Privacy policy

Last updated: 28 September 2026

Translation for information only. The legally binding version of this privacy policy is the German version (Datenschutzerklärung). If the two differ, the German version prevails.

This policy informs you under Articles 13 and 14 GDPR how SIMRelay GmbH processes personal data when you

• visit our website voxio.dev,
• use a customer account in the Voxio portal or create a trial account,
• make or receive calls over the Voxio telephony platform – as an employee of a customer as well as an external caller –, or
• use the Voxio connect app for iOS or Android.

1. Controller and data protection officer

SIMRelay GmbH
Lilienthalstr. 5c
12529 Schönefeld
Germany
office@simrelay.com

Represented by Aleksander Koleski, Managing Director. Full company details are in our imprint.

Data protection officer

You can reach our data protection officer at datenschutz@simrelay.com or by post at the address above, marked “Data protection officer”.

2. Our roles: controller, processor, telecoms provider

Voxio is a cloud phone system for businesses. Depending on the processing, we act in different roles:

• Controller (Article 4 (7) GDPR) for the website, customer and trial accounts, billing, the technical operation of the platform including the traffic data we process ourselves as a provider of a telecommunications service, and device registration in the app.
• Processor (Article 28 GDPR) where we operate call lists, call recordings, voicemail, transcripts, summaries, AI voice agents, WhatsApp messages and integrations for our business customers. The controller is then the company that uses Voxio – for example your employer, or the company you are calling. That company decides which features are used and how long data is kept. Please address requests about this data to that company first; we forward requests sent to us.
• Telecommunications provider. Where we provide or take part in providing telecommunications services through Voxio, the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies, in particular its rules on the secrecy of telecommunications and on traffic data.

3. Secrecy of telecommunications

The content of your calls and their circumstances – in particular who called whom and when – are protected by the secrecy of telecommunications (Article 10 of the German Basic Law, § 3 TDDDG). We only take note of them as far as necessary to provide the service, including protecting our technical systems, or where a statutory provision expressly allows it. Call content is only recorded, transcribed or processed by AI systems if the customer concerned has switched the feature on (section 7). Our staff are bound to the secrecy of telecommunications and to confidentiality.

4. Website voxio.dev

4.1 Hosting and server log files

The website runs on the Cloudflare Workers platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, your browser necessarily transmits the following data, which Cloudflare processes to deliver the page and to protect it against attacks:

• the IP address of the requesting device
• date and time of the request
• the requested path, HTTP status and amount of data transferred
• the referring URL, browser type and version, and operating system

The legal basis is our legitimate interest in a secure, stable and efficiently delivered website (Article 6 (1) (f) GDPR); access to your device is strictly necessary for this (§ 25 (2) no. 2 TDDDG). We do not merge this data with other sources and do not use it to identify individual visitors. Logs are deleted after seven days at most. Cloudflare is our processor; on transfers to the USA see section 10.

4.2 Fonts and other assets

Fonts, stylesheets and images are delivered from our own domain only. No connection to Google Fonts or any other third-party content delivery network is made when you open a page.

4.3 Consent management

On your first visit we ask whether you agree to audience measurement. Until you agree, only the technically necessary processing described in 4.1 takes place.

Your decision is stored with its date in your browser's local storage under the key voxio-consent. This is necessary to honour your decision on later visits (Article 6 (1) (c) and (f) in conjunction with Article 7 (1) GDPR; § 25 (2) no. 2 TDDDG). The entry is not transmitted to us and is discarded after twelve months, after which we ask again.

You can change or withdraw your decision at any time with effect for the future: Change privacy settings

4.4 Google Tag Manager

Only with your consent do we load Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Tag Manager loads the analytics tags we have configured (4.5); it creates no profiles of its own but processes your IP address in order to be delivered. We use Google Consent Mode v2: before consent, all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage) are set to denied and only change to granted once you agree.

