scoco.ai
DE
Get access
Get accessCall the demo

Privacy Policy

This is a convenience translation. The German version is authoritative.

1. Controller

LuminaByte GmbH
Julius-Hatry-Straße 1, 68163 Mannheim, Germany
Email: datenschutz@scoco.ai

2. Hosting and server logs

This website runs on our own infrastructure at Hetzner Online GmbH (Falkenstein data center, Germany). When you visit the site, our web server automatically processes technical access data (IP address, date and time, requested page, browser type) as far as necessary to deliver and secure the service. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Our central log store deletes server logs after 7 days; the local copies on the server are limited in size and continuously overwritten.

If a technical error occurs while your browser displays a page, the page sends an error report to our server. It contains the type and text of the error (digit sequences, email addresses and long character strings made unrecognisable), the places in our program code where it occurred, the affected page without any appended parameters (parts of the address that look like identifiers, email addresses or numbers made unrecognisable), the browser with its major version and the operating system, the screen size class (phone, tablet, computer), the language the page was displayed in and whether your browser was showing the page translated. The report contains neither your IP address nor an identifier, nothing you typed and no page text; unlike other requests, we also log no IP address for its transmission. We use it solely to detect and fix errors and delete it after 7 days, like the server logs. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a website that works without errors).

3. No cookies; analytics

This website sets no cookies and stores nothing on your device. For anonymous reach measurement we use PostHog (PostHog EU, processed on servers within the EU) in cookieless mode: no cookies and no persistent identifiers are stored on your device, and measurement data (pages viewed, coarse technical properties) cannot be linked into a profile across visits. In the search on our help pages we also record how many results a search found and, for a search with no result, the search term itself – digits and e-mail addresses masked, cut to 60 characters – so we can add the guides that are missing. Please do not type personal data into the search. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our offering). A consent banner is therefore not required.

4. Demo phone numbers

This website lists demo phone numbers: +49 621 490799-22 for a neutral sample business, and on each industry page a number of its own from the same number block (+49 621 490799-…). Calls to these numbers are answered by our AI telephone assistant, which explicitly discloses this at the start of the call. To provide the service, the conversation is transcribed in real time and processed by AI systems. The audio connection is not recorded; we store a call transcript (deleted after 21 days at the latest) and a summary (deleted after 365 days at the latest). Legal bases are Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in demonstrating our service).

The following processors are involved in handling demo calls:

  • Hetzner Online GmbH, Germany (hosting)
  • Deepgram Inc., USA (speech recognition via EU endpoint; safeguarded by EU Standard Contractual Clauses)
  • Soniox Inc., USA (speech recognition for additional call languages and speech-recognition failover, speech synthesis; processing in the provider’s EU region, call audio and reply texts are processed transiently and not stored; safeguarded by EU Standard Contractual Clauses)
  • ElevenLabs Inc., USA (speech synthesis, also as fallback; EU-US Data Privacy Framework certified — we delete the assistant’s reply texts from the provider’s history after one hour at the latest, and use for improving the provider’s models is switched off)
  • Microsoft Ireland Operations Ltd. (Azure OpenAI, EU Data Zone; Azure Speech, Germany — conversation text is not stored there and not used for training; only content automatically flagged as potential abuse may be stored for a limited time for human review within the EU)
  • seven.io (seven communications GmbH & Co. KG), Germany (SMS delivery)
  • Microsoft Azure Communication Services, EU (email delivery)

Recipient: telecommunications provider (independent controller)
Telephony (line, numbers, call set-up) is provided by easybell GmbH, Berlin. easybell does not act as our processor but as an independent controller in its capacity as a provider of telecommunications services; the confidentiality of telecommunications and German telecommunications law (§ 3 TDDDG, § 166 TKG) apply to the traffic data processed in its network. easybell’s own privacy policy applies in that respect.

