remain applicable. Voice messages are transcribed through Soniox in the EU.

9. Your rights as a data subject

In relation to the respective controller you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Where consent relates to analytics or marketing services on this website, you can withdraw it at any time via the Privacy settings available on the website. Withdrawing consent must be as easy as giving it.

For callers: please address your request primarily to the business you called — it is the controller for your data. We naturally assist the businesses in responding, and forward requests addressed to us without undue delay.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for rylivo is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

10. Currency of this policy

We adapt this privacy policy when the service or the legal position changes. The version currently in force is available at this address.