Hallo Marco Hallo Marco

Privacy policy

This policy applies to the websites hallomarco.com and hallomarco.de and to the Hallo Marco service at app.hallomarco.com. It describes which personal data we process, for what purpose, on which legal basis and for how long. Version 1.2, as of 27 October 2026.

This English text is a translation for convenience. Only the German version at hallomarco.de/datenschutz is legally binding.

1. Controller

Bavarian Valley UG (haftungsbeschränkt)
Passauer Str. 21
81369 Munich
Germany
Managing director: Christian Moser
Email: contact@hallomarco.com

2. Data protection officer

No data protection officer has been appointed. Please send questions about data protection to contact@hallomarco.com.

3. Summary

  • We act in two roles. For our websites, enquiries, the demo number and customer accounts we are the controller. Calls and messages that Marco handles for a business we process on behalf of that business (section 11).
  • Hosting, data storage and knowledge search are in Germany. The AI language model runs at a provider that also processes outside the EU, including the USA. Telephony runs via a provider with an EU region; speech recognition and speech output may partly take place outside the EU, including the USA.
  • Calls are only recorded if the business has switched recording on, and only after a notice to the caller.
  • Each business sets how long calls are kept: 30, 90 or 365 days, with 90 days as the default.
  • We only use Google Analytics on the website if you consent.

4. Providing the website and server logs

The websites are hosted in data centres in Germany. With every request the server processes technically necessary data: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identifier. We use this data to deliver the website, find errors and fend off attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation. We delete the server logs after 14 days. Logs we need to investigate a specific attack are kept until the investigation is complete. A data processing agreement is in place with the hosting provider.

5. Cookies, local storage and consent

On the contact page we set two technically necessary cookies (session and protection against forged form requests). They contain no information about you and are deleted after two hours. After sign-in, the application at app.hallomarco.com sets a session cookie without which sign-in does not work. The legal basis is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and, for the related processing, Art. 6(1)(f) GDPR.

We store your choice in the consent notice in your browser's local storage so that we don't ask again on every page. You can change it at any time under "Cookie settings" at the bottom of every page. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(c) GDPR (proof of consent).

6. Google Analytics

If you consent, we use Google Analytics 4 to understand which pages are visited and how visitors find our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA.

Google Analytics sets cookies (for example "_ga") and processes information about your device and browser, the pages viewed, the source of the visit, date and time, and your approximate location. According to Google, your IP address is not stored in Google Analytics 4. We do not use Google Analytics for advertising and do not combine the data with other data about you.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent Google Analytics is not loaded. You can withdraw your consent at any time under "Cookie settings"; this does not affect the lawfulness of processing carried out before.

Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on this adequacy decision. Data on individual visitors is deleted in Google Analytics after 14 months. Google processes the data as our processor under the data processing terms for Google Analytics.

7. Contact form, demo request and email

If you write to us via the form or by email, we process the information you provide: name, business, industry, phone number, email address, preferred date and message. We use it to answer your enquiry and arrange a demo call.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. The enquiry is stored on our server and delivered to us through an email service. We delete enquiries six months after they have been completed. If a contract results, the periods in section 9 apply; we keep business letters as long as commercial and tax law require.

To protect against automated submissions, the form contains an invisible field and a time check. No additional data about you is collected for this.

8. Demo number

If you call our demo number, Marco talks to you. Here we are the controller ourselves. Marco says at the beginning that an AI assistant is speaking. We process your phone number, time and duration of the call, the conversation content as text and a summary. Demo calls are not recorded. The technical steps in section 11 apply accordingly.

To keep the demo available for everyone, we limit the duration and the number of calls per phone number and day. Once the daily budget is reached, you hear an announcement and we receive an email with your phone number and the time, so that we can get in touch if you are interested.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is demonstrating the service to prospects, preventing abuse and responding to enquiries. We delete demo calls after 30 days.

