Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

You can find the full provider details in the Legal Notice. We have not appointed a data protection officer, as the statutory requirements for doing so are currently not met.

2. General information on data processing

We process personal data only to the extent necessary to provide a functional website as well as our content and services, or where you have given your consent. Personal data is deleted as soon as the purpose of storage ceases to apply and no statutory retention obligations preclude deletion.

3. Hosting and server log files

This website is hosted by Hostinger International Ltd. (Hostinger). When the pages are accessed, Hostinger, acting as our processor, automatically collects information transmitted by your browser (server log files). This includes in particular:

• IP address of the requesting device,
• date and time of access,
• the file / URL accessed, the amount of data transferred, and a message confirming successful retrieval,
• the browser type and operating system used, and the referrer URL.

The purpose is the technical delivery, stability and security of the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation). Log data is generally deleted after a short period, unless it is required to investigate security incidents.

4. Voice demo (AI telephone / voice assistant)

On the demo page, you can try out the Primavox voice demo. In doing so, you speak with an AI-powered voice assistant through your device's microphone. At the outset, you are informed that you are speaking with an artificial intelligence (AI). Use of the voice demo is voluntary.

What data is processed

• Voice input / speech: Your audio input (what you speak into the microphone) is processed in real time.
• Audio recording: The conversation with the AI assistant is captured and stored as an audio recording for quality assurance and improvement of the service. Storage takes place encrypted via Supabase's storage hosting in the EU region (Frankfurt am Main, Germany). The legal basis is our legitimate interest in quality assurance and improvement of the service (Art. 6(1)(f) GDPR).
• Transcript: The voice input is converted into text (transcription). The transcript of the conversation is stored for quality assurance and demonstration purposes.
• AI voice output: The assistant's responses are generated as synthetic speech (text-to-speech) and played back to you.
• Technical connection data: IP address, timestamps and session/room identifiers that are required for real-time transmission.
• Content you actively provide: If you voluntarily disclose information during the conversation (e.g. your name or your request), this is processed as part of the transcript. Please do not share any sensitive personal data during the demo.

Purposes

Demonstration and testing of the voice assistant, answering your questions in the demo dialogue, as well as quality assurance and improvement of the service.

Legal basis

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give by implication when starting the voice demo and speaking into the microphone after the AI notice. You can end the demo at any time; processing that has already taken place remains unaffected. Insofar as the processing is necessary for the technical performance of the demo you have started, we additionally rely on Art. 6(1)(b) GDPR (performance of pre-contractual measures) as well as on our legitimate interest in presenting and improving the service under Art. 6(1)(f) GDPR.

Recipients / services used

To provide the voice demo, we use specialized service providers as processors (Art. 28 GDPR) or recipients. Where required, data processing agreements are in place with them. The voice input, the audio recording and/or the transcript are thereby transmitted to the following services:

The LiveKit infrastructure used for audio streaming is operated in the Germany region. The storage of the transcripts and the audio recordings takes place via Supabase's database and storage hosting in the EU region eu-central-1 (Frankfurt am Main, Germany).

5. Appointment booking (cal.com)

For booking a (demo) appointment, we use the service cal.com (Cal.com, Inc.). When you book an appointment, we process the contact details you provide (e.g. name, email address, and where applicable your telephone number and your message) as well as the date and time of the requested appointment. The data is entered on the booking page provided by cal.com.

The purpose is arranging and holding the appointment. The legal basis is Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request) or Art. 6(1)(a) GDPR (consent), insofar as you provide voluntary information. cal.com is a US provider (see Section 6).

6. Transfer to third countries (USA)

Several of the services named above are operated by providers based in the USA — namely Deepgram, ElevenLabs, OpenAI, Anthropic and cal.com. When these services are used, personal data (in particular your voice input or the transcript, and your contact details in the case of appointment booking) may be transferred to and processed in the USA.

The USA is not consistently regarded as a country with a level of data protection equivalent to EU law. The transfer therefore takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular through standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) and — where the respective provider is certified — on the basis of an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR). Despite these safeguards, there is a risk that US authorities may access transferred data under certain conditions. By starting the voice demo or the appointment booking, you consent to this transfer (Art. 49(1)(a) GDPR).

7. Retention period

• Server log files: As a rule, deleted shortly after access, unless required for security analysis.
• Transcripts of the voice demo: Stored only for as long as necessary for quality assurance and demonstration; they are deleted after 6 months at the latest, provided no business relationship comes about.
• Audio recordings of the voice demo: The audio recording of the conversation created for quality assurance and improvement of the service is stored encrypted with Supabase (EU region, Frankfurt am Main) and deleted after 6 months at the latest, provided no business relationship comes about. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
• Appointment booking data: Stored for the duration of the appointment processing and subsequent communication; thereafter deleted, unless statutory retention periods apply.

8. Your rights as a data subject

You have the following rights vis-à-vis the controller regarding your personal data:

• Access (Art. 15 GDPR),
• Rectification (Art. 16 GDPR),
• Erasure (“right to be forgotten”, Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Objection to processing (Art. 21 GDPR).

Withdrawal of consent: Insofar as the processing is based on your consent (Art. 6(1)(a), Art. 49(1)(a) GDPR), you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

To exercise your rights, an informal message to info@primavox.de is sufficient.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. For this purpose, you may contact the data protection supervisory authority responsible for you.

10. Notice on artificial intelligence

The voice demo is an AI-powered, automated assistant. At the beginning of the conversation, you are informed that you are speaking with an artificial intelligence and not with a natural person. The responses are generated automatically and may in individual cases be incomplete or incorrect; they do not constitute legally binding information.

11. Currency and amendment of this Privacy Policy

This Privacy Policy is currently valid. As our website continues to develop, or due to changed statutory or regulatory requirements, it may become necessary to amend this policy. The version published here applies in each case.