Website demo: your own AI assistant to try

If you enter the address of your own website on this site, we read up to eight publicly accessible pages of it (for example the home page, contact, legal notice, services) and build a demo assistant from them that presents your business on the phone. We store the address or company name you entered, the page of our website you came from, the referring page, campaign markers in the address (utm parameters), whether you use a phone or a computer, the content read from your website (services, opening hours, frequent questions, the business’s contact details) and the assistant built from it. We do not store your IP address for this; to limit abuse we only store irreversible keyed hashes of your address and its network range. We process conversations with your demo assistant as for the demo numbers above, but with shorter periods: call transcript at most 7 days, summary at most 30 days. Your demo page shows the summary of these conversations. The demo page can only be reached through its link — whoever knows the link sees the demo; share it only if you want to. We delete the demo and all data belonging to it automatically after 30 days. The legal bases are Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR (legitimate interest in demonstrating our service and in protection against abuse). Where the website read names people (such as contact persons), this information comes from a publicly accessible source (Art. 14 GDPR); the demo uses it only as far as a phone assistant needs it to answer. For websites of banks, insurers, authorities and major brands we build a neutral industry demo without a company name.

Call from the demo assistant. You talk to your demo assistant by having it call you. For this we process the mobile number you enter (mobile numbers in Germany, Austria and Switzerland only) and send a confirmation code to it by text message; seven.io (seven communications GmbH & Co. KG) sends it as our processor. Only once you have entered the code and confirmed your consent does the AI assistant call you, once, right away (a call that has not been placed within 10 minutes is dropped), and afterwards it sends you the summary of the call by text message (also through seven.io). We process the call as described above: no audio recording, call transcript at most 7 days. We call from one of our demo numbers. If you call that number from the confirmed mobile number while your demo exists, we connect you to your demo assistant by the transmitted caller number (Art. 6(1)(b) GDPR); every other caller reaches an announcement, through which anyone can also have their number put on our block list. The legal basis for the call is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, by saying “stop” during the call or by email to hallo@scoco.ai. We document your consent and every use of it in an evidence log: the times, the wording and version of the notices, the confirmed number, the reference of the code message, irreversible check values (keyed hashes) of your IP address and browser and, for each call, the calling and called number and the outcome. Section 7a of the German Act against Unfair Competition (UWG) obliges us to do so (Art. 6(1)(c) GDPR); we keep the log for five years after the consent and after its last use. If you say “No, that was not me” or “stop” during the call, we put the number on our block list for demo calls permanently, so that it is never called again (Art. 6(1)(f) GDPR; our legitimate interest is not to call anyone who does not want it).

5. Customer account and billing (app.scoco.ai)

If you use a customer account on app.scoco.ai, we process your account and sign-in data (name, email address, role within the company, password as a hash value only, two-factor authentication details) as well as security-relevant log data (sign-in times, IP address, failed sign-in attempts). The legal bases are Art. 6(1)(b) GDPR (performance of the usage contract) and Art. 6(1)(f) GDPR (legitimate interest in protecting accounts).

Signing in with Google or Microsoft

Instead of an email address and password, you can also sign in or register on app.scoco.ai with an existing Google or Microsoft account (“Sign in with Google”, “Sign in with Microsoft”). This is optional; signing in with an email address and password remains available to you at all times. The buttons are plain links: only when you click one are you redirected to the provider’s sign-in page. Before that, no data is exchanged with Google or Microsoft.

What we receive. We request only the basic sign-in details from the provider (the “openid”, “email” and “profile” permissions). After you have signed in with the provider and, where it asks, agreed to the transfer, it sends us your name, your email address, an indication of whether it has verified that address, and an identifier of your account with the provider; for Microsoft, also the identifier of the organisation the account belongs to. We do not store any further profile details the provider may include (such as the address of a profile picture). We receive neither your password nor access to your mailbox, contacts, calendar or files. Connecting a calendar (section 4) is separate and requires its own approval.

What we use it for. We use these details solely to sign you in, to create your account when you register, and to link the provider account to your scoco account — not for advertising, not for profiling and not to train AI models; we do not pass them on. We store the provider, the account identifier (for Microsoft, also the organisation identifier), the email address at the time of linking, and the times of linking and of the last sign-in. We do not store the provider’s access keys (tokens).

