Privacy & security
Privacy and security
EU hosting, GDPR, DPA: the four sentences for your data protection officer.
Updated: 30 August 2026
In one sentence
HostUpp is operated in the EU, processes data in compliance with the GDPR, works under a data processing agreement and documents every action in a traceable way.
The facts
- EU hosting: Operated in Frankfurt.
- DPA: The data processing agreement is part of the contract package and can be viewed on our website.
- Data minimisation: We do not store a word-for-word record in our database. The full transcript stays with our AI provider for 30 days and is then deleted. Events, summaries and tasks: personal data is removed after 30 days, anonymous statistics remain. The content of incoming emails is deleted after 90 days. Guest data is also stored in encrypted form.
- Access protection: Every portal account is protected by mandatory two-factor authentication.
- Transparency towards guests: Your position identifies itself as an AI assistant.
- Control: Permissions per position, the approval gate and the emergency stop are in your hands.
The details are set out in the privacy policy and the DPA on our website. Does your data protection officer have a question that is not answered there? Write to us at info@hostupp.ai and we will give you a specific answer.