This article gives a practical overview of Loomira's data-protection mechanisms. You'll find the full legal basis in our privacy policy and on the GDPR overview page; this article focuses on what that means in everyday use.

The roles under data-protection law are clearly divided: for your callers' data, you are the controller under the GDPR; Loomira processes that data solely on your behalf as a processor under Art. 28 GDPR — on the basis of the data processing agreement (DPA) that you enter into during sign-up.

Is the Call Recorded as Audio?

By default, no: voice processing happens transiently in real time, and call audio isn't stored. The record of the call is the transcript in text form (see Transcripts & Messages). Callers' phone numbers also aren't shown in plain text in lists — they're stored only as a salted hash and shown masked in the call log.

Each assistant also has an optional recording feature, which is off by default. If you turn it on, you must inform callers about it — an automatic announcement can be enabled — and, as the controller, you're responsible for ensuring the recording is lawful under data-protection law.

How Long Is Call Data Retained?

Call data — transcripts and their related message deliveries — is retained for 30 days by default and then automatically anonymized or deleted. These 30 days are the platform default; on request, we can set a different retention period for your workspace if your business needs a longer or shorter period for operational or legal reasons. Reach out via Support for that.

Deletion and Access Requests (Data Subject Rights)

At a caller's request, you, as the workspace owner, can have their data removed completely from your workspace — call sessions, related transcripts, and message deliveries. This deletion is logged (with a timestamp and scope, never with the phone number itself), so you can prove, if needed, that a deletion request was fulfilled.

You can likewise export the entire dataset stored in your workspace — for example, to provide a data subject with a full disclosure, or for your own records.

Deletion and export are features of our interface (API) and reserved exclusively for workspace owners; a dedicated interface for this in the portal is coming. Until then, we handle it on request via Support.

How Do I Inform My Callers?

As the controller, you carry the information duties toward callers under Art. 13 GDPR. So you don't have to start from scratch, we provide a ready-to-fill template: the caller privacy notice. It describes the actual processing (AI assistant, transcript instead of audio recording, 30-day anonymization) and only needs your company details added.

Separately, the assistant identifies itself as an AI at the start of the conversation by default — the disclosure obligation under Article 50 of the EU AI Act and how to configure it are described in Configure Your Assistant; our AI transparency page also gives an overview.

Consent to our contract documents — in particular the Terms and the data processing agreement (DPA) — is recorded in a consent log, along with the timestamp, document version, and the person who consented. This keeps it traceable at any time which version of a document you agreed to and when.

EU Hosting

Loomira is developed and operated in the EU. Voice processing, the database, and the AI providers we use all run through EU regions or EU endpoints. Details on the service providers we use are in our sub-processor overview.

Data Processing Agreement (DPA)

Because Loomira processes callers' personal data on your behalf, you, as the controller, need a data processing agreement with us. You enter into this during sign-up; you can find the full contract text at any time under DPA.

Note for Healthcare Providers and Health Data

If your calls involve health data — typical for medical or therapy practices — special requirements apply: health data is a special category of personal data under Art. 9 GDPR and generally requires its own legal basis, such as explicit consent. Clarify the deployment with your data protection officer beforehand, extend your caller privacy notice accordingly, and, as a holder of professional secrecy, also observe the duty of confidentiality under § 203 of the German Criminal Code. When in doubt, configure conservatively and get legal advice.