Privacy policy

The controller of personal data is Filip Bojda, sole trader operating as Web’Inspir (entrepreneur individuel), 11 rue du Bel Air, 93600 Aulnay-sous-Bois, France, SIREN 101 943 637. Contact for data matters: the contact form on the website or kontakt@osimi.pl (also shown in the footer).

Your data (the business owner’s and your team’s) is processed by us as controller, in order to provide the Service.

Your customers’ data that you type or dictate into the Service (customer name, address, contact details, tax ID, place of work on a quote) is processed by us as a processor, only on your instructions and on your behalf. You are the controller of that data; the terms are set out in the data processing agreement (in Polish).

• Business account data: business name, sector, owner’s name, phone, e-mail, tax ID (optional), to open and run the account and to invoice you (legal basis: contract, Art. 6(1)(b) GDPR).
• Conversations with the agent: text messages, voice notes and their transcripts, photos and documents you send, so the agent can do its work (prepare a quote, issue an invoice, file a document) and so your conversation history stays available to you (basis: contract). What is sent to AI providers is described in section 4.
• Site visits (in Mariusz’s package): photos, the voice recording of the visit and its transcript, plus the visit’s title, customer and place, to prepare a list of findings for you to approve (basis: contract).
• Generated documents (e.g. quote PDFs), kept in your archive, available only after logging in with the owner code.
• Contact form data (business name, e-mail, phone, message), to answer your request (basis: legitimate interest, Art. 6(1)(f) GDPR).
• Technical data: server logs and usage counters (number of messages, AI model usage): security, anti-abuse limits and billing (basis: legitimate interest).
• Phone agent (if you turn it on): the caller’s number, call time and a short summary written by the agent, to pass the matter or booking on to you. Calls are not recorded; speech is processed in real time. We delete the caller’s number after 12 months.
• Chat for your customers (link or QR code): your customers’ messages and a technical session identifier.
• The Osimi app on your phone stores locally the session data (access code), messages waiting to be sent without a network (including a voice note until it is sent) and your decision about the AI assistant. We do not collect advertising identifiers and use no analytics tools in the app.
• Consent to the AI assistant: the date, the version of the text shown and your decision (consent, “Not now”, withdrawal), so that we can demonstrate your consent (Art. 7(1) GDPR).

We do not profile users and take no automated decisions producing legal effects. Website traffic is measured anonymously, without identifying you: Cloudflare Web Analytics (no cookies, no browser fingerprinting) and our own anonymous page events (page view, button click) with language, country code (never the IP address), referring domain and campaign parameters (utm). To count visitors we add a short technical hash, computed on our server from the IP address, browser information and a random string changed every day; neither the IP address, the browser information nor the day’s random string is stored, so the hash cannot be recreated or linked to another day. Nothing is stored on your device for this measurement. Only if you choose “Accept” do we store the osimi_gocookie in your browser (random identifier, 180 days); “Only necessary” removes it. Advertising tools (Meta pixel and Google Ads tag, which only measure whether an ad led to a sign-up or purchase) run only after your consent in the banner; you can change your choice at any time through the “Cookie settings” link in the footer. If you arrive through a link with campaign parameters (utm) and choose “Accept”, we keep them in your browser for as long as the tab is open, to know where a sign-up came from; they disappear when the tab is closed. The business panel stores in your browser only the session data needed to log in.

The agent (assistant) in the app, in the business panel and in phone calls uses AI models from external providers. Before you first use the assistant in the app, we ask for your consent; you can withdraw it at any time in the app, in the Company tab. Without consent, the app sends no messages, recordings or photos to AI.

• Anthropic (Claude model) writes the other assistants’ replies and summarises site visits. It receives: the text of your message (or the transcript of a voice note) together with the latest messages of the conversation; your business data needed for the reply (name, tax ID, address, phone, e-mail, opening hours, price list or service catalogue, the business description you wrote); your customers’ data that you give for quotes, invoices and bookings (name, contact details, address, document lines); photos sent in the conversation (the model reads their content); for a site visit, the photos and the transcript of the recording.
• OpenAI (GPT model) writes Mariusz’s replies and turns speech into text. It receives: in the conversation with Mariusz, the same data that Anthropic receives from the other assistants (the message with the latest messages of the conversation, business data, customer data, photos sent); the audio of voice notes and site-visit recordings; for the phone agent, the caller’s speech, processed in real time.
• OVHcloud (OVH SAS, France) turns your voice messages and site visit recordings into text. It receives the audio of the recording and a list of names from your business (menu items, services and materials from your price list), so that these words are written correctly. It does not receive your customers’ data stored with us. If the OVHcloud service is unavailable, OpenAI turns the recording into text.
• Phone agent: replies during the call are written by the Anthropic model; the agent’s voice is synthesised by Telnyx (default voice) or Microsoft Azure, from the text spoken by the agent only.

We share this data only so that the agent can reply and prepare your documents. Under these providers’ API terms, data sent through the API is not used to train their models. We do not share with them your access code, push notification tokens, device identifiers, location, phone contacts or payment data. Anthropic and OpenAI also process data outside the EEA (USA), as described in section 5. OVHcloud processes recordings in France.

When we ask for consent. The consent screen appears in the app after the owner signs in, before anything is sent to AI. It lists the data sent, the recipients and the country where the data is processed, and has two buttons: “I agree” and “I don’t agree”. Without consent, the app and our server block messages to the assistant, voice recordings, photo reading, site visits and turning on call answering. Documents and settings keep working. Each decision is recorded with its date and the text version.

