Privacy Policy
Last updated 7 September 2026. See also the Terms of Service.
Frontbook is an AI phone receptionist for businesses. This policy explains what personal data we process, why, and what rights you have. It covers our website, the Frontbook application and the phone calls our receptionist answers on behalf of our customers.
1. Who is responsible
The controller for the website and for customer accounts is Amie GmbH, Immanuelkirchstr. 26, 10405 Berlin, Germany. VAT ID: DE329214523.
For privacy questions or requests, email support@frontbook.ai. We have not appointed a data protection officer because the law does not require one for a company of our size and activity.
2. Three groups of people
We process data about three groups, and our role differs for each:
- Website visitors: people who browse frontbook.ai. We are the controller.
- Customers and their team: people who create a Frontbook account for their business and the colleagues they invite. We are the controller for account, billing and usage data.
- Callers: people who phone a number our receptionist answers. The business that owns the number decides why the call is handled and what is collected. That business is the controller, and we process caller data on its behalf as a processor under Article 28 GDPR. If you called a business that uses Frontbook and want to exercise your rights, contact that business. We help it respond.
3. Data we process about website visitors
When you visit frontbook.ai, our servers receive your IP address, browser type, the pages you request and the referring page. We keep server logs for up to 30 days to run and secure the site. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
We use DataFast for visit statistics. DataFast does not set cookies. It counts visits, pages, referrers and the country derived from the IP address, and it links a visit to an account only after you sign up so we can see which pages lead to customers. Legal basis: legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR).
We use the Meta Pixel and the Meta Conversions API (Meta Platforms Ireland Limited, Dublin, Ireland) to measure whether our advertising on Facebook and Instagram leads to sign-ups and subscriptions. The pixel sets the cookies _fbp and _fbc, stores the ad click ID from the URL in your browser, and sends page views and conversion events to Meta together with your IP address and browser information. When you sign up or subscribe we also send the event from our server with a hashed version of your email address so Meta can match it to an ad click. Meta may combine this data with your Meta account. Legal basis: our legitimate interest in measuring advertising (Article 6(1)(f) GDPR); where your local law requires consent for this, we rely on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by blocking the cookies in your browser. You can also limit ad measurement in your Meta ad settings at facebook.com/ads/preferences. Meta is certified under the EU-US Data Privacy Framework.
We use self-hosted session replay on public pages and sign-in to diagnose navigation and registration problems. It records page changes, clicks, scrolling and sanitized signup outcomes. Form inputs are masked before upload; the customer dashboard and call transcripts are excluded. Recordings are accessible only to authorized operators and may be inspected with AI tools. They are deleted after seven days, with cleanup running hourly. A first-party frontbook_replay cookie and per-tab session storage connect activity for up to 30 minutes. To recognise repeat visits within those seven days we store a keyed hash of your IP address and browser identification with each recording; the address itself is not stored. Recording is disabled when your browser sends Do Not Track or Global Privacy Control.
The pricing page shows prices in the currency of your country. We derive the country from your IP address on our server and do not store it.
4. Data we process about customers
Account: your email address, name, password (stored as a hash) and, if you sign in with Google, the Google account ID, name and email address that Google shares with us. We send a verification code by email when you create an account. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Business profile: your business name, locations, opening hours, services, prices, FAQs, transfer numbers and other knowledge you enter so the receptionist can answer callers. If you give us your website address, we fetch its public pages and use an AI model to extract this information for you to review. Legal basis: performance of the contract.
Team: names, email addresses and roles of the colleagues you invite, and which calls each person handled. Legal basis: performance of the contract.
Billing: your billing address, business name, tax ID and the subscription and invoice history. Card details are entered on Stripe and never reach our servers; we only store a reference to your Stripe customer. Legal basis: performance of the contract and our legal obligation to keep accounting records (Article 6(1)(c) GDPR).
Usage: which features you use, when you sign in, and technical logs needed to diagnose problems. Legal basis: legitimate interest in running a reliable service.
Email: we send transactional emails such as verification codes, callback notifications, trial and billing notices and the weekly call report. You cannot opt out of emails that are necessary to run your account. Legal basis: performance of the contract.
