01, Introduction

Who we are

Dabster Labs (“we”, “us”, “our”) is an AI automation service provider based in Cyprus. This Privacy Policy explains how we collect, use, and protect personal data when you visit our website or engage our services. We comply with the EU General Data Protection Regulation (GDPR) and applicable Cypriot data protection law.

02, Data Controller

Controller vs Processor

For the purposes of GDPR, Dabster Labs is the Controller of personal data collected through this website and in pre-sales communications. When processing client data under a signed service agreement, we act as a Processor on behalf of the client, governed by our separate Data Processing Agreement.

03, Personal Data We Collect

What we gather

• Contact form submissions: name, email address, company name, phone number (optional), and your message.
• Discovery call data: information you share during scoping calls about your business, workflows, and tools.
• Website analytics: anonymized traffic data via Google Analytics, see our Cookie Policy.
• Voice assistant data: if you choose to use it, see section 05 below.
• AI phone line data: if you call our AI phone line or ask it to call you back, see section 05 below for exactly what is processed.
• Number unlock and verification: to reveal our AI line number on the website you give a name, an email and a phone number; we verify the email with a one-time code and keep a record of your consent (timestamp and IP address) as GDPR requires us to be able to prove it.
• Correspondence: emails and messages you send us directly.

04, Lawful Basis

Why we’re allowed to

Under GDPR, every use of personal data needs a legal basis. Ours:

• Consent, for analytics cookies, voice assistant, and marketing communications.
• Legitimate interest, for responding to inquiries and maintaining business correspondence.
• Contract, for delivering services under a signed Statement of Work.
• Legal obligation, for tax, accounting, and regulatory record-keeping.

05, Voice Assistant

Voice & biometric data

Our website includes an optional AI voice assistant powered by a specialist speech technology provider located in the United States. When you choose to start a voice conversation, your microphone audio is transmitted to our speech technology provider, a specialist supplier located in the United States, for speech recognition, response generation, and text-to-speech synthesis. No audio is captured before you accept in the consent dialog.

What we process:

• Your speech audio, processed in the moment so the assistant can understand you. The audio is not stored by us. Under GDPR, voice is classified as biometric data when used to identify a person. We do not use voice for identification, but we treat it as special category data under Article 9 GDPR and apply the strictest consent standard.
• Transcripts, text version of the conversation, generated automatically.
• Conversation metadata, timestamp, conversation ID, and your consent record.

Lawful basis: explicit consent under Article 9(2)(a) GDPR (special category data) and Article 6(1)(a) GDPR (general processing). That provider is established in the United States and is an active certified participant in the EU-U.S. Data Privacy Framework, so the transfer is covered by the European Commission’s adequacy decision of 10 July 2023 under Article 45 GDPR. Its standard data processing addendum, which applies to our account, additionally incorporates the Standard Contractual Clauses of Commission Decision (EU) 2021/914 under Article 46(2)(c) as a fallback, and no audio is sent until you have given explicit consent

Retention: we do not keep the audio; text transcripts are retained for up to 30 days, then permanently deleted. Consent records are retained for 3 years to demonstrate lawful processing under Article 7(1).

Withdrawing consent: voice consent is stored only in your browser’s session storage and does not persist beyond the current tab, closing the tab automatically clears it, and consent is re-asked on your next visit. To request deletion of any transcript we hold, email info@dabsterlabs-ai.cy.

What we do NOT do: we do not keep your voice audio, we do not use it to train AI models, we do not share it beyond that provider acting as our processor, and we never use voice to identify or authenticate anyone.
In accordance with Article 50 of the EU AI Act (Regulation 2024/1689), users are informed that the voice assistant is an AI system before any interaction begins. This disclosure is provided via the consent dialog shown prior to starting a conversation

The AI phone line and requested callbacks

Our phone line is answered by an AI assistant. It tells you it is an AI at the start of every call, as Article 50 of the EU AI Act requires. The same applies when you ask, through our website, to have the assistant call you back.

• What is processed: your speech is processed in real time so the assistant can hold the conversation, through our enterprise voice platform and its speech-technology providers acting as our processors. A text transcript, a short summary, the number you call from, and the details you choose to share (for example your name, business type, or a preferred contact method) are kept as a record of your enquiry in our EU-hosted CRM.
• No recordings by default: calls are not voice recorded. If that ever changes, you will be told at the start of the call and recording will only happen with consent.
• Returning callers: if you have unlocked our number on the website, we may recognise you on a later call from the phone number you verified (never from your voice) so the assistant can greet you and avoid asking again for details you already gave. You can ask us to remove this at any time.
• Team alerts: when a call needs human follow-up, minimal details (name, phone number, and what you asked for) are forwarded to our team by email and by an instant-messaging tool, strictly for handling your request.
• Retention: call transcripts and enquiry records are kept for as long as needed to handle your request and for up to 24 months, unless we enter a business relationship or you ask us to delete them earlier.
• Transfers: real-time speech processing may involve providers outside the EEA; where that happens we rely on Standard Contractual Clauses (SCCs) under Article 46 GDPR. Your enquiry records themselves stay in the EU.