9. Customer account and contract

To use Hallo Marco, you or we on your behalf create an account. We process name, email address, business, address, phone number, role in the business, sign-in data (password only as a hash, passkeys only as a public key), billing and payment details and the settings of your business. On registration and for new versions, we store when you accepted the terms, this privacy policy, the data processing agreement and, where applicable, the addendum for professional secrecy holders, with IP address and browser identifier as proof. To protect against automated registrations, your browser solves a small computing task; no additional data is collected for this.

We send you emails and, if you allow it in the installed app, push notifications that are needed for using the service, such as invitations, callback tasks, notices about used-up minutes and invoices. Push notifications are delivered by your browser vendor's push service (such as Google, Apple or Mozilla, also in the USA). Their content, such as a caller's name or phone number and a short summary of the request, is end-to-end encrypted and cannot be read by these services. You can switch push notifications off at any time in the app or in your browser. We log who views, changes, exports or deletes data in the account, and when our staff access an account for setup or support.

The legal basis is Art. 6(1)(b) GDPR, for invoices and accounting Art. 6(1)(c) GDPR, for security logs and proof Art. 6(1)(f) GDPR; our legitimate interest is secure operation and being able to prove agreements.

We delete registrations whose email address is not confirmed within 48 hours. We delete account and business data 30 days after the end of the contract. We keep proof of acceptances and access logs until the limitation periods expire, as a rule three years after the end of the year in which the contract ends. We keep invoices and accounting records as long as commercial and tax law require (up to ten years).

10. Payments, calendar and mailbox

Payments are handled by a payment service provider. It processes your payment data partly on our behalf and partly as a controller in its own right, for example for fraud prevention and statutory checks. We only receive the information we need for billing and accounting, such as payment status, payment method and the last digits of a card. If you enter a VAT identification number, the payment service provider checks it in the European Commission's VAT Information Exchange System (VIES). The legal basis is Art. 6(1)(b) and (c) GDPR.

If you connect your calendar or mailbox at Google or Microsoft, you sign in there yourself and allow access. We store the access tokens encrypted and use them only for the features you have switched on. You can disconnect at any time in Hallo Marco or at your provider; we then delete the tokens. Appointments Marco enters are in your calendar.

11. Calls and messages on behalf of your business

Marco answers calls for businesses and replies to messages via WhatsApp, email and the website chat. The respective business is the controller for this data. We process it on its behalf under Art. 28 GDPR on the basis of a data processing agreement. If you are a caller or customer of a business and have questions about your data, please contact that business; we support it.

We process:

  • phone number or sender, date, time and duration of the conversation
  • content of the call or message as text, and from it a summary with the request and next step
  • information Marco asks for per request type, for example name, address, date of birth or preferred appointment
  • appointments, callback requests and contacts; if the same number calls again, the business can see that
  • attachments, photos and voice messages if you send them
  • recordings, if the business has switched them on (section 12)

How a call works: the call arrives via a telephony provider with an EU region. Speech recognition and speech output run through this provider and may partly take place outside the EU, including the USA. The AI language model that understands the request and replies runs at a provider that also processes outside the EU, including the USA. According to its terms, this provider does not use the data to train its models. The knowledge search, for which passages from the business's knowledge and your question are processed, runs with our own model, hosted in Germany. We store knowledge, conversation histories, summaries and contacts in Germany.

At the beginning of every call Marco says that an AI assistant is speaking; in the chat it is shown in the header of the window, in messages in the first reply. Marco makes no decisions with legal effect for you within the meaning of Art. 22 GDPR; binding decisions are made by the business.

WhatsApp: Messages via WhatsApp are also processed by Meta, including outside the EU; our telephony provider routes WhatsApp messages via the USA. For medical practices, law firms and tax firms, WhatsApp is therefore switched off by default and can be switched on deliberately by the business.

