Privacy policy
Last updated 13 October 2026
Who we are
Vaki is a front desk assistant for small businesses. It answers questions from guests on an operator's website, WhatsApp, Telegram and email, on that operator's behalf, and it turns a voicemail into text for them. On a phone line the operator has switched it on for, it can also answer the call itself, by voice.
Vaki is operated by Helgi Þór Jóhannsson, kennitala 040292-3229, Hraunbær 35, 810 Hveragerði, Iceland. You can reach us at [email protected].
When you talk to Vaki, you are talking to a business's front desk. The operator decides what Vaki knows and what it is allowed to say. In data protection terms the operator is the controller and we are their processor: they decide why your information is used, and we only act on their instructions.
What we handle, and why
- What you write to Vaki. Your questions, in your own words. Vaki needs them to answer you.
- How to reach you on the channel you chose. On WhatsApp that is your phone number, on Telegram your chat identifier, on the website a random identifier for that browser session. This is how a reply gets back to the right person.
- Contact details you choose to give. If Vaki cannot answer something it offers to have a person follow up. On the website that means asking for an email address, once. You do not have to give it.
- Booking details, if you book. The date, the tour, how many people and what it costs. These go to the operator's booking system, which is where your booking actually lives.
- A name and an email address, if you book. Asked for at the point of booking, and only then, because the booking system will not take a booking without them and because the confirmation should reach you rather than the operator's inbox. They are passed straight to the booking system and are not kept here: the record we keep of a booking has the email address stripped out of it, the same as everything else we write down.
We never handle card details. Payment happens on the booking provider's own page or in person with the operator. No card number ever passes through our systems. That is a permanent design rule, not a temporary one.
Who else sees it
Anthropic. Vaki's answers are generated by Claude, a service run by Anthropic in the United States. Your message and the conversation so far are sent to Anthropic to produce each reply. This is the single most important thing on this page.
- Hetzner, who host the service. Conversations are stored on a server in Helsinki, Finland, inside the European Economic Area.
- Cloudflare, who serve our website, pass traffic through to the service, hold our encrypted backups, and handle mail sent to our support address.
- Your chosen messaging platform. If you write on WhatsApp, Meta carries the message; on Telegram, Telegram does. Their own privacy terms apply to that.
- Brevo, who send our email. That includes an alert to the operator when a guest needs a person, which can contain your question.
- Sentry, who receive a report when something breaks. Message contents and contact details are removed before it is sent.
- Paddle, who handle the operator's own subscription. Your information is not part of that.
- The operator's booking system, when you actually make a booking.
- The operator themselves. When Vaki passes a question to a person, that person sees the question and the conversation, because they cannot answer it otherwise.
If you telephone
There are two ways Vaki can be on an operator's phone line, and the operator chooses.
If Vaki answers the call
You are talking to an automatic answering service, not a person. It says so when it picks up, and it says the call is recorded.
- Zadarma carry the call, and they record it.
- ElevenLabs, in the United States, run the voice: they hear what you say, turn it into text, and speak the answer. They keep the audio and the text of the call. No deletion date is set for them at present.
- Anthropic receive the text of what you said, to write each answer, the same as for a written message.
If you leave a voicemail
A call the operator's line does not take can be forwarded to a voicemail that Vaki turns into text, and the answer goes to the operator rather than back to you. Nothing is sent to your number.
- Zadarma carry the call and hold the recording. Vaki fetches it, turns it into text, and then asks them to delete it, which is normally within a minute.
- ElevenLabs, in the United States, turn the recording into text. They receive the audio of your voice, and on our current plan they retain it.
- Vaki's own copy of the recording is overwritten as soon as it has been read, and nothing here can store a path to it.
If you fill in the form on this website
The form at vaki.chat/start is how a company signs up. It asks for your name, your email address, the company's name and website, which of the four prices you picked, how the company takes bookings today, and, if you want, a message. We use it to set Vaki up for you and to send you the invoice or take your card payment. For this information we are the controller, not an operator, and the basis is taking steps at your request before a contract, Article 6(1)(b).
- It is saved in a file on our server in Helsinki, Finland. The form does not use a model: nothing you type there is sent to Anthropic.
- We hear about it by email at our support address, with your details in it, and in a private chat channel on Discord, which gets your name and company but not your email address.
- If you pay by card, Paddle takes the payment and your card details go to Paddle, never to us. We send you one automatic email, a link to sign in to your panel. Everything else we write to you ourselves.
- We keep it while Vaki is being set up for you and, if you become a customer, for as long as you are one. If you do not, write to [email protected] and we will delete it. It is in the encrypted backups too, and gone from those within seven days of deleting it.
We do not sell your information, and we do not use it for advertising.
Why we are allowed to handle it
The law requires us to tell you which lawful basis applies, and the operator you are writing to is the one who chooses it, because they are the controller. In practice it is one of two, both under Article 6 of the GDPR:
- To take steps before a contract, or to carry one out. Article 6(1)(b). This covers answering what you asked about a tour or a room, and it covers making a booking you confirmed.
- Legitimate interests. Article 6(1)(f). Answering a general question outside any booking, and keeping the service working and secure. The interest is running a front desk that replies; we weigh it against your privacy by keeping as little as possible and deleting it after 30 days.
We never rely on consent for answering you, so there is no consent for you to withdraw here. If you object to processing based on legitimate interests you can say so, to the operator or to us, and we will stop.
For the operator's own account with us, their name, email and billing details, we are the controller and the basis is the contract between us.
How long we keep it
Conversations are deleted after 30 days. This is automatic. The service checks every hour and deletes anything past that age. Deleted means removed from the database, not marked as hidden.
Records of actions taken on your behalf, such as a booking being made, are kept longer, because an operator has to be able to answer "why is there a booking in my system for four people on Tuesday". Those records have phone numbers and email addresses stripped out of them before they are written.
What we do to keep it safe
Personal details are kept out of our logs. Phone numbers and email addresses are removed from anything written to a log file or an activity record. On WhatsApp your phone number is also the conversation identifier, so that is stripped too.
The limit of that: it catches identifiers that are mechanical to spot. If you write your home address or your name in an ordinary sentence, no filter can reliably find it.
Backups are encrypted before they leave the server, with a key the storage provider does not hold, and are kept in the EU for seven days. The server disk itself is not encrypted. The host is ISO 27001 certified. Stored conversations and backups stay in the EEA. What is sent to Anthropic, and call audio sent to ElevenLabs, is handled in the United States; Anthropic's data processing terms use the EU Standard Contractual Clauses for that.
Your rights
Under the GDPR you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Deletion is built in and takes effect at once on the live service: the conversation is removed rather than flagged. Encrypted backups are expired by an automatic rule, so everything of yours is gone from those within seven days as well.
The quickest route is the operator you were talking to, because they hold the relationship. You can also write to us at [email protected] and we will act on it. If you are not satisfied you can complain to Persónuvernd, the Icelandic Data Protection Authority.
Automated decisions
Vaki answers questions. It does not make decisions about you. It cannot refuse you a booking on its own judgement: availability and price come from the operator's booking system, and a booking is only made after you have confirmed the exact details.
Vaki will not tell you whether weather or road conditions are safe, and that is deliberate. Those questions go to a person and to the official sources.
Changes
If this changes we will update this page and the date at the top.