Lawful basis: consent for contacting you about our services (given on the unlock form, with a stored timestamp), and legitimate interest in answering and following up the enquiries you place through the line. To withdraw consent or have your call data deleted, email info@dabsterlabs-ai.cy.

06, How We Use Your Data

What we do with it

• Respond to inquiries and schedule discovery calls.
• Prepare fixed-scope proposals and Statements of Work.
• Deliver and support contracted automation services.
• Send service-related communications and invoices.
• Improve our website and understand visitor behaviour (in aggregate).

We do not sell personal data. We do not use personal data for automated decision-making or profiling.

07, Data Retention

How long we keep it

08, Sub-Processors

Who else touches your data

We share personal data only with vetted sub-processors necessary to operate our services:

• Hosting and infrastructure providers, servers and storage that run our website and systems. Located in the European Union.
• Telephony and voice AI platform providers, real-time speech processing during calls on our AI phone line, so that speech can be turned into text while you speak. The platform is hosted in the European Union. Some speech technology behind it is provided from outside the European Economic Area, and section 09 explains the safeguards that apply to that.
• Speech technology providers, the speech recognition and synthesis behind the website voice assistant, invoked only after you accept in the consent dialog. One of these is located in the United States, so your speech leaves the European Economic Area at that point. Section 09 explains the safeguards, and we will name the provider on request.
• Email delivery providers, sending the messages you request, such as the one time code that reveals our phone number. Located in the European Union.
• Client records and project management software, keeping a record of your enquiry and of our work. Self-hosted by us on infrastructure in the European Union.
• Instant messaging tools, alerting our own team that an enquiry has arrived. Minimal details, internal use only.
• Analytics providers, measuring how the website is used: Google Analytics, only after you accept analytics cookies.
• Accounting and invoicing software, issuing invoices and meeting Cypriot tax obligations. Located in the European Union.

We name a recipient where you would otherwise be surprised to learn it holds your data, in particular where your data leaves the European Economic Area. For the rest we describe the category, what it does and where it sits, which is what Article 13(1)(e) of the GDPR requires.

The current list of our sub-processors, naming each one, is available on request: email info@dabsterlabs-ai.cy and we will send it. All of them are bound by written agreements requiring GDPR-compliant handling, and none of them may use your data for their own purposes.

09, Our CRM and Google Data

Our CRM and your Google Drive

Beyond this website, Dabster Labs provides its own CRM product, which we host on our servers on behalf of our clients. For the data a client puts into it, the client is the controller and we are the processor, under the data processing agreement we sign with them.

The CRM can optionally connect to the client’s own Google account. We request the narrowest permission Google offers, which is access only to the files the application itself creates and to the items the user hands it through Google’s own picker window. We use them solely to create the client and video folders, to create and read the scripts document, and to upload approved videos. The files stay in the client’s Google account.

If the client has connected an AI provider of their own, the text of the scripts document is sent to that provider so it can be split per video. Nothing else from the Drive is sent, direct identifiers are removed before any request leaves, and we do not use Google user data to develop or train models.

We do not sell and do not share Google user data with third parties, other than the AI provider the client chose and our hosting provider. A person on our side reads it only on a support request, or where security or the law requires it. Access can be removed at any time, from the CRM itself or at myaccount.google.com/permissions.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10, International Transfers

Data stays in the EU

Dabster Labs operates within the EU. Where personal data is transferred outside the EEA (for example United States based analytics providers, the speech technology provider behind the website voice assistant, and speech technology behind our AI phone line), we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions, or, for voice data, the explicit consent derogation under Article 49(1)(a) GDPR. The United States does not benefit from a general adequacy decision, but organisations certified under the EU-U.S. Data Privacy Framework do, and the speech technology provider behind the website voice assistant is an active certified participant. That transfer therefore rests on Article 45 GDPR, with the Standard Contractual Clauses in the provider’s data processing addendum as a fallback. You can ask us which provider receives your data, which safeguard applies to it and for a copy of that safeguard, by emailing info@dabsterlabs-ai.cy, as Article 13(1)(f) of the GDPR entitles you to.

11, Security

How we protect it

We implement appropriate technical and organizational measures to protect personal data, including encrypted transmission (TLS), access controls, least-privilege permissions, and regular security reviews. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours as required by GDPR.

12, Your Rights

What you can ask us to do

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure (“right to be forgotten”), subject to legal retention obligations.
• Restrict or object to processing.
• Data portability in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy).

To exercise any of these rights, email us at info@dabsterlabs-ai.cy. We will respond within 30 days.

13, Changes

If this policy changes

We may update this Privacy Policy from time to time. The current version is always available on this page with the revision date at the top. Material changes will be communicated to active clients by email.

14, Contact

Talk to our DPC

Dabster Labs does not meet the thresholds for mandatory DPO appointment under Article 37 GDPR. The contact below handles all data protection inquiries.

For any privacy-related inquiries:

Email: info@dabsterlabs-ai.cy
Dabster Labs, Nicosia, Cyprus