Email: If a business forwards its emails to Hallo Marco or connects its mailbox at Microsoft or Google, Marco reads incoming emails and creates replies as drafts or sends them, depending on the business's settings. Receiving and sending runs through an email service in the EU. If the business has confirmed its own domain, Marco sends replies from the business's address, and links in Marco's SMS and WhatsApp messages lead through a subdomain of the business to Hallo Marco.

Website chat: The chat on a business's website sets no cookies. It only stores a conversation identifier in the storage of the browser tab, which is deleted when the tab is closed (§ 25(2) no. 2 TDDDG). To protect against abuse, we briefly process the IP address for rate limits.

Calendar and travel time: If a business connects its calendar, Marco reads free times and enters appointments. If the business switches on service area and travel time, your address is sent to Google's map service to convert it into coordinates and calculate the travel time; data may reach the USA in the process.

Voice messages: We convert voice messages to text on our own systems in Germany. Only if this fails does an external speech recognition provider carry out the conversion, also in the USA.

12. Call recording

Each business decides itself whether calls are recorded. The template for each industry sets a default; for professions with a duty of confidentiality, such as medical practices and law firms, recording is switched off. Before a recording starts, the caller hears a notice and can end the call. The business as controller determines the legal basis for the recording; as a rule this is the caller's consent. Recordings are kept at our telephony provider in the Ireland region, are only played through our application and are deleted together with the conversation.

13. Retention in the service

Each business sets how long calls, messages, summaries, recordings, callback tasks and appointments are kept: 30, 90 or 365 days after the last activity. The default is 90 days. After that the data is deleted automatically, also at the telephony provider, including the notifications by SMS or WhatsApp that belong to a conversation. Contacts, such as name and phone number, are kept until the business deletes them, you request their erasure or the business's contract ends. What a business deletes in the application stays in a trash for 30 days, from which it can restore it; after that it is deleted. If you request the erasure of your data, it takes effect immediately, without the trash. When a business's contract ends, we delete its data 30 days after the end of the contract. Deleted data disappears from our backups after at most 14 further days.

14. Recipients and processors

We only share data where this is necessary for the service. The following categories of service providers work on our behalf:

  • hosting and data storage (Germany)
  • server administration (USA, without access to content in normal operation)
  • monitoring of errors and performance of the application (USA, technical data without conversation content)
  • telephony with an EU region, including speech recognition and speech output (partly outside the EU), SMS and WhatsApp sending (USA)
  • AI language model and the fallback for voice messages (USA)
  • receiving and sending email (in the EU)
  • Google's map service for service area and travel time (also USA), only if the business switches it on
  • Google Analytics on the website, only with your consent (section 6)

Notifications to the installed app are delivered by the browser vendors' push services; they cannot read the content (section 9). Partly a controller in its own right is the payment service provider (section 10). Services a business connects itself and with whose providers it has its own contracts, such as WhatsApp, its calendar or its mailbox, work on behalf of the business. The individual providers with name, registered office, location of processing and basis are listed in Annex 2 to the data processing agreement. We use the same providers where we are the controller ourselves (demo number, customer accounts).

15. Transfers to third countries

Data is transferred to countries outside the EU and the EEA for the AI language model, parts of speech recognition and speech output, SMS, WhatsApp, the map service and the fallback for voice messages (section 11), server administration, error and performance monitoring and Google Analytics after your consent (section 6). We only transfer data if the requirements of Art. 44 et seq. GDPR are met: for providers certified under the EU-US Data Privacy Framework on the basis of this adequacy decision, otherwise on the basis of the standard contractual clauses of the European Commission. You can obtain a copy of the standard contractual clauses on request to contact@hallomarco.com.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future. Please write to contact@hallomarco.com. If your request concerns a conversation with a business, we forward it to that business.

Right to object: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

17. Obligation to provide data

You do not have to provide personal data to use the website, apart from the technically necessary data under section 4. For an enquiry we need a way to reach you. For a customer account and the contract we need the information under section 9; without it we cannot conclude a contract.

18. Changes

We adapt this policy when the service, our providers or the legal situation change. The version published here applies. We inform customers of material changes by email.