Protection against account takeover. We link a provider account to a scoco account only once it is established that the email address belongs to you. Where the provider cannot confirm this authoritatively — for example a personal Google account registered on a business email address — we send a one-time six-digit code to that address, valid for 15 minutes. When a provider account is linked to, or removed from, an existing scoco account, we inform you by email at your scoco account’s address. Two-factor authentication, where set up, also applies when you sign in through Google or Microsoft. For the duration of the sign-in process we set encrypted, strictly necessary cookies on app.scoco.ai that expire after 15 minutes at the latest (§ 25(2) no. 2 TDDDG).

Legal bases and retention. The legal basis is Art. 6(1)(b) GDPR where you yourself are our contractual partner or are opening a customer account; where you use an account as an employee of a customer, Art. 6(1)(f) GDPR (our customer’s legitimate interest and ours in offering simple sign-in). The checks protecting against account takeover rely on Art. 6(1)(f) GDPR (legitimate interest in protecting accounts). The link remains in place until you remove it under Settings → Security or your account is deleted; we then delete it.

Processing by the provider. Signing in on the provider’s page — entering your credentials, the provider’s own security checks and the data arising there, such as your IP address — takes place solely with the provider, which is itself responsible for it: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Where your account is managed by your organisation (Google Workspace, Microsoft Entra ID), your organisation is generally responsible for that account. The provider learns that you are signing in to scoco. It may also process data in the USA; Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework. The privacy notices of Google and Microsoft apply. You can also withdraw scoco’s access in the settings of your Google or Microsoft account.

For invoicing and payment processing we use Stripe Payments Europe Ltd., Ireland. Only billing data is passed on: company name, billing email address, address, VAT identification number and payment method. Call content, transcripts and summaries never reach the payment provider. The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (retention obligations under commercial and tax law). Where intra-group transfers to Stripe, Inc. (USA) take place, they rely on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses under Stripe’s data processing agreement.

For the data arising from calls to our customers’ own phone numbers, the respective customer is the controller; we process it on their behalf. Callers are informed by the separate privacy notice for callers.

Operating data and statistics

To provide, bill, secure and develop scoco, we process aggregated operating data per customer account and at least per calendar day as a controller in our own right: the number and duration of calls and conversations, their outcomes (such as message taken, appointment booked), response times, error rates and the providers, models, languages and features used. Call content and callers’ phone numbers are not part of it. We keep operating data for at most 24 months unless it has to be kept longer as billing records. The legal basis is Art. 6(1)(b) GDPR where we need the data for billing and Art. 6(1)(f) GDPR otherwise (legitimate interest in a secure, stable and improving service). We never use call content to train or fine-tune AI models, nor for our own purposes. Our team reviews a customer’s calls only on that customer’s behalf: to handle its requests and fault reports or, where it has instructed us to, in the quality programme of its data processing agreement, to find and fix faults and quality problems in its service. From the operating data of several customers we may compile anonymised statistics that allow no conclusion about any customer or person; such a statistic is published only if it is based on the data of at least ten customers.

Usage statistics in the customer account

To improve scoco, we count which pages and features of app.scoco.ai are used. This happens on our servers, not in your browser: when you use a feature while signed in, we record which one (the feature’s technical name, such as “change assistant”, without the ID of the record concerned), when, whether it succeeded, and with which role (Owner, Admin, Member, Viewer). Your user account and your company appear only under one random ID each, which is linked to your account in our database alone. We record no content – no calls, messages, names, phone numbers, inputs or search terms –, no IP address, and nothing stored in or read from your browser; we use no cookies or similar technologies for this. When a page uses the same feature repeatedly, we count it at most once a minute.

The events are analysed with PostHog (PostHog Inc., processing on servers in Frankfurt am Main) as our processor. PostHog keeps the events for up to seven years. When your user account is deleted or you are removed from the team, we delete or replace the random ID; the events left at PostHog can then no longer be linked to anyone once our encrypted backups have expired too (after six months at the latest). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our product based on how it is actually used).

You can object at any time (Art. 21 GDPR): under Settings → Account, with the switch “Contribute to usage statistics”. Switching it off applies at once and only to you; your team does not see this setting. On request, we also delete the events already recorded under your ID; write to datenschutz@scoco.ai.

