Last updated: 10 October 2026 · Deutsche Fassung
This is an English translation of our German privacy policy (Datenschutzerklärung). In case of discrepancies, the German version prevails.
Email, also for data protection requests: support@voicehook.ai
voicehook.ai is a voice call in your browser. You talk to a voice bot whose answers come either from an AI language model or from an AI agent you invite. You can use a free allowance without signing in. For paid usage you top up a balance; for this there is an account, to which your email address is optionally linked. Our pages set no cookies for visitors and embed no analytics, tracking or advertising services.
The website, the application programming interface (API), the databases and the voice server run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data center, Germany. Hetzner processes the data as a processor.
When you visit voicehook.ai, the web server (Caddy) logs every request with:
In addition, the application server and the voice service log technical events: room name, participant identifiers, start, end and duration of a call, booking and error messages. We do not log call content: neither what you say nor what the bot or an invited agent says, only technical details such as length, time and state of an utterance.
For our reach statistics we count per day, campaign source and step (page view, call started, invite copied, AI joined, call of one minute or longer, sign-in, top-up, another call on a later day). The open page keeps the campaign source (utm_source and utm_campaign from the link) only in memory; it is not stored in your browser. For calls via an invite link or a call link created by an AI agent, the type of link counts as the source; without a campaign source the source is "direct". When a room is created, the page sends the source once, and the server stores it as a label for the room name (room name, source, campaign, time; separate table room_source in funnel.sqlite, not in the cost record), without IP address, account or device identifier. Whether an invite was copied or an AI joined in this room is also noted for the room. The server assigns the remaining steps only via the room name: call of one minute or longer and sign-in from the cost record (section 7.1), top-up from the bookings of the account linked to this room. This assignment is pseudonymous, not anonymous, because the bookings of an account can be reached via the room. However, only totals per day, source and step are evaluated and output; the statistics do not link the steps to your person and contain no IP addresses and no identifiers of your device. Whether someone comes back is evaluated only for signed-in accounts, based on the call bookings that are stored anyway; this too results only in totals. Like every request, the counting requests appear in the server log for at most 7 days, without the content of the request. We delete labels and notes for a room after 35 days and the daily counters without personal reference after 25 months (section 14). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach without tracking).
Purpose: operation, troubleshooting and prevention of abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and working service).
To prevent abuse, the server keeps the IP address in memory for up to 10 minutes when a call is started (at most 5 call starts per 10 minutes and IP address). This list is not written to disk.
Audio is transmitted in real time via WebRTC through a self-hosted LiveKit server on our server in Nuremberg (rtc.voicehook.ai). We do not record calls. To join, the server issues an access token that expires after one hour by default. Invite links are bound to one room and also expire. The call ends when nobody is left in the room or the balance is used up. The room is then deleted.
So that the bot can understand you, your microphone audio is sent to Deepgram, Inc. (USA) for speech recognition. A voice filter on our server only sends segments in which speech was detected; silence is not sent.
In normal mode, Google's Gemini API receives the recognized text of the conversation and the instructions for the bot in order to generate answers. In live mode, your audio is sent directly to Gemini Live (Google), which handles speech recognition, the answer and speech output in one step.
The sentences the bot speaks are converted into audio by Google Cloud Text-to-Speech. Google only receives the text to be spoken.
The transcript (what the bot heard and said) is sent live to the participants in the room and shown in the browser. Our code does not store transcripts or audio permanently. If you invite your own AI agent into the call (for example Claude Code or Codex), this agent receives the transcripts. We are not responsible for the processing by your agent and its provider.
Legal basis for the processing during the call: Art. 6(1)(b) GDPR (providing the service you started).
An invited agent joins the call either directly via WebRTC (for example with the command line
tool voicehook-agent) or via our HTTPS interface (/api/bridge/*), for example when
it runs in a cloud environment without WebRTC. When an agent joins via HTTPS, our server holds
the connection to the room on the agent's behalf. It forwards the transcript, the sentences of
other participants and events in the room (who joins, who is speaking) to the agent via HTTPS,
and passes the sentences the agent wants spoken on to the bot. The server keeps this content
in memory only, for as long as the session runs.
For each join, the server issues a random session key that is valid for this one room only. The server stores only a SHA-256 hash of it. The key expires when the call ends or the agent leaves the room, and also after a period of inactivity (10 minutes by default; the agent can set this to up to 60 minutes or switch it off). So that a running session survives a restart of our server, we store the following per session in a database on our server (bridge.sqlite): room name, participant identifier, the agent's IP address, the name and model stated by the agent, the requested voice, the user's name if the agent sends it, and the times of start, last activity and end. We do not store invites, persona texts or transcripts there. The entry is deleted no later than 5 minutes after the session ends. When the agent joins, the server logs the room name, participant identifier and the agent's IP address (see section 4).
You decide which agent you invite; it is operated by you or by a provider of your choice. We are not responsible for the processing by your agent and its provider (see 5.5). Legal basis: Art. 6(1)(b) GDPR.
The site and the call are available in German and in English. Your browser stores your choice
locally (see section 11). When a room is created, the server records the language as a
property of the room (room metadata on our LiveKit server) so that the bot and invited agents
use the same language; invite links to English rooms carry the addition lang=en.
This setting belongs to the room, not to a person, and disappears with the room. The label with
the campaign source, by contrast, is stored by the server separately from the room (see
sections 4 and 14).
