Documentation Index
Fetch the complete documentation index at: https://docs.salesfrank.com/llms.txt
Use this file to discover all available pages before exploring further.
Privacy Policy
As of: March 2026
1.1 Controller
Another Side Ventures Free Zone LLC
Al Shohada Road
Ras Al Khaimah
United Arab Emirates
Email: info@salesfrank.com
Website: salesfrank.com
1.2 EU Representative pursuant to Art. 27 GDPR
As Another Side Ventures Free Zone LLC is established outside the European Union but offers goods and services to individuals in the EU and processes personal data of individuals in the EU, the following representative in the European Union has been designated pursuant to Art. 27(1) GDPR:
Thomas Bergmann
Email: info@salesfrank.com
The EU representative serves as a point of contact for data subjects and supervisory authorities with regard to all matters relating to the processing of personal data.
For all questions regarding data protection, the exercise of your data subject rights, or complaints, please contact:
Email: info@salesfrank.com
We endeavor to respond to your inquiry within 30 days of receipt. In particularly complex cases, the deadline may be extended by a further two months in accordance with Art. 12(3) GDPR, of which we will inform you in a timely manner.
2. Principles of Data Processing
We process personal data in accordance with the General Data Protection Regulation (GDPR), the respectively applicable national data protection laws of the EU Member States, and the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) (Telecommunications Digital Services Data Protection Act).
We process personal data only insofar as:
- the data subject has given consent (Art. 6(1)(a) GDPR)
- the processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR)
- the processing is necessary for compliance with a legal obligation (Art. 6(1)(c) GDPR)
- the processing is necessary for the purposes of legitimate interests (Art. 6(1)(f) GDPR)
3. Processing of Personal Data in Detail
3.1.1 Server Log Files
Each time our website is accessed, information that your browser transmits to our server is automatically collected. This data is stored in server log files:
| Data | Description |
|---|
| IP address | The IP address of the accessing device |
| Date and time | Time of access |
| Page/file accessed | URL of the accessed resource |
| Referrer URL | Website from which the access originated |
| Browser and operating system | Browser type, version, operating system used |
| Amount of data transferred | Amount of data transferred as part of the request |
| Status code | HTTP status code of the server response |
| Data | Purpose |
|---|
| Name | Identification and personal address |
| Email address | Contact and appointment confirmation |
| Phone number (optional) | Telephone contact |
| Company (optional) | Assignment and meeting preparation |
| Message / inquiry | Processing your request |
| Selected appointment | Appointment scheduling |
3.1.3 Test Call Function
When you request a free test call via our website, we process:
| Data | Purpose |
|---|
| Phone number | Conducting the test call |
| Name (optional) | Personal address during the test call |
| Call recording | Demonstration of platform functionality |
| Transcript | Documentation of the test conversation |
3.2.1 Registration and User Account
Upon registration on our platform, we collect the following data:
| Data | Purpose | Legal basis |
|---|
| First and last name | Identification, contracting party | Art. 6(1)(b) GDPR |
| Email address | Communication, login, notifications | Art. 6(1)(b) GDPR |
| Phone number | Contact, verification | Art. 6(1)(b) GDPR |
| Company data (company name, address, VAT ID) | Contract processing, invoicing | Art. 6(1)(b), (c) GDPR |
| Password (stored encrypted) | Authentication | Art. 6(1)(b) GDPR |
| IP address and login timestamp | Security, abuse prevention | Art. 6(1)(f) GDPR |
| Data | Purpose | Legal basis |
|---|
| Campaign configurations (prompts, scripts) | Provision of platform functionality | Art. 6(1)(b) GDPR |
| Usage statistics (calls, minutes, campaigns) | Billing, dashboard, plan management | Art. 6(1)(b) GDPR |
| Technical usage data (page views, clicks within the platform) | Product improvement, bug fixing | Art. 6(1)(f) GDPR |
3.2.3 Payment Processing
Payment processing is carried out by the payment service provider Stripe Payments Europe Ltd (Ireland). In the course of payment processing, the following data is transmitted to Stripe:
| Data | Purpose |
|---|
| Name | Assignment of payment |
| Email address | Payment receipts, communication |
| Payment information (credit card, SEPA, etc.) | Execution of payment |
| Billing address | Invoicing |
| Purchase amount and plan | Billing |
3.3.1 Role Allocation
Our customers use the platform to conduct automated phone calls to their contact persons. In this context:
- Our customer is the Controller (Art. 4(7) GDPR) for the personal data of the contact persons. The customer decides on the purpose and means of processing.
- We act as the Processor (Art. 4(8) GDPR) and process the data exclusively on the documented instructions of the customer.
The rights and obligations are governed by a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.
