Effective date: 9 June 2026

In accordance with Article 13 et seq. of the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), we provide you, as a user of Ghosty, the AI phone assistant (hereinafter "User"), with this Information on Personal Data Processing — setting out the conditions under which your personal data is processed.

Ghosty, the AI phone assistant, is a software application using elements of artificial intelligence, provided by SLAI labs s.r.o., which answers calls on your behalf. Ghosty conducts conversations with the Caller on your telephone number, creates a recording of the call, and generates a transcript or summary (hereinafter "Ghosty"). This enables the User to handle requests as quickly and efficiently as possible.

If you are a Caller (an individual who called a Ghosty application User), this Information does not apply to you. For information on how we process your data, please read the Information on Personal Data Processing for Callers.

1. Who is the Controller of Your Data

The controller of your data is the owner of the telephone number on which you use Ghosty as a User.

2. Who is the Processor of Your Data

Ghosty is provided by SLAI labs s.r.o., with registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, Company ID: 24010065, email: [email protected], which acts as the Processor of your data.

3. To Whom Data May Be Transferred

We share data with the following entities, some of which are based outside the EU:

  1. ElevenLabs Inc. (real-time speech-to-text conversion, transcription, audio processing, USA): processes ephemeral audio data streams and ephemeral call transcripts for real-time speech-to-text conversion. Transfers are governed by SCCs, with TIAs and additional safeguards.
  2. Twilio Ireland Ltd. and Telnyx Ireland Ltd. (telecommunications infrastructure, WebSocket communication): processes caller numbers, call routing data, and audio streams, which are passed to ElevenLabs. Covered by the EU–US Data Privacy Framework (DPF).
  3. Google Ireland Ltd. (cloud provider: infrastructure, databases, servers, hosting, crash reporting, AI services; EU): may process device identifiers, IP addresses, account data, call metadata, audio, and transcripts within the scope of hosting; processes ephemeral call transcripts and metadata solely for the purpose of generating real-time call summaries. Covered by the EU–US DPF.
  4. Mixpanel, Inc. (analytics, possible EU residency): receives pseudonymous user identifiers and usage events. Processing in the EU when configured; transfers outside the EU based on SCCs.
  5. Plus Five Five, Inc. (email delivery via Resend, USA): used for sending transactional emails. Transfers outside the EEA/UK rely on Standard Contractual Clauses (via their DPA).
  6. ProfiSMS s.r.o. (SMS delivery, Czech Republic): used for sending transactional SMS messages. Processing takes place within the European Union.
  7. Functional Software, Inc. (diagnostics, possible EU residency): receives pseudonymous identifiers and application error logs. Processing in the EU when configured; transfers outside the EU based on SCCs.