Without a balance, there is a limited free allowance per day. To attribute it, we use a random identifier that your browser creates in local storage (anon-id) and your IP address (for IPv6, the /64 network); if you are signed in, also the internal identifier of your account, so that the allowance applies once per account and day. Of these, we only store SHA-256 hash values, never the identifier or the IP address in plain text. We compute the hash of the IP address with a secret key that changes daily and is not stored anywhere, so hash values from different days cannot be linked. In addition, we store the day, mode, usage and the room name. These entries are deleted automatically after 7 days.
Legal basis: Art. 6(1)(b) GDPR (providing the free offer) and (f) (legitimate interest in preventing abuse of the free offer).
When you top up a balance, the server creates an account and gives your browser a secret wallet token, which is kept in your browser's local storage. The server stores only a SHA-256 hash of it. In the account database (billing.sqlite) we store:
Legal basis: Art. 6(1)(b) GDPR (contract for the balance) and (c) (retention obligations under commercial and tax law for bookings).
At the end of every call, the server writes an entry to a cost record (table call_ledger in billing.sqlite), also for calls using the free allowance. An entry contains:
The record contains no transcripts, audio, email addresses or IP addresses. Purpose: billing, traceability of bookings and control of our costs. Legal basis: Art. 6(1)(b) GDPR.
Your browser stores your own styles (name, colour and slider values, preview image) in local storage (see section 11). If you are signed in, we also store them with your account (in billing.sqlite) so that they are available on all your devices. If you share a style, we create an unchangeable copy that anyone with the link can retrieve; your account and email address are not visible. Legal basis: Art. 6(1)(b) GDPR. Storage period: as long as the account exists.
If you enter your email address, we send you a sign-in link. It is sent via Resend (Resend, Inc., USA), which receives your email address and the content of the email for this purpose. The link is valid for 15 minutes and can only be used once; the server stores only a hash of it together with the email address. To prevent abuse, we limit the number of requests per IP address and email address.
You can also sign in with your Google or GitHub account (OAuth). You are redirected to the respective provider and sign in there. We only request your email address and only accept it if the provider reports it as verified. We store the verified email address and the identifier of your account at the provider (provider ID) with the time of the first and last sign-in. Google and GitHub are themselves responsible for the processing during sign-in on their pages.
Legal basis for the sign-in: Art. 6(1)(b) GDPR.
To top up, we redirect you to Stripe's payment page (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details (for example card details) directly at Stripe; we do not receive them. If an email address is already stored for your account, we pass it to Stripe so that it is prefilled. From Stripe we receive the email address given during payment, the amount and identifiers of the payment, as well as notifications about refunds and chargebacks. Stripe may also transfer data to the USA. Legal basis: Art. 6(1)(b) and (c) GDPR.
The call page loads the libraries livekit-client and three.js from the content delivery network jsDelivr. The CDN operator receives your IP address and browser headers. Legal basis: Art. 6(1)(f) GDPR (fast, reliable delivery).
We do not set cookies for visitors. Exception: the operator's devices carry a technical
cookie (vh_int) so that their requests are not counted in the statistics.
Visitors never receive this cookie. Our pages store some values in your browser's local
storage (localStorage). We do not store the campaign source from a link in your browser. Most of them never leave your browser; the participant identifier, anon-id,
wallet token and sign-in nonce are sent to our server with the respective request. You can
delete everything at any time in your browser settings.
| Key | Content |
|---|---|
vh-wallet-v1 | Wallet token: access to your balance |
vh_login_nonce | One-time value that binds a sign-in to this browser |
vh-anon-v1 | Random identifier for the free allowance (anon-id) |
vh-free-seen-v1 | Whether the note about the free allowance has already been shown today |
vh-seen-v1 | Whether you have had a call before (controls the note for first-time visitors) |
vh-theme-v1 | Light or dark design |
vh-hd-v1 | HD display on/off |
vh-tr-mode-v1 | Position and display of the transcript |
vh-music-state-v2 | Visualization settings (sliders, color palette) |
vh-mode-v1 | Selected display mode |
vh-live-mode-v1 | Normal mode or live mode |
vh.lang | Selected language for the site and the call (German or English) |
vh-mic-v1, vh-mic-v1-label | Selected microphone (device ID and name) |
vh-id:v1:<room> | Random participant identifier per room, so that reloading does not show you as a new person |
A previously used key vh-recent-invites:v1 is deleted when the page is opened.
Stripe's payment page and the sign-in pages of Google and GitHub may set their own cookies;
the privacy notices of these providers apply to them.
Emails to addresses at voicehook.ai are forwarded to our mailbox via the forwarding service ImprovMX. We process your message only to answer it. Legal basis: Art. 6(1)(b) or (f) GDPR.
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting | Germany |
| Deepgram, Inc. | Speech recognition | USA |
| Google (Gemini API, Gemini Live, Cloud Text-to-Speech) | Language model, speech output | Ireland / USA |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland |
| Resend, Inc. | Sending sign-in emails | USA |
| Google, GitHub, Inc. | Sign-in (OAuth), only if you choose it | Ireland / USA |
| jsDelivr | Delivery of program libraries | see operator |
| ImprovMX | Email forwarding | see operator |
Where data is transferred to the USA or another country outside the EU, this is based on an adequacy decision of the EU Commission (for certified US companies, the EU-US Data Privacy Framework) or on standard contractual clauses of the EU Commission.
We store personal data for as long as it is required for the respective purpose, and beyond that where statutory retention periods (for example for bookings) require it. Where the code sets fixed periods:
Under the GDPR you have the right to:
To exercise them, contact support@voicehook.ai.
You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, the data protection authority of North Rhine-Westphalia), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.