Protection equivalent to the GDPR. Each AI provider processes data only on our instructions, under a data processing agreement (DPA):

• Anthropic PBC (USA): DPA incorporated into its commercial terms, with the European Commission’s Standard Contractual Clauses (DPA, commercial terms). Anthropic does not train models on API data and deletes API inputs and outputs within 30 days (source).
• OpenAI (USA): DPA with Standard Contractual Clauses (DPA). OpenAI does not train models on API data; abuse monitoring logs are kept for up to 30 days, and audio sent for transcription is not kept in those logs (source).
• Telnyx LLC (USA): DPA with Standard Contractual Clauses (DPA); Telnyx also participates in the EU‑U.S. Data Privacy Framework (list).
• OVH SAS (France), 2 rue Kellermann, 59100 Roubaix: OVHcloud data processing agreement (DPA). Servers in France (Gravelines), the data stays in the EU. According to OVH, the content of recordings is not kept after transcription and is not used to train models.

Sources checked on 5 October 2026, OVHcloud on 22 October 2026.

The Service relies on the following technology providers:

• Supabase: database and file storage; data hosted in the European Union (Frankfurt, Germany).
• Anthropic: AI model (Claude) that processes conversation content, the business and customer data needed for the reply, and photos you send, to write the agent’s reply (details in section 4). Under Anthropic’s API terms, data sent through the API is not used to train models.
• OpenAI: AI model (GPT) that writes Mariusz’s replies, and speech to text. The content of the replies is not stored by OpenAI; data may be kept for up to 30 days solely to detect abuse. Under OpenAI’s API terms, data sent through the API is not used to train models.
• OVHcloud: OVH SAS (France): turning voice messages and site visit recordings into text (AI Endpoints); data in the EU, on servers in France.
• Amazon Web Services: Amazon SES (Frankfurt region, EU), sending e-mails (e.g. the owner code after sign-up, quotes and invoices sent to customers).
• Resend: backup e-mail sending when the main provider is unavailable.
• Expo: delivery of push notifications to the app. Only the technical device identifier (push token) and the notification text are processed; Expo passes them to Apple’s (APNs) and Google’s (Firebase Cloud Messaging) notification services, which deliver them to the phone.
• Microsoft Azure: voice synthesis for the phone agent when an Azure voice is selected (turning the reply text into speech). Only the agent’s spoken text is processed.
• Telnyx: telecom operator for the phone agent: receives calls forwarded from your number and carries the call audio; also synthesises the agent’s default voice. Processes the caller’s number, your number and the agent’s spoken text.
• DIDWW: DIDWW Ireland Ltd (Ireland): phone numbers and call routing for the phone agent. Processes the caller’s number, your number and the call audio during the call; data in the EU.
• Hetzner: Hetzner Online GmbH (Germany): the server that runs the phone agent: processes the call audio in real time, without recording; data in the EU.
• Stripe: subscription payments. You enter your card details only with Stripe; Osimi never sees or stores them.
• Cloudflare: website hosting, attack protection and traffic measurement (Web Analytics, no cookies); processes technical connection logs (IP address) for a short time for security.
• Google Workspace: the kontakt@osimi.pl mailbox, which receives your messages and form requests.

Outside the European Economic Area (in the USA), data is or may be processed by: Anthropic and OpenAI (AI models), Telnyx (calls and the phone agent’s voice), Stripe (payments), Resend (backup e-mail sending), Cloudflare (website hosting), Expo (and, when delivering notifications, Apple and Google) and Google Workspace (the kontakt@osimi.pl mailbox). Supabase, Microsoft Azure and Amazon Web Services have US parent companies, so access from the USA cannot be ruled out even though we use their services in the EU. DIDWW, Hetzner and OVHcloud process data only in the EU. Transfers outside the EEA rely on the standard contractual clauses (SCC) approved by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework. We do not sell or share data with anyone other than the entities listed above.

KSeF (invoicing module, Poland). If you use the “Invoices in KSeF” module, the data of invoices you approve (seller, buyer, lines, amounts) is sent, on your instruction, to the National e-Invoicing System run by the Polish Ministry of Finance. Your KSeF token is stored only in encrypted form and you can disconnect it at any time.

Account data and conversation history: for the duration of the contract. After the account is closed, personal data is deleted or anonymised automatically within 90 days. You can close your account yourself at osimi.pl/usun-konto (with the owner code) or by writing to us from the account’s e-mail address. Exception: accounting documents (quotes, invoices) are kept for the period required by tax law, without the customer’s contact details.

• Contact form requests: 12 months.
• Caller’s number in the phone call history: 12 months.
• Site-visit photos and recordings: 30 days after the visit is approved (or after it is created, if it was never approved); the approved list of findings stays in your archive. Deleting a visit immediately deletes its photos and recordings too.
• Push notification tokens unused for 6 months: deleted.
• Technical message delivery logs: 30 days.
• Anonymous website events: 12 months.

You have the right to:

• access your data and obtain a copy,
• rectification,
• erasure (“right to be forgotten”),
• restriction of processing and objection,
• data portability,
• withdraw your consent at any time (for the AI assistant: in the app, Company tab).

To exercise these rights, write to us (contact details in section 1). You may also lodge a complaint with a supervisory authority: the French CNIL (competent for the Service provider) or the Polish President of the Personal Data Protection Office (UODO).

Access to business data is protected by unique access codes: one for the owner, one for the team. The team code gives narrower access: an employee always sees bookings or quotes, and the owner decides in the business settings whether they also see customer data, address, phone, amounts and photos. Invoices, PDF documents and payments stay with the owner only. Data in transit is encrypted (TLS), documents are kept in private file storage accessed through short-lived signed links, and service access to the database is limited to the strict minimum.

We will inform you of material changes in the app or by e-mail. The current version is always available at this address.