4.5 Google Analytics 4

With your consent we use Google Analytics 4 by Google to understand how our website is used and to improve it. It records in particular the pages viewed, time on page, referrer, approximate location (derived from the IP address, reduced to country/region), device and browser information, and interactions. Google Analytics 4 does not store full IP addresses in the EU. The cookies _ga and _ga_<ID> are set for up to two years. Event data is deleted in Google Analytics after 14 months. We do not use Google signals or advertising features.

The legal basis for 4.4 and 4.5 is your consent (Article 6 (1) (a) GDPR, § 25 (1) TDDDG). Withdrawal does not affect the lawfulness of processing carried out before it. Google processes the data as our processor; a transfer to Google LLC in the USA is possible (section 10). More information: policies.google.com/privacy.

5. Contacting us by email

If you email us, we process your email address, your name and the content of your message in order to answer you. The legal basis is Article 6 (1) (b) GDPR where your enquiry concerns a contract or its preparation, and otherwise our legitimate interest in answering enquiries (Article 6 (1) (f) GDPR).

6. Customer account, portal and trial

6.1 Customer account

For a customer account we process email address, password (stored only as a bcrypt hash), company name, display name, role in the account, stored forwarding numbers, email verification status, and the numbers, trunks, extensions and rules you configure. The legal basis is performance of the contract (Article 6 (1) (b) GDPR); where a customer's staff have an account, we process their data in our legitimate interest in performing the contract with the customer (Article 6 (1) (f) GDPR).

6.2 Sign-in and sessions

After sign-in we set a session cookie (HttpOnly, SameSite=Lax) that expires after seven days. It is strictly necessary for sign-in (§ 25 (2) no. 2 TDDDG, Article 6 (1) (b) GDPR). For email verification and password reset we create time-limited one-time tokens. If you connect third-party applications to Voxio via OAuth, we store the granted permissions and access tokens (as hashes); refresh tokens are valid for 90 days at most. The portal and dashboard use no analytics or tracking tools.

6.3 Trial with SMS verification

When you create a trial account, you confirm your mobile number with a code we send by SMS via Twilio. We process your mobile number and the code; the code is stored only as a salted hash and expires after ten minutes. We keep the verified number to prevent abuse of trial accounts. The legal basis is Article 6 (1) (b) GDPR and our legitimate interest in preventing abuse (Article 6 (1) (f) GDPR).

6.4 System emails

We send emails for account verification, password reset and – where the customer has set them up – notifications about new voicemail. These may contain the caller's number, the caller's name, a transcript and a summary. They are sent through an email delivery provider acting as our processor.

6.5 AI assistant in the portal

The portal offers an optional AI assistant that helps with configuration. Your input and the configuration data needed for the answer – with credentials and phone numbers masked – are processed by Anthropic (see section 9). The conversation is deleted after 24 hours. The legal basis is Article 6 (1) (b) GDPR.

7. Telephony over the Voxio platform

This section concerns everyone who makes calls over Voxio: users at the customer as well as people who call, or are called by, a company that uses Voxio. We do not receive this data from you directly but in the course of connecting the call (Article 14 GDPR).

7.1 Connection data (traffic data)

For every call we process: number or identifier of the calling and called party, start, answer, end and duration, direction, channel (telephone network or WhatsApp), connection status and hang-up cause, the extension, group and line used, technical identifiers, IP addresses of the devices involved, and call quality measurements (jitter, packet loss, round-trip time). For registrations of phones and devices we additionally process IP address, transport protocol and device/software identifier.

Purposes and legal bases:

• setting up, maintaining and ending the connection (§ 9 TDDDG, Article 6 (1) (b) GDPR),
• detecting, localising and eliminating faults and preventing abuse (§ 12 TDDDG),
• calculating and billing charges where usage-based billing applies (§ 10 TDDDG),
• providing the call list in the customer account on the customer's behalf (Article 28 GDPR).