3.3.2 What Data Do We Process on Behalf of Our Customers?
| Data Category | Description | Source |
|---|
| Contact data | Phone number (required), possibly name, email, company data, and other information uploaded by the customer | Uploaded by the customer |
| Call recordings | Audio recording of the entire phone conversation | Automatically created during the call |
| Transcripts | Complete transcription of the conversation | Automatically created by speech recognition |
| Call metadata | Date, time, duration, call status, outcome | Automatically captured |
| Extracted data | Structured information extracted from the conversation (e.g., appointment data, qualification results) | Automatically extracted by AI analysis |
3.3.3 Purpose and Legal Basis
The processing is carried out exclusively for the purpose of providing the platform functionality on behalf of the customer. The legal basis for the processing is determined by the respective customer as the Controller.
3.3.4 Recording and Transcription of Conversations
Phone conversations conducted via the platform are recorded and transcribed. The recordings and transcripts are stored exclusively on servers within the European Union (Microsoft Azure, Region EU West, Netherlands).
The recording serves the following purposes:
- Traceability of conversation contents by the customer
- Quality assurance and optimization of AI agents
- Data extraction (e.g., agreed appointments, conversation outcomes)
- Documentation of the conversation conduct
Retention period: For the duration of the contractual relationship between us and the customer. The customer can view and delete recordings and transcripts at any time via the dashboard. After termination of the contract, all data is deleted within 90 days at the latest.
3.3.5 AI-Powered Conversation Conduct
The platform uses AI models (Large Language Models) for automated conversation conduct. The AI processing takes place on servers within the EU:
| Component | Provider | Processing Location |
|---|
| Language model (LLM) | Azure OpenAI Service / Azure AI (Google Gemini) | Microsoft Azure, EU West (Netherlands) |
| Voice communication infrastructure | LiveKit (self-hosted) | Microsoft Azure, EU West (Netherlands) |
| Fallback voice infrastructure | VAPI (self-hosted) | Amazon Web Services, EU (Frankfurt) |
3.3.6 No Independent Analysis
We do not carry out any independent analysis of conversation contents. The processing is carried out exclusively on behalf of and on the instructions of the customer. No sentiment analysis, emotion recognition, biometric voice analysis, or other automated profiling takes place beyond the data extraction configured by the customer.
3.4 Communication by Email
If you contact us by email, we process your email address, your name (if provided), and the content of your message for the purpose of handling your inquiry.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
Email dispatch: For sending emails (e.g., notifications, invoices), we use the service Resend (Resend, Inc., USA). Resend processes the email address and email content for the purpose of delivery. The transfer is based on Standard Contractual Clauses (SCCs). Emails are not permanently stored by Resend.
4. Use of Third-Party Services and Sub-Processors
4.1 Overview of Services Used
In the course of providing the platform and the website, we use the following third-party services:
| Service | Provider | Registered Office | Processing Location | Purpose | Role |
|---|
| Microsoft Azure | Microsoft Ireland Operations Ltd | Ireland (EU) | EU West (Netherlands) | Hosting, compute, database, LLM processing, LiveKit hosting | Processor |
| Amazon Web Services | AWS EMEA SARL | Luxembourg (EU) | EU (Frankfurt) | Hosting fallback voice infrastructure (VAPI) | Processor |
| Twilio | Twilio Ireland Ltd | Ireland (EU) | EU (Ireland) | Telephony, number provisioning | Processor |
| Stripe | Stripe Payments Europe Ltd | Ireland (EU) | EU | Payment processing (payment data) | Independent Controller (processes payment data on the basis of its own privacy policy) |
| Resend | Resend, Inc. | USA | USA | Email dispatch | Processor |
| ElevenLabs | ElevenLabs, Inc. | USA | USA | Speech synthesis (TTS), speech recognition (STT) | Sub-processor |
| Deepgram | Deepgram, Inc. | USA | USA | Speech recognition (STT) | Sub-processor |
| Cartesia | Cartesia, Inc. | USA | USA | Speech synthesis (TTS) | Sub-processor |
| Framer | Framer B.V. | Netherlands (EU) | EU | Website hosting | Processor |
4.2 Self-Hosted Components (No Third-Country Transfer)
The following core components are operated by the Controller on EU infrastructure:
| Component | Technology | Hosting | Processing Location |
|---|
| Primary voice infrastructure | LiveKit (open-source, self-hosted) | Microsoft Azure | EU West (Netherlands) |
| Fallback voice infrastructure | VAPI (self-hosted) | Amazon Web Services | EU (Frankfurt) |
| Database | MongoDB (self-hosted on Azure) | Microsoft Azure | EU West (Netherlands) |
| Application server | NestJS + React | Microsoft Azure | EU West (Netherlands) |
| LLM processing | Azure OpenAI Service / Azure AI | Microsoft Azure | EU West (Netherlands) |
4.3 Voice Service Providers (Transient Real-Time Processing)
For the real-time processing of voice data during phone calls, the voice service providers ElevenLabs, Deepgram, and Cartesia are used. With regard to data processing by these services, the following should be noted:
Nature of processing:
- Audio data is transmitted to the service providers as a real-time stream and processed immediately (transient stream processing)
- No permanent storage of audio data, transcripts, or generated speech takes place at the service providers
- Processing takes place in the servers’ working memory and is deleted from memory upon completion of the respective request
Data minimization:
- Only audio fragments (STT) or text fragments (TTS) are transmitted to the voice service providers
- No identifying metadata (phone numbers, names, email addresses, company data) is transmitted to the voice service providers
- The voice service providers are unable to associate the audio data with a specific person
Safeguards for third-country transfer:
- Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) pursuant to Implementing Decision (EU) 2021/914 have been concluded with all voice service providers
- Participation in the EU-US Data Privacy Framework is verified (where applicable)
- A Transfer Impact Assessment (TIA) in accordance with EDPB Recommendations 01/2020 has been conducted for each voice service provider
- Transport encryption is carried out using TLS 1.2 or higher
The complete Transfer Impact Assessments can be viewed upon request.
