Where your data actually lives.
Your customers’ conversations are business-critical data. This page is the plain map: what runs where, who touches it, and which controls you hold. Nothing here goes beyond what our legal pages already state — this page just links them together.
One path, all of it in the EU.
- Replies stream back over the same EU path.
- Voice is synthesized EU-side.
- Data at rest stays in the EU (Hetzner, Germany).
GDPR stance
You are the data controller; OpenAlice is your processor. The data processing agreement is a standing document, not a sales call: read or download the DPA. The widget shows visitors an AI disclosure and asks for consent before any voice capture. Visitors can be exported or erased on request; the privacy policy has the full rights catalogue.
EU AI Act position
Our products are conversational AI assistants: limited-risk systems under the EU AI Act. The Act’s transparency duties for this class are met in the product itself: the agent is disclosed as an AI (never presented as a human), the AI disclosure is one click away, and voice interaction is consent-gated. We monitor the Act’s implementation timeline and keep this position under review.
Everyone who touches your data.
| Provider | Role | Region | Status |
|---|---|---|---|
| Hetzner Online | Server hosting · data at rest | Germany (EU) | active |
| Mistral AI | LLM inference · voice synthesis | France (EU) | active |
| Mollie | Billing | Netherlands (EU) | contracted |
| Brevo | Transactional email | France (EU) | pending activation |
That is the whole list. Optional per-tenant providers a customer switches on themselves (see voice, below) are listed in the DPA when enabled.
Voice
Voice is EU by default: text-to-speech runs on Mistral-native EU voices. US voice providers are strictly per-tenant opt-in. They stay off unless you explicitly enable them for your own widget, behind a consent gate.
Retention controls
Conversation retention is yours to set, per widget:
- Off: nothing is kept after the conversation ends.
- Session: kept only while the visitor’s session lives.
- Persistent: kept with a retention window you choose.
Questions a reviewer needs answered? security@openalicelabs.eu