Usage analysis in the browser (with your consent)

Only if you expressly consent in app.scoco.ai do we also record in your browser how you use the dashboard: clicks (without the text of the element clicked), mouse movements and scrolling for heatmaps, clicks without effect and repeated clicks, and recordings of your sessions that trace the layout of the screen, plus technical details such as browser, operating system, screen size and time zone. All content and input in them is hidden, images are left out; only the interface’s fixed labels (menu items, headings, buttons) stay readable, never names, numbers or text you entered. We never record pages with calls, messages, contacts, appointments, knowledge and reports, “Frag scoco” or searches; there we only record that the page was opened. Page addresses are recorded without the IDs of records and without search terms.

For this, the dashboard loads PostHog’s software and stores an identifier in your browser (in local storage). The data goes through our server, without your IP address, to PostHog (PostHog Inc., processing on servers in Frankfurt am Main) as our processor, and appears there under the same random ID as the usage statistics above. Recordings are deleted after 30 days, the other events kept for up to seven years; deleting and replacing the random ID works as described above. The legal basis is your consent (Section 25(1) TDDDG for access to your device, Art. 6(1)(a) GDPR for the processing).

Consent is voluntary: the dashboard works exactly the same without it, and your team does not learn what you decide. We ask once after you sign in. You can withdraw your consent at any time under Settings → Account with the switch “Consent to usage analysis in the browser”; the withdrawal applies at once, removes the identifier from your browser and does not affect the lawfulness of processing up to then (Art. 7(3) GDPR).

Error reports from the dashboard

If a technical error occurs in the dashboard, it sends an error report to our server with the information described for the website (section 2, error reports) and, if the error arose while our server was building the page, a reference number under which we find it in our server logs. Of the page’s address it contains only the names of the areas (such as “inbox”): identifiers of calls, contacts and other entries are replaced before the report leaves your browser. For an error of our interface it sends only its status and error code, never the message you see on the screen. The report is sent without your session cookie and without the address of the page you had open, and contains no identifier of your account. It does not depend on your consent to usage analysis, because its only purpose is to keep the dashboard you are using working (Section 25(2) No. 2 TDDDG). We delete it after 7 days, like the server logs. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a service that works without errors).

Logs

We log changes to the settings of a customer account and show them to the customer in the dashboard (“Protokoll”). We also show our team’s access to a customer account through the application, the admin console and the command line, per 15-minute window (which individual call was opened is not recorded). Emergency sessions directly on the database are logged and counted but cannot be attributed to a customer account and do not appear in the dashboard. We keep these logs for 24 months; the legal basis is Art. 6(1)(f) GDPR (accountability and security).

Retention after the contract ends

When the contract or a trial without a subsequent booking ends, the customer account remains readable for at least 30 days. As the contract terms that apply to the account provide, we delete it with all its content no earlier than 30 days after the end and announce the deletion by email at least 14 days in advance; until then it is kept. We keep invoices, payment records and the monthly usage totals after the deletion until eight years after the end of the year in which the invoice was issued, paid or written off (§ 147 AO, § 14b UStG; Art. 6(1)(c) GDPR), without access through the dashboard, and delete them afterwards.

Connecting WhatsApp (Meta)

When an owner connects a WhatsApp Business account in app.scoco.ai, the dashboard loads Meta’s JavaScript SDK (connect.facebook.net) as soon as the owner points at or focuses the connect button, and uses it to open Meta’s sign-up window. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, then receives your browser’s technical data (such as the IP address) and can read cookies on facebook.com; Meta is responsible for this processing itself, and Meta’s privacy policy applies. Without this step there is no exchange with Meta. The legal basis is Art. 6(1)(b) GDPR (the connection the customer asked for).