5. Data Transfers to Third Countries
5.1 Principle
The core systems of the platform (hosting, database, application server, LLM processing, voice communication infrastructure) are operated exclusively within the European Union. The permanent storage of personal data takes place exclusively on EU servers.
5.2 Transfers to the USA
For the services listed below, transient data transfers to the USA take place:
| Service | Type of Data | Type of Processing | Safeguard |
|---|
| ElevenLabs | Audio fragments (STT), text fragments (TTS) | Transient, real-time | SCCs + DPA + TIA; where applicable EU-US DPF |
| Deepgram | Audio fragments (STT) | Transient, real-time | SCCs + DPA + TIA; where applicable EU-US DPF |
| Cartesia | Text fragments (TTS) | Transient, real-time | SCCs + DPA + TIA |
| Resend | Email addresses, email content | Transient (delivery) | SCCs + DPA |
5.3 Access from the United Arab Emirates
The Controller is established in the UAE. Authorized personnel access the EU systems administratively from there. As this remote access may be classified as a transfer of personal data to a third country within the meaning of Art. 44 et seq. GDPR, Standard Contractual Clauses (SCCs) pursuant to Implementing Decision (EU) 2021/914 have been implemented as the legal basis. Additionally, the following safeguards apply:
- All data remains on EU servers — no local storage on devices outside the EU
- Access exclusively via encrypted VPN connection with multi-factor authentication
- Role-based access control (RBAC)
- Complete logging of all access
- Transfer Impact Assessment (TIA) conducted in accordance with EDPB Recommendations 01/2020, which, in conjunction with the SCCs and the supplementary technical measures, confirms an adequate level of protection
5.4 No Transfer to Other Third Countries
Beyond the cases described above, no transfer of personal data to third countries takes place.
6. Retention Periods and Deletion Deadlines
6.1 Overview
| Data Category | Retention Period | Deletion |
|---|
| Server log files (website) | 30 days | Automatic deletion |
| Contact inquiries (forms) | Duration of processing + 6 months | After expiration of the period |
| Test call data | 90 days (if no contract is established) | Automatic deletion |
| User account data | Contract duration + 90 days | After contract termination and expiration of the export period |
| Contact data (uploaded by customer) | Contract duration | Deletable by customer at any time; within 90 days after contract termination at the latest |
| Call recordings | Contract duration | Deletable by customer at any time; within 90 days after contract termination at the latest |
| Transcripts | Contract duration | Deletable by customer at any time; within 90 days after contract termination at the latest |
| Call metadata | Contract duration | Within 90 days after contract termination at the latest |
| Invoice and payment data | Statutory retention period (up to 10 years pursuant to Section 147 AO, Section 257 HGB) | After expiration of the statutory period |
| Email communication | 3 years after last contact | After expiration of the period |
6.2 Deletion After Contract Termination
After termination of the contractual relationship, the customer receives a 30-day period to export all data via the dashboard export function in machine-readable formats (CSV, JSON). After expiration of this period, all personal data is irrevocably deleted within 90 days at the latest. Deletion is confirmed in writing upon request.
6.3 Statutory Retention Obligations
Insofar as statutory retention obligations (in particular commercial and tax law obligations pursuant to Section 147 AO, Section 257 HGB) preclude immediate deletion, the affected data is restricted and processed only for the legally prescribed purpose. This applies exclusively to invoice data and business correspondence.
