Privacy and security at a glance

The platform provides permissions, consent records, retention rules and protected access. Providers and data locations for your installation are agreed during setup and verified before production launch.

Where data is stored

  • Hosting and data location: German hosting is planned for production. Server, location, backups and monitoring are defined and accepted during setup.
  • AI provider and region: The provider layer supports Vertex AI with regional configuration. Actual processing requires a configured and verified provider.
  • Multilingual voice output: Cloud speech output uses a technical EU endpoint. This does not establish a data residency guarantee for the voice model used; possible third-country access is disclosed in the privacy documents. Browser speech recognition is also subject to the browser provider’s conditions.

What your visitors experience

  • Without external advertising tracking: The platform includes its own usage and source analytics. Additional services and consent requirements depend on the specific profile setup.
  • Media and connected services: Fonts are served locally. Vimeo videos only load after a click. External images, videos, links and optional bot protection can involve other providers. Privacy notices must match the actual setup.
  • Consent with proof: For every enquiry we store when consent was given and for what.
  • AI clearly labelled: Visitors can see that they are talking to an AI assistant. They confirm every action by Sintrii – such as an appointment, enquiry or order – themselves beforehand.

What you get as a customer

  • Data processing agreement: Read and sign it right in the dashboard.
  • Retention that is enforced: Old enquiries are deleted after the platform’s retention periods, which you can shorten for your account – checked daily.
  • Access and erasure: Find and delete enquiries and notes about a person by email address or phone number. You export your entire account as a file; as the account owner you can also delete it yourself.
  • EU AI Act: A notice for visitors and a log of AI use are prepared.
  • Records archive: Contracts and records are stored encrypted (AES-256-GCM) in your account – such as your accepted data processing agreement as a PDF.
  • Privacy policy in your profile: It automatically names the services you have connected – such as calendar, CRM or webhooks.

Security

  • Second factor: Sign-in with an authenticator app, recovery codes and device overview.
  • Encrypted keys: Credentials for your software are stored encrypted and never shown again.
  • Audit log: Temporary support access to the customer dashboard requires customer approval, is read-only, time-limited and logged. Regular operator administration is separate.