Skip to content
VandioBack to home

Privacy & Recording Notice

Last updated: August 20, 2026

Vandio is an AI voice-agent service operated by Sitovai Agency (Business ID 3638129-8, Finland). This notice explains what personal data we process, why, on what legal basis, how long we keep it, and your rights. It covers three situations: (A) you using Vandio as a business customer, (B) someone calling or being called by our own demo line, and (C) someone interacting with an AI phone agent that one of our customers runs.

AI and call recording — the short version

  • Our phone agents are artificial intelligence, not humans. The agent says so at the start of every call.
  • Calls are recorded and transcribed. The agent discloses this at the start of the call, before anything substantive.
  • We use recordings and transcripts to answer and book the call, to assure quality, and to improve the service. Improvement work uses de-identified transcripts wherever possible.
  • You can object to marketing calls and ask not to be called again at any time — just say so on the call, or email us. We act on it immediately.

A. Data we process about you (the business customer)

  • Account data: name, email, login credentials.
  • Business profile: hours, services, prices, FAQs, tone, language, and contact details you configure (or import from your website).
  • Billing data: handled by Stripe — we never see full card numbers.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in running and securing the Service (Art. 6(1)(f)).

B. Calls to or from Vandio's own demo line

When you call our demo number, or ask us to call you back through the “let the AI call you” widget, Sitovai Agency is the data controller. We process:

  • Your phone number, the time and duration of the call.
  • The call audio, its transcript, and an AI-generated summary.
  • For a requested callback: your number and the record of your consent (the wording shown, the time, and the SMS verification confirming you control the number).

Legal basis: your consent (Art. 6(1)(a)) to receive the demo call and to be recorded, which you can withdraw at any time; and our legitimate interest (Art. 6(1)(f)) in quality assurance. We place automated demo calls only after you request one and verify your own number, in line with the Finnish Act on Electronic Communications Services (§ 200) and the ePrivacy rules on automated calling. We call only within local business hours (Mon–Fri 9–20:30, Sat 10–18).

C. Data processed when a customer's AI handles calls

When someone calls a business that uses Vandio (or that business's AI places an outbound call), we process on that business's behalf:

  • Caller phone number, call time, and duration.
  • Call audio, its transcript, and an AI-generated summary.
  • Booking details the caller provides (name, phone number, requested service and time).
  • For outbound campaigns: the business's lead lists, consent records, do-not-call entries, and a compliance decision log.

For this data the customer business is the data controller and we act as its processor under a data-processing agreement. That business is responsible for having a lawful basis (e.g. prior consent for automated marketing calls) and for the AI-and-recording disclosures its callers hear.

Sub-processors

  • Supabase — database and authentication (EU hosting where available)
  • Vercel — application hosting
  • Vapi (incl. Deepgram) — voice platform: speech-to-text, call orchestration, text-to-speech
  • xAI (Grok) — the language model that generates the agent's responses
  • Anthropic — AI processing for setup import and call review/summaries
  • Twilio — telephony carrier and SMS
  • Stripe — payments
  • Resend — transactional email

Some sub-processors are based outside the EU/EEA (e.g. in the United States). Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Retention and deletion

How long we keep call data (this mirrors our internal retention policy):

  • Demo-line call recordings (audio): deleted within 90 days.
  • Demo-line transcripts and summaries: up to 12 months, then deleted.
  • Consent and do-not-call records: kept for up to 2 years after the last contact, so we can demonstrate consent and honour opt-outs.
  • Customer call records, transcripts and bookings (where we are the processor): retained while the customer's account is active so their dashboard history works, and deleted within 30 days of account deletion or on the customer's request — except where longer retention is legally required (e.g. bookkeeping records under the Finnish Accounting Act, ~6 years).

Your rights

Under the GDPR you can request access, correction, deletion, export, or restriction of your personal data, object to processing, and withdraw consent at any time (withdrawal is as easy as giving it). You have an unconditional right to object to direct marketing — tell the agent on the call or email us and we stop. You can lodge a complaint with your supervisory authority; in Finland this is the Data Protection Ombudsman (tietosuoja.fi). For a request about a call you made to one of our customers' businesses, contact that business — we will assist them in fulfilling it.

Cookies and similar technologies

We keep this deliberately small. Two kinds of cookie can be set on vandio.ai:

  • Necessary. Your sign-in session (sb-*, set by our authentication provider), the organisation you are currently viewing (active_org), and — only if you arrived through a partner's referral link — a 30-day attribution cookie (vd_ref) that records which partner sent you. These are required for the site to work and are set without asking.
  • Analytics and advertising (optional). If you accept them, we load the Meta Pixel, which sets Facebook's _fbp cookie and lets us measure which ads bring people here. Nothing from Meta loads until you accept, and you can change your mind at any time using the button below. Our own page analytics (Vercel Analytics) is cookieless and collects no personal identifiers.

Contact

Sitovai Agency, Helsinki, Finland (Business ID 3638129-8) — support@sitovaiagency.com. We reply within 1 business day.