7.2 Call content and media relay

Voice is relayed in real time through our servers in Germany and – in the browser and in the app – transmitted encrypted with DTLS-SRTP. Where no direct connection is possible, the still-encrypted media is relayed through Cloudflare's TURN service, which cannot decrypt it. The connection to the public telephone network is provided by the carrier (SIP trunk) chosen by the customer, which processes data for this under its own responsibility. Unless recording is switched on (7.4), voice is not stored. Key presses during a call (DTMF, e.g. menu choices) are processed to control the call and are not stored permanently.

7.3 Caller ID

On outgoing calls, only a number assigned to the customer, or one whose use the customer has proven, is presented. If a caller withholds their number, we do not show it to the called party and do not pass it to integrations; we process it only as far as necessary for connecting the call, eliminating faults and preventing abuse.

7.4 Call recording and voicemail

Calls are recorded only if the customer switches this on for the number or call concerned. Recording words not spoken in public is only lawful with the consent of everyone involved (§ 201 German Criminal Code, Article 6 (1) (a) GDPR); the customer must inform all participants beforehand and obtain their consent where required. The platform can play an announcement before the call for this. A mixed track and one track per participant are recorded.

If you leave a voicemail (up to 120 seconds), we store the recording together with your number, any name transmitted and any callback number you give, and notify the recipient. We process recordings and voicemail as the customer's processor; they are stored on our servers in Germany or within the EU.

7.5 AI transcription and summaries

If the customer has switched the feature on, voicemail and – with live transcription enabled – calls are automatically converted to text and summarised. For this we send the audio to ElevenLabs or OpenAI (speech recognition) and the transcript to Anthropic (summary). Transcript and summary are stored with the call record or the voicemail. The providers process the data as sub-processors solely to deliver this service and not to train their models. Transcription is fully automated; no decision with legal effect for you is derived from it.

7.6 AI voice agents

Customers can have calls answered by an AI voice agent (for example as a digital receptionist). The call is then transmitted in real time to the AI provider the customer has chosen – OpenAI, Google (Gemini), ElevenLabs or Anthropic – which processes it to understand speech and respond. The AI agent identifies itself as AI at the start of the call (Article 50 (1) EU AI Act). For speech output we generate audio through ElevenLabs and keep it in a temporary cache.

7.7 Answering machine detection

Customers can have outgoing calls automatically checked for whether a person or an answering machine picks up. The beginning of the audio signal is analysed technically for this; the result is stored with the call record.

7.8 WhatsApp Business

If a customer has connected WhatsApp Business, we relay WhatsApp calls and messages through the interface of Meta Platforms Ireland Limited. We process the WhatsApp ID or number, message content, timestamps and delivery and read status. WhatsApp's own privacy policy applies to the use of WhatsApp itself.

7.9 Integrations and webhooks

Customers can send call events (including numbers and times) to their own systems by webhook, or connect Voxio to applications such as HubSpot. With the HubSpot integration, the number is sent to the customer's HubSpot account to find the matching contact, and calls are logged there with number, time, duration, status and notes. The customer is responsible for processing in these target systems.

8. Voxio connect app

The app for iOS and Android is the handset for a Voxio extension that an administrator at your organisation sets up for you.

No account

The app has no user name and no password. Your administrator sends you an enrolment link or QR code (valid for 24 hours); opening it links that one device to the extension. We do not ask for your name, email address or mobile number.

What the app sends to us

• Device registration: platform (iOS/Android) and device model; in return the device receives an access token, which we store only as a hash. No IMEI, no advertising ID.
• Push token: on iOS a VoIP push token from Apple, on Android a Firebase Cloud Messaging token (Google), so calls ring while the app is closed. On Android, Firebase creates an installation ID for this.
• Calls: the number or extension you dial, key presses (DTMF), hold and hang-up, connection set-up data including your device's IP addresses, and the voice data during the call.
• Availability: the status you choose (Available, Away, Do not disturb) and the time of the last connection.