7. Your Rights as a Data Subject
7.1 Overview
As a data subject, you have the following rights under the GDPR:
| Right | Article | Description |
|---|
| Right of access | Art. 15 GDPR | You have the right to obtain information about the personal data we process. This includes information about the processing purposes, the categories of data processed, the recipients, the retention period, and the origin of the data. |
| Right to rectification | Art. 16 GDPR | You have the right to request the immediate rectification of inaccurate or the completion of incomplete personal data. |
| Right to erasure | Art. 17 GDPR | You have the right to request the erasure of your personal data, provided the processing is not necessary for compliance with a legal obligation, for the exercise of the right to freedom of expression, for reasons of public interest, or for the establishment, exercise, or defense of legal claims. |
| Right to restriction | Art. 18 GDPR | You have the right to request the restriction of processing if you contest the accuracy of the data, the processing is unlawful, we no longer need the data, or you have lodged an objection. |
| Right to data portability | Art. 20 GDPR | You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and to transmit that data to another controller. |
| Right to object | Art. 21 GDPR | You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. |
| Right to withdraw consent | Art. 7(3) GDPR | Insofar as the processing is based on consent, you have the right to withdraw that consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of consent until the withdrawal is not affected thereby. |
- Primarily: The company that commissioned the call (the “Controller”). This company is usually identified at the beginning of the conversation or upon inquiry.
- Alternatively: Us at info@salesfrank.com. We will forward your inquiry to the responsible Controller and assist with processing.
7.3 Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You may in particular contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.
8. Data Security
We implement comprehensive technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of protection appropriate to the risk of the processing. These include in particular:
| Measure | Description |
|---|
| Encryption in transit | All data transfers are carried out via TLS 1.2 or higher (Transport Layer Security). This applies to the website, the platform, API communication, and connections to third-party services. |
| Encryption at rest | All data stored on EU servers is encrypted using AES-256 (Encryption at Rest). This includes the database, call recordings, transcripts, and backups. |
| Access control | Role-based access control (RBAC) with strict separation by areas of responsibility. Multi-factor authentication (MFA) for all administrative access. |
| Tenant separation | Logical separation of data from different customers through individual tenant identifiers. |
| Backups | Automated daily backups, stored encrypted in geographically separated availability zones within the EU. Retention: at least 30 days. |
| Monitoring | Continuous monitoring of systems for anomalies and security incidents (24/7). |
| Incident response | Documented process for detection, containment, analysis, and remediation of data protection incidents with notification within 24 hours. |
| Regular review | At least annual review and update of security measures. |
9. Cookies and Tracking
9.1 Technically Necessary Cookies
Our website and platform use technically necessary cookies that are required for the operation of the website and the provision of platform functionality. These cookies do not store personal data beyond session management.
| Cookie | Purpose | Retention Period |
|---|
| Session cookie | Management of the user session after login | Session duration (deleted when the browser is closed) |
| Authentication cookie | Maintenance of login status | Maximum 30 days |
| CSRF token | Protection against Cross-Site Request Forgery | Session duration |
| Cookie settings | Storage of your cookie preferences | 12 months |
9.2 Analytics and Marketing Cookies
Analytics or marketing cookies are only set with your explicit consent. Without your consent, no tracking takes place.
10. Automated Decision-Making and Profiling
10.1 AI-Powered Conversation Conduct
The platform uses AI models (Large Language Models) to conduct automated phone conversations. The AI makes automated decisions during the conversation regarding:
- The next conversational utterance (based on the logic configured by the customer)
- The qualification of the called person (based on criteria defined by the customer)
- The conversation outcome (e.g., “appointment scheduled,” “no interest”)
10.2 No Automated Decision with Legal Effect
The automated conversation conduct by the AI has no legal effect and no similarly significant impact on the called person within the meaning of Art. 22(1) GDPR. The AI:
- Does not conclude contracts
- Does not make legally binding statements
- Does not carry out scoring or profiling with legal consequences
- Merely qualifies the interest of the called person based on criteria defined by the customer
The called person can end the conversation at any time (hang up). The final decision regarding business relationships is always made by a human.
11. Changes to This Privacy Policy
We reserve the right to amend this privacy policy as needed to adapt it to changed legal requirements or technical changes. The current version is always available on our website. In the case of material changes affecting your rights, we will — where possible — inform you separately.
12. Validity and Authoritative Language Version
This privacy policy is drafted in German. In the event of discrepancies between different language versions, the German version shall prevail.
Another Side Ventures Free Zone LLC
Al Shohada Road, Ras Al Khaimah, UAE
EU Representative: Thomas Bergmann
Email: info@salesfrank.com
As of: March 2026
