Privacy Policy

IT DEV offers HiNewton: voice and chat AI agents for businesses. This Policy explains what personal data we process when you visit hinewton.ai, when you are our customer, and when you talk to the AI agent of a business that uses HiNewton.

Company

IT DEV

Address

139 Argous St, 104 41 Athens, Greece

GEMI No.

172450601000

Email

info@itdev.gr

Phone

+30 210 260 3414

• For the data of website visitors, prospects and customers (communication, account, invoicing), IT DEV is the controller.
• For calls and conversations with a business's AI agent, that business is the controller. IT DEV acts as processor on its instructions and uses the sub-processors in section 7.

If you talked to a business's AI agent, contact that business first about the legal basis, the purpose and your rights.

• Details you give us in the contact form or other communication: name, email, phone, company and your message
• Customer details: invoicing details, VAT number, contract details, plan, usage and payment history. We do not store card numbers
• Console user details: name, email, role and login records
• Technical visit details, such as IP address and browser type, in the hosting provider's logs
• Website usage data through Google Analytics, only if you accept it (section 11)

When you talk to a business's AI agent, we may process on its behalf:

• The content of the conversation: real-time audio, transcript, chat messages, summary and fields extracted from it
• The audio file of the call, only if the business has turned recording on
• The phone number, time, duration and technical details of the call or session
• Anything else you mention in the conversation. Please do not give sensitive details unless necessary

The business sets the purpose and legal basis, and must inform the caller that they are talking to an artificial intelligence system (Article 50 of Regulation (EU) 2024/1689) and, if there is recording, before it starts (Article 4 of Greek Law 3471/2006). We provide the technical means for this notice.

The agent's answers are generated automatically and may contain mistakes. We do not take decisions with legal effects on you by solely automated means within the meaning of GDPR Article 22. You can ask to talk to a person at the business.

For data where we are the controller (GDPR Article 6(1)):

Answering requests and quotes

Pre-contractual steps or performance of a contract, Article 6(1)(b)

Providing the service and support

Performance of a contract, Article 6(1)(b)

Invoicing, tax and accounting compliance

Legal obligation, Article 6(1)(c)

Security, abuse prevention, defending legal claims

Legitimate interest, Article 6(1)(f)

Telling customers about similar services

Legitimate interest, with a right to object at any time

Newsletter to non-customers

Consent, Article 6(1)(a)

Traffic statistics with Google Analytics

Consent, GDPR Article 6(1)(a) and Article 4(5) of Greek Law 3471/2006

We do not sell personal data.

Call recordings

Where turned on, for a number of days that depends on the package and is stated in the business's contract. They are then deleted automatically

Transcripts and call records

According to the business's package and settings, or until it requests their deletion

After the cooperation ends

Call data is exported or deleted, with a 30-day export period

Backups

Up to 35 days after deletion from active systems

Contact form and requests

Up to 3 years from the last communication, unless a cooperation follows

Invoices, tax and accounting records

As long as tax and accounting law requires, up to 10 years

Security and access logs

Up to 12 months, or longer if a specific incident is being investigated

Deletion may be suspended while data is under a legal hold, for example because of an investigation or a court dispute.

We share data only where needed, with authorised staff, accountants and legal advisers, public authorities where the law requires, and providers acting on our behalf:

Agent platform

A Greek company providing the agent infrastructure and telephony, as sub-processor. Its name is stated in the data processing agreement with our customers

Amazon Web Services

Hosting, storage, databases. EU (primary region)

OpenAI / Microsoft Azure OpenAI

Language models for agent answers. EU / US

Soniox

Speech to text. US

ElevenLabs

Voice synthesis. EU / US

LiveKit

Real-time audio transport. EU / US

ai-coustics

Audio enhancement and noise suppression. EU

SendGrid (Twilio)

Notification and summary emails. EU / US

Vercel

Hosting of the hinewton.ai website. EU / US

Web3Forms

Delivering the contact form to our email. Outside the EU

Google Analytics (Google)

Website traffic statistics, only with your consent. EU / US

The platform's primary data hosting is inside the EU. Some providers in section 7 may process data outside the EEA, for example in the US. In those cases GDPR Chapter V safeguards apply, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask for more information at info@itdev.gr.

• Encryption in transit (TLS) and at rest
• Logical separation of each business's data
• Role-based, least-privilege access with logging
• Backups, monitoring and an incident response process

The hinewton.ai website uses Google Analytics 4 to measure traffic, only if you press Accept. Before you choose, or if you press Reject, no cookies are set and no statistics are recorded. Your browser only downloads the service's file from Google's servers, so Google receives your IP address for that request. We do not use advertising cookies.

_ga, _ga_QKSPVRCVKD

Google Analytics cookies that tell visitors and visits apart. They last up to 14 months

hinewton-cookie-consent

Local storage in your browser that remembers your choice. Necessary, no consent needed

You can change or withdraw your choice at any time from the "Cookie settings" link at the bottom of every page.

An AI agent's widget on a business's website may store in your browser what the conversation needs to work. That business's cookie policy applies to it.

• Access, rectification and erasure (GDPR Articles 15 to 17)
• Restriction of processing and portability (Articles 18 and 20)
• Objection, and in particular to direct marketing at any time (Article 21)
• Withdrawing consent, where consent is the legal basis

Send your request to info@itdev.gr. We answer within one month. For a call or conversation with a business's agent, the business handles the request as controller: if you send it to us, we forward it.

You have the right to complain to the Hellenic Data Protection Authority, 1-3 Kifisias Ave, 115 23 Athens, www.dpa.gr.

HiNewton is aimed at businesses, not at children under 16.

Changes to this Policy are published on this page with a new date, and for material changes we inform our customers. This Policy is governed by Greek law, without prejudice to your mandatory rights.