5. Data we process about callers
When someone calls a number our receptionist answers, we process the caller's phone number, the time and duration of the call, the audio of the conversation, a written transcript, a summary, and the details the caller gives during the call: typically a name, a callback number or email address, the reason for calling, appointment requests and any information the caller volunteers. If the caller is transferred, the destination number and outcome are recorded too.
Our customers use this data to call people back, book appointments and keep a history of who contacted them. We process it only on their instructions and under our data processing terms. We do not use call content to train AI models, and we do not sell it.
Calls are answered by an AI system. It converts speech to text, generates replies with a large language model and converts the reply back to speech. The providers involved are listed in section 7. Where a caller asks, the receptionist confirms that it is an AI assistant.
Recording: whether a call is recorded, and whether the caller must be told, depends on the law where the business and the caller are located. Our customers are responsible for giving callers the notices that apply to them.
Retention: recordings, transcripts and summaries stay available to the business until it deletes them or closes its account. See section 8.
6. Where the data is stored
The Frontbook application and its database run on DigitalOcean servers in New York, United States. Backups are stored in the same region. Data therefore leaves the European Union. DigitalOcean is certified under the EU-US Data Privacy Framework, and we have the EU standard contractual clauses in place with it and with the other US providers below. You can ask us at support@frontbook.ai for a copy of the clauses.
7. Providers who process data for us
We use the following companies as processors. Each receives only the data needed for its task and is bound by a data processing agreement.
- Telnyx LLC (Chicago, US): phone numbers and carrying calls to and from the public phone network.
- LiveKit, Inc. (San Jose, US): real-time audio between the phone network and our receptionist.
- Cartesia AI, Inc. (San Francisco, US): speech recognition and speech synthesis for calls.
- Inworld AI, Inc. (Mountain View, US): additional speech synthesis voices.
- Groq, Inc. (Mountain View, US): running the language model that generates the receptionist's replies during calls.
- OpenRouter, Inc. (US) and Google LLC (Gemini models): extracting business information from your website during setup.
- Jina AI GmbH (Berlin, Germany): fetching the public pages of your website during setup.
- Stripe Payments Europe, Ltd. (Dublin, Ireland) and Stripe, Inc. (US): payments, invoices and the customer portal. Stripe is an independent controller for the card data it collects; see stripe.com/privacy.
- Google Ireland Limited (Dublin, Ireland): Sign in with Google, if you choose it.
- DataFast (datafa.st): cookieless website statistics.
- Meta Platforms Ireland Limited (Dublin, Ireland): advertising measurement as described in section 3.
- DigitalOcean, LLC (New York, US): hosting and backups.
- Cloudflare, Inc. (San Francisco, US): DNS for frontbook.ai.
- Our email delivery provider: sending transactional emails.
We may replace a provider with one that offers an equivalent level of protection. Customers with a data processing agreement are informed in advance and can object.
8. How long we keep data
- Call recordings, transcripts, summaries and caller details: until the business deletes them or closes its account.
- Account and business profile data: for as long as the account exists. When an account is closed we delete its data within 90 days, except data we must keep by law.
- Invoices and billing records: 10 years, as required by German tax and commercial law.
- Phone numbers: released back to the carrier seven days after a subscription ends unless it is resumed.
- Server logs: up to 30 days.
- Meta Pixel cookies: _fbp for 90 days, _fbc for 90 days after an ad click.
9. Your rights
Under the GDPR you can ask us for access to your personal data, correction, deletion, restriction of processing, and a copy of the data you gave us in a portable format. You can object to processing based on legitimate interests, and you can withdraw consent at any time without affecting processing that happened before.
To exercise these rights, email support@frontbook.ai. We answer within one month. If you called a business that uses Frontbook, direct your request to that business; if you send it to us we forward it.
You can also complain to a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de.
10. Security
All connections to frontbook.ai and between our services use TLS. Passwords are stored as salted hashes. Access to production systems is limited to the people who operate the service and protected by SSH keys. Team members only see the calls and locations their role allows. We review our providers' security certifications before using them.
12. Children
Frontbook is a service for businesses. We do not knowingly collect data from anyone under 18 through the website or the application. Callers of any age may reach a business's receptionist; that data is handled on the business's instructions.
13. Changes
We update this policy when our processing changes. The date at the top shows the current version. For material changes we notify customers by email or in the application before they take effect.