Data processingagreement.

1. Roles

You (the customer) are the Data Controller. number7even UG (operating VoiceCosmos) is the Data Processor. We process personal data only on your documented instructions.

2. Categories of data processed

• Guest contact data (name, email, phone) — when captured by ARIA during a guest interaction
• Booking data (dates, room type, special requests, payment confirmation reference)
• Voice recordings + transcripts — for service delivery and quality auditing
• Voice biometric vectors — only with explicit Article 9 consent
• Operational metadata (timestamps, channel, language, sentiment)

3. Sub-processors

Current sub-processors:

• OpenAI (speech recognition and language processing — USA)
• Cartesia (voice generation — USA)
• VAPI (phone calls to ARIA — USA)
• Supabase (Frankfurt region — primary database hosting)
• Vercel (Frankfurt region — application hosting)
• Stripe Payments Europe (billing only, never voice or guest data)
• Resend (transactional email only)
• Twilio (SMS reminders only, opt-in)

Audio leaves the EU for speech recognition, language processing and voice generation. Transfers to the USA are covered by Standard Contractual Clauses and supplementary measures.

Sub-processor changes are notified 30 days in advance with right to object.

4. Security measures

See our Privacy & Security page for the operational summary. Detailed controls (encryption at rest + in transit, access logging, sub-processor isolation, incident response) provided in the full DPA PDF.

5. Data Subject Rights

Right to access, rectify, delete, and data portability — all programmatic via your tenant cockpit OR by emailing privacy@number7even.com. Response within 30 days, typically within 5 business days for standard requests.