For incoming calls the app receives the caller's number and – if transmitted – name.

What stays on the device

• Call log: the last 200 calls (name, number, times, direction, outcome) are stored on the device only. You can clear them in the app; deleting the app removes them. On iOS, Voxio calls also appear in the Phone app's recent calls and may be synced from there via iCloud.
• Diagnostic log: the app keeps a log of up to 500 entries, which may contain phone numbers. It leaves the device only if you send it yourself with "Share app log".
• Contacts: access is requested only when you tap "Contacts" on the dial pad, and only to pick a number. The address book is not uploaded or stored.
• Credentials are kept encrypted in the iOS Keychain or the Android Keystore.

Permissions

• Microphone – for the call only
• Camera – only to scan the enrolment QR code. On Android, recognition runs locally with Google ML Kit; Google may receive technical usage and diagnostic data (e.g. device type, app version, performance metrics).
• Contacts – only to pick a number (see above)
• Notifications, phone integration (CallKit or Android Telecom), Bluetooth – for ringing and headsets

No location data is processed. The app contains no advertising and no analytics or crash-reporting SDKs.

Legal basis and unenrolment

Processing is necessary to provide the telephony service that you or your employer agreed (Article 6 (1) (b) and (f) GDPR, § 9 TDDDG); access to your device is strictly necessary for it (§ 25 (2) no. 2 TDDDG). "Unenroll device" on the Status tab, or revocation in the portal, ends the registration; we then delete the device record including the push token. If you only delete the app without unenrolling, the device record is deleted once your administrator revokes the device.

The app is intended for businesses and is not directed at children.

9. Recipients and processors

We use the following providers, which process data on our behalf under Article 28 GDPR or – for delivering push notifications and SMS – act as communication services:

Data is also received by: the carrier chosen by the customer for connecting to the telephone network, the customer itself and integrations it sets up (7.9), and authorities where we are legally obliged to disclose information (e.g. under §§ 170 et seq. of the German Telecommunications Act or the Code of Criminal Procedure). We do not sell personal data and do not use data from telephony or the app for advertising.

10. Transfers to third countries

Some of the providers named are based in the USA or may process data there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Article 45 GDPR). Otherwise we have agreed the European Commission's standard contractual clauses with the provider (Article 46 (2) (c) GDPR) and taken supplementary measures where necessary. You can obtain a copy of the safeguards on request.

11. Retention

We delete personal data as soon as it is no longer needed for its purpose and no statutory retention obligation applies. For data we process on behalf of a customer, the customer may set different periods under its own responsibility; without such a setting, the default periods below apply.

12. Your rights

Under the GDPR you have the right to

• access the data we hold about you (Article 15),
• have inaccurate data corrected (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability (Article 20),
• withdraw consent with effect for the future (Article 7 (3)).

Right to object: you may at any time, on grounds relating to your particular situation, object to processing of your data based on Article 6 (1) (f) GDPR (Article 21 GDPR). We will then stop processing it unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to datenschutz@simrelay.com is sufficient. If your request concerns data we process on behalf of a customer (section 2), please contact that customer; we support them in responding.

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or of the alleged infringement. For processing in connection with our telecommunications services, the competent authority is:

Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Straße 153
53117 Bonn, Germany

Otherwise (e.g. the website) the competent authority is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany

14. Provision of data, no automated decisions

Providing the data named in sections 6 to 8 is necessary to use the respective service; without it, calls cannot be connected and accounts cannot be kept. There is no statutory obligation to provide it. No solely automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

15. Security

All connections to the website, portal and APIs are encrypted with TLS, and voice in the browser and app with DTLS-SRTP. We store passwords and access tokens only as hashes. We take technical and organisational measures under Article 32 GDPR and the security requirements of the German Telecommunications Act, and keep them in line with the state of the art.

16. Changes to this policy

We update this policy when our services or the law change. The version in force is the one published here, with the date shown at the top.

Back to the Voxio home page