Privacy Policy

Effective Date: March 21, 2026
Last Updated: March 21, 2026

1. Introduction

Donostia OÜ (“we”, “us”, “our”) operates Ariel, an AI-powered receptionist service. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service at ariel.donostia.ai.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the Estonian Personal Data Protection Act, and other applicable data protection laws.

2. Information We Collect

Account Information

Name, email address, and business name provided during registration
Authentication credentials (hashed passwords, OAuth tokens)
Billing information processed through Stripe (we do not store card numbers)

Call Data

Inbound and outbound call recordings and transcripts
Call metadata (duration, timestamps, phone numbers, call outcomes)
AI-generated conversation summaries and analysis

Usage Data

Pages visited, features used, and interaction patterns within the Service
Device information, browser type, and IP address
Error logs and performance data

Business Data

Scripts, knowledge base entries, and campaign configurations you create
Contact lists and phone numbers you upload
Business settings (industry, tone, language preferences)

3. How We Use Your Information

We use your data to:

Provide, operate, and maintain the Ariel service
Process and handle phone calls through our AI receptionist
Generate call transcripts, summaries, and analytics
Process payments and manage your subscription
Send transactional emails (magic links, call follow-ups, billing notices)
Improve service quality and fix technical issues
Comply with legal obligations

We do not use your data for:

Selling to third parties
Targeted advertising
AI model training without your explicit opt-in consent

4. Legal Basis for Processing

Under GDPR, we process your data based on:

Contract performance: Processing necessary to provide the Service you signed up for (call handling, transcription, analytics)
Legitimate interest: Service improvement, security monitoring, and fraud prevention
Legal obligation: Tax records, regulatory compliance, and law enforcement requests
Consent: AI training data contribution (opt-in only), marketing communications

We share data only with service providers necessary to operate Ariel:

Provider	Purpose	Data Shared
ElevenLabs	Voice AI processing	Call audio, conversation context
Twilio	Phone number provisioning	Phone numbers, call routing data
Stripe	Payment processing	Billing details, subscription data
OpenRouter	AI transcript analysis	Call transcripts (anonymized where possible)
Resend	Transactional email	Email addresses, notification content
Neon (PostgreSQL)	Database hosting	All application data (encrypted at rest)

We may also disclose data:

When required by law, court order, or government request
To protect the rights, safety, or property of our users or the public
In connection with a merger, acquisition, or sale of assets (with prior notice)

6. Data Security

We implement industry-standard security measures:

Encryption in transit (TLS/HTTPS) and at rest
Hashed and salted passwords
JWT-based authentication with secure token handling
Rate limiting and CSRF protection
Regular security reviews of infrastructure and code
Access controls limiting employee access to production data

No system is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach, in compliance with GDPR Article 33.

7. Data Retention

Data Type	Retention Period
Account data	Duration of account + 30 days after deletion
Call recordings	90 days, unless you configure a shorter period
Call transcripts and metadata	Duration of account
Billing records	7 years (Estonian tax law)
Server logs	90 days

You may request earlier deletion of your data at any time (see Section 8).

8. Your Rights

Under GDPR and applicable laws, you have the right to:

Access your personal data and obtain a copy
Rectify inaccurate or incomplete data
Erase your data (“right to be forgotten”), subject to legal retention requirements
Restrict processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interest
Withdraw consent for optional processing (e.g., AI training opt-in) at any time

To exercise these rights, contact us at privacy@ariel.donostia.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

9. Cookies and Tracking

We use essential cookies to:

Maintain your authentication session (JWT token)
Remember your language preference
Protect against CSRF attacks

We do not use third-party analytics cookies, advertising trackers, or social media pixels.

See our Cookie Policy for full details.

10. Children’s Privacy

Ariel is a business service and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

11. International Data Transfers

Your data is processed and stored within the European Union. If data is transferred outside the EU (e.g., to US-based sub-processors), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to your registered address. Continued use of the Service after changes constitutes acceptance.

13. Contact Information

For privacy-related inquiries:

Email: privacy@ariel.donostia.ai
General Support: support@ariel.donostia.ai
Company: Donostia OÜ
Jurisdiction: Estonia

Last Updated: March 21, 2026