VoiceBot and data protection: Implementing AI telephony in compliance with GDPR

AI telephony is booming, but where does the data end up?

Updated on 9 September 2026: at Nexoria, Telnyx provides the telephone connection in Frankfurt. Speech recognition and speech synthesis run via Voxtral from Mistral AI in France; the AI answers are also generated by Mistral AI in France. The STT/TTS service does not store the voice data in the process. The location and data controls are as stated by Nexoria as the operator.

AI phone assistants take calls, answer questions and can create appointments or tasks from a conversation. When assessing such a solution, it helps to consider four steps separately: telephone connection, speech recognition, AI answer generation and speech synthesis. Providers and processing locations may differ between these steps.

At Nexoria, this split is stated specifically: Telephone connection in Frankfurt via Telnyx; speech recognition, speech synthesis and AI answer generation via Mistral AI in France. The knowledge base is located on dedicated servers in Germany. This article describes the services involved as well as the rules for consent and retention for the optional VoiceBot.

Voxtral for speech recognition and speech synthesis

At Nexoria, Voxtral from Mistral AI handles both speech-to-text (STT) and text-to-speech (TTS). With STT, the caller's speech is converted into text for further processing. TTS turns the formulated answer back into spoken language.

Mistral documents both functions in its audio documentation, including Voxtral for speech recognition and Voxtral TTS for speech synthesis. The documentation describes the available model functions. The processing in France mentioned here and the absence of storage by the STT/TTS service are based on the operator's confirmation of the Nexoria configuration dated 9 September 2026.

For smooth telephone conversations, the response time of the entire chain is what counts. In a demonstration, check how quickly the VoiceBot responds to typical questions and how it handles pauses or interruptions.

How the processing is split at Nexoria

• Telephone connection: Telnyx provides the connection in Frankfurt. Telnyx is a US company with an EU branch in Ireland. The standard contractual clauses specified in the data processing agreement and the processing register under Art. 30 apply to Telnyx.
• Speech recognition and speech synthesis: STT and TTS are performed via Voxtral from Mistral AI in France. The voice data is not stored by the STT/TTS service.
• AI response generation: Mistral AI processes the content required for the answer in France. The data transmitted by Nexoria is not used for model training; this is agreed in the individual data processing agreement between Nexoria and Mistral AI.
• Knowledge base: Files and the knowledge index are located on dedicated servers in German data centres. Relevant context excerpts may be transmitted to Mistral AI for the answer.

The statement on the absence of storage by the STT/TTS service must be distinguished from retention in Nexoria: the privacy policy sets out separately which call data and, with active consent, which conversation content is created in the Nexoria workspace. The details are set out in the Data processing agreement, in the privacy policy and in the processing register.

A pure opt-in solution: what the VoiceBot has to do with your platform

One point that is particularly important to us: The Nexoria VoiceBot is never activated automatically. It is an add-on that you book deliberately and separately. A Nexoria subscription is required; customers with Nexoria Pro receive a 10% discount on all VoiceBots. No company using the Nexoria platform suddenly has a VoiceBot running without having actively decided to do so. This is a fundamental design principle, not a data protection measure added after the fact.

That leaves the question of separation from the platform. The following is documented on this point:

• The data processing agreement states in § 7(3a) that the core platform is completely separate from the VoiceBot and that files and the knowledge index are located on German servers
• The processing register under Art. 30 names call handling, appointment booking, task creation and forwarding as the purpose of this processing, and lists the callers as data subjects
• The privacy policy lists what results from a call: the caller's telephone number, name and concern, call duration, timestamp and consent status, the transcript only with active consent, plus tasks and calendar entries created on the basis of the conversation
• Without a VoiceBot subscription in place, no data is transmitted to Telnyx. AI answer generation in the core platform via Mistral AI is independent of this

“Completely separate” means, in this context: separate systems with a defined handover. For answer generation, Mistral AI processes relevant context excerpts within the EU, and appointments and tasks can be created in your tenant from a call.

For the AI assistant Nex, the knowledge base, the creation of documents and presentations in the Nex AI chat, tasks and calendar , the data flows of the core platform must still be considered separately from the optional telephone connection: files, the knowledge index and semantic search are located on servers in Germany. AI answer generation is carried out by Mistral AI in France. Other services, including technical error monitoring via Sentry, and enabled integrations are described individually under Security . This does not imply a blanket statement about the entire processing of all additionally used features.

