Privacy Policy

1. Data Controller

Talivio Technology OÜ is the data controller for account and usage data collected through VoxSim. For data processed on behalf of a customer workspace, the workspace owner is the data controller and Talivio Technology OÜ is the data processor.

• Talivio Technology OÜ · Ahtri tn 12, 15551 Tallinn, Harju maakond · Estonia
• E-mail: [email protected]

2. Data We Collect

We collect minimal personal data necessary to provide the VoxSim service:

3. Sub-processors

We use the following sub-processors to deliver the service. Each is bound by a data processing agreement:

Processors (acting on our behalf)

• Google Gemini API — LLM inference for simulation and recognition reports. We use the paid Gemini API tier; under Google's terms and the Google Cloud Data Processing Addendum, prompts and outputs are not used to train or improve Google's models. US processing relies on Google's EU-U.S. Data Privacy Framework certification, backed by the EU Standard Contractual Clauses in the Cloud DPA as an additional safeguard.
• Postmark — Transactional email delivery
• Hetzner / Scaleway — Server infrastructure located in the EU (Frankfurt / Paris)
• Google Analytics — Aggregate website usage statistics — loaded only with your prior consent via the cookie banner; IP anonymisation enabled; transfers to the USA covered by the EU-U.S. Data Privacy Framework / SCCs

Independent controllers (acting on their own account)

• Stripe — Payment processing. Stripe acts as an independent (separate) controller for the payment flow and processes cardholder data under its own privacy policy; we do not store card data and do not sign a controller-processor DPA with Stripe for payments. US transfers rely on the EU-U.S. Data Privacy Framework, backed by Standard Contractual Clauses.

We host within the EU and do not transfer your personal data outside the EEA ourselves. Some recipients (Google, Stripe) process data in the US under the EU-U.S. Data Privacy Framework, backed by Standard Contractual Clauses (SCCs) as an additional safeguard.

4. Your Rights

As a data subject under GDPR you have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to data portability (Art. 20)
• Right to restriction of processing (Art. 18)
• Right to object (Art. 21)
• Right to lodge a complaint with a supervisory authority (Art. 77) — our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); you may also complain to the authority of your own EU member state

To exercise any of these rights, contact [email protected]

5. Data Retention

Account data and simulation content are deleted or anonymised within 90 days after your subscription ends, unless longer retention is legally required. Report access logs are retained for 12 months and AI call audit records for at least 6 months (in line with EU AI Act record-keeping obligations); billing records are retained for 7 years (Estonian Accounting Act, GDPR Art. 17(3)(b)). You may request earlier deletion of data that is not subject to a statutory retention period.

6. Synthetic Agents

The synthetic population used in simulations contains no personal data. Agents are statistically generated from public aggregate statistics (TÜİK and licensed research organisation data) and do not represent or re-identify any real individual.

7. AI Transparency (EU AI Act Art. 50)

VoxSim is an artificial-intelligence system and you are informed that you are interacting with AI. All simulation, poll, and recognition outputs are AI-generated synthetic content — not real opinion polls, surveys, or statements by any real person. In line with Article 50 of the EU AI Act (applicable from 2 August 2026), such outputs are labelled as artificially generated and, where technically feasible, carry a machine-readable marking (a visible and steganographic watermark on PDF reports); the extended deadline for machine-readable marking of pre-existing systems is 2 December 2026. Outputs concerning public figures are hypothetical, synthetic model outputs and must not be presented as genuine statements, opinion polls, or surveys.

Political Opinions of Public Figures (GDPR Art. 9)

Where a simulation refers to the political opinions of a public figure — a special category of personal data under Article 9 GDPR — we rely only on statements that the figure has manifestly made public themselves (Article 9(2)(e) GDPR). We do not infer, attribute, or generate political opinions for real individuals, and any such output is labelled as a synthetic model output rather than a factual statement of that person's views.

8. Cookies

We use essential first-party cookies that are always active: a session cookie that keeps you signed in, a CSRF cookie that protects forms against abuse, and cookies storing your language and theme preference. In addition, we use Google Analytics to collect aggregate usage statistics — these cookies are set only if you accept them via the cookie banner (GDPR Art. 6(1)(a) consent, with IP anonymisation enabled). You can withdraw or change your choice at any time by clearing your browser's site data, after which the banner will appear again. We do not use advertising cookies.

9. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. Material changes will be notified via email to workspace owners at least 30 days before taking effect.