Connecting AI apps (Claude, ChatGPT and others)

When a person connects their access in app.scoco.ai to an AI app through our interface for AI apps (MCP), such as Claude (Anthropic) or ChatGPT (OpenAI), we send that app, at its request, the data from the customer account that the person allowed when connecting and that their role permits. The customer chooses the app’s provider; the provider processes the data under its own terms and is, to that extent, not our processor. For each connection we store which app is connected (with the details the app publishes about itself), who connected it, what it may do and when it was last used, and per day how often it called which tool — but not the content it retrieved. We keep these daily counts for 400 days; we delete a disconnected connection 90 days after it was disconnected. The legal basis is Art. 6(1)(b) GDPR (the connection the customer asked for), and for the daily counts Art. 6(1)(f) GDPR (traceability and security).

Emails to customers

We send messages about the contract and the service to the addresses stored in the customer account — such as invoices, payment reminders, security notices, call notifications and changes to the terms (Art. 6(1)(b) GDPR). We currently send no advertising by email. Should we inform customers about our own similar services in future (§ 7(3) UWG), every such email will tell you that you may object at any time without incurring costs other than the transmission costs at basic rates; an objection to datenschutz@scoco.ai is enough.

Services the customer connects itself (not processors)
Where a customer connects its own account with Microsoft (Microsoft Graph) or with Google LLC, USA, we access the contacts and calendar of that account with its permission (delegated OAuth access) — reads are free/busy times only, and booking an appointment writes an event. Microsoft and Google process this data under the contract between the customer and them; Google LLC is certified under the EU-US Data Privacy Framework.

Calendar and contacts from Google (Limited Use)

When a customer connects a Google account to an assistant in app.scoco.ai, scoco receives through the Google APIs: the free/busy times of the connected calendar and the appointments the assistant creates there, and — for the contacts connection — the names, email addresses, phone numbers and companies of the contacts, so that the assistant recognises callers. We use this data solely to provide these features to the customer. During a call, the assistant’s language model (section 4) processes it only to handle that call.

scoco’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data received from Google APIs is not used to develop, improve or train generalised AI or machine-learning models, is not used for advertising, is not sold, and is shared only with the service providers we use for these features. Our staff read it only with the customer’s consent, for the security of the service, or where the law requires it. The customer can disconnect at any time in app.scoco.ai or revoke access in their Google account.

Protection, retention and deletion. We also receive the email address of the connected Google account, so that the customer sees which account is connected. The data is stored on our servers at Hetzner in Germany and transmitted only over encrypted connections (TLS); the access token issued by Google is stored encrypted, never in readable form. Free/busy times are read when they are needed and not stored. When the customer disconnects, we delete the access token immediately and revoke it at Google. Contacts already taken over and the appointments the assistant booked stay in the customer account, without further syncing, until the customer deletes them or the customer account is deleted (see “Retention after the contract ends” above).

6. Contact by email

If you contact us by email, we process your details to handle the inquiry (Art. 6(1)(b) GDPR) or based on our legitimate interest in responding (Art. 6(1)(f) GDPR). The data is deleted once it is no longer required and no statutory retention obligations apply.

Requesting trial access

If you request trial access through the email field on our website, we store your email address, the page language and the page you sent the request from, and send our team a notification containing your address by email (delivery via Microsoft Azure Communication Services, EU). The purpose is to send you an invitation link; the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). We do not store an IP address with the request itself; for server log files see section 2. The request is deleted automatically after 90 days, or earlier on request; we delete the notification once we have replied to you.

7. Transfers to third countries

Where providers established outside the EU/EEA are used (see sections 4 and 5), transfers are based either on the adequacy decision for the EU-US Data Privacy Framework — where the provider is certified — or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Where a transfer relies on the Standard Contractual Clauses, we additionally carry out a documented transfer impact assessment and apply supplementary measures, in particular processing on EU endpoints and continuous transport encryption (TLS) on all connections to the processing services.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact datenschutz@scoco.ai.

You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Version and changes

Version: November 2026 (last changed on 4 November 2026: error reports from the website and the dashboard; on 2 November 2026: website demo, call-back from the demo assistant; on 30 October 2026: usage analysis in the browser, usage statistics in the customer account, connecting AI apps, protection and retention of Google calendar and contacts data; on 29 October 2026: operating data, logs, retention after the contract ends, emails to customers; Gladia removed as a provider). We update this privacy policy when processing or the legal situation changes; the version published here applies.