GDPR consent by key press: how it works

When a caller reaches the VoiceBot, a multi-stage consent procedure applies, which is based on the DTMF consent procedure (Dual-Tone Multi-Frequency, the tone signals produced when a telephone key is pressed). This procedure meets the requirements of Art. 6(1)(a) in conjunction with Art. 7 GDPR as well as the EDPB Guidelines 05/2020 on Consent (paras. 77-82).

The process in detail:

• At the start, the caller hears: “This conversation is being conducted by an artificial intelligence. Would you like the conversation to be recorded for quality assurance purposes? Press 1 for yes or 2 for no.”
• The key press is treated as an active, unambiguous action and thus meets the requirement of a clear affirmative action under Art. 7 GDPR
• If “No” is selected (key 2), the call still goes ahead, but without any recording or transcription
• If the caller does not respond at all, the status is treated as “not decided”, and in this case too there is no recording

Technically, we use a 3-state consent model as follows:

• NULL: No decision made (default: no recording)
• false: Explicitly declined (no recording, the decision is respected and documented)
• true: Explicitly consented (transcription starts, consent is traceably logged with a timestamp, session ID and SHA256 hash of the caller's number)

This model relies on the caller's active consent before any recording. The EDPB has repeatedly made clear that pre-selected consent does not constitute valid consent (EDPB Guidelines 05/2020, para. 81). Our approach ensures that personal conversation data is never stored without active consent. Consent can be withdrawn at any time (Art. 7(3) GDPR), even during an ongoing call.

EU AI Act: transparency obligation for VoiceBots

Since 2 February 2025 the first provisions of the EU Regulation on Artificial Intelligence (Regulation (EU) 2024/1689), better known as the EU AI Act, have applied. For VoiceBots, Art. 50(1) is central: AI systems that interact directly with natural persons must be designed in such a way that the person concerned is informed that they are interacting with an AI system. The legislator assumes that people change their communication behaviour when they know that their counterpart is a machine.

At Nexoria, we implement this obligation as follows:

• Immediate disclosure: Even before the actual conversation begins, the caller hears unmistakably that they are speaking to an AI, not hidden at the end of a long announcement, but as the very first statement
• Clear language: The wording is simple and easy to understand: “You are speaking to an AI phone assistant.” No legalese, no small print
• No bypassing: The announcement is technically hard-wired into the IVR flow and cannot be deactivated or skipped by the company using the VoiceBot
• Forwarding to humans: The caller can be forwarded to a human member of staff at any time (if configured by the company)

Infringements of Art. 50 can be penalised with fines of up to €15 million or 3% of worldwide annual turnover (Art. 99(4) EU AI Act). As modern VoiceBots with high-quality speech synthesis sound increasingly natural, the labelling obligation is likely to be interpreted more strictly rather than more loosely in future. Art. 50(1) provides an exception for AI systems that are “obviously” recognisable. However, this does not apply to modern VoiceBots, as they are specifically designed to sound natural.

An overview of risk classes, deadlines and sanctions is provided in the article EU AI Act 2026: What is changing now for AI users.

We do not see the transparency obligation as a burden, but as a mark of quality. Customers who know they are talking to an AI express themselves more precisely, have more realistic expectations and rate the result more fairly.

Retention periods and automatic deletion

Art. 5(1)(e) GDPR sets out the principle of storage limitation: personal data may only be stored for as long as is necessary for the purpose of the processing. For VoiceBot data, we have defined clear retention periods that are enforced automatically.

Our retention policy:

• Raw audio data: Never stored permanently. Speech processing takes place as a real-time stream: audio is converted into text and the audio signal is discarded immediately. At no point does an audio file of the conversation exist on our servers.
• Transcripts (only with consent): Maximum 90 days of retention. If no consent has been given, no transcript is created. Once the 90 days have expired, deletion takes place automatically and irreversibly.
• Caller numbers: After 90 days, automatic truncation to the area code (e.g. +49 228 instead of +49 228 1234567). This means anonymised statistical analyses remain possible without the caller being identifiable. This measure is in line with the principle of data minimisation under Art. 5(1)(c) GDPR.
• Consent logs: Retained for at least as long as the associated conversation data, plus a period of 3 years for possible complaints (limitation period under Section 195 BGB). This means consent can be proven in the event of a dispute (Art. 7(1) GDPR).

Deletion is fully automated by a daily background process (cron job) that identifies expired records and removes them irreversibly. There is no manual component that could be forgotten or bypassed. The deletion mechanism is documented in our processing register under Art. 30 GDPR and is audited regularly.