Privacy Policy

1Data Controller

Dirivian B.V. is the data controller for the processing of personal data as described in this policy.

2Contact Details

For questions about your personal data or this privacy policy, please contact us via:

• Email: privacy@voicehelden.com (or: info@voicehelden.com)

3What Personal Data We Collect

We only collect personal data that is necessary for the purposes described below, including but not limited to:

• Identity and contact data (such as name, email address, phone number)
• Technical data (such as IP address, browser type, operating system)
• Usage data (such as pages visited, time on site, click behaviour)
• Transaction data when you make purchases (such as payment details and invoice data)
• The content of a chat conversation you start yourself through the live chat on our website, together with the name you give and, if you fill it in, your email address or phone number. We also store the page you started the conversation on and a hashed version of your IP address to prevent abuse of the chat window; we do not keep the IP address itself.

4Purposes and Legal Bases

We process personal data for clearly defined purposes and on the basis of a legal ground, for example:

• Performance of a contract (e.g. service delivery, orders)
• Partner applications: assessing your application as a partner and contacting you about it, as a step taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). If you book an introduction through our partner sign-up page, our booking tool receives the details you enter when booking; the sign-up page itself sends no form.
• Call-back requests: calling you back as you asked through the call-back form on our website and following up your request, as a step taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). The processors involved are listed under Third parties and processors.
• Partner account and commission: performance of the partner agreement (Art. 6(1)(b) GDPR). For this we process your name, company name, your business address (street, postal code and city), Chamber of Commerce number, VAT number, IBAN, email address, your partner code and, per paid invoice of a customer you referred, the amount invoiced and the commission that follows from it. Your login and the partner record are held with our hosting provider, as with a customer account; we also create the partner code with our payment service in order to apply your customer’s discount.
• Legal obligations (e.g. statutory retention requirements)
• Legitimate interest (e.g. improving the website, analytical purposes, fraud prevention)
• Live chat: answering your question through the chat window on our website, as a step taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). If your question does not concern a possible contract, the legal basis is our legitimate interest in being able to answer visitors’ questions (Art. 6(1)(f) GDPR). A person answers; no AI is involved.
• Consent (e.g. marketing communications, where you have given explicit consent)

5Cookies and Tracking

We use cookies and similar technologies for functional, analytical and marketing purposes. Functional technologies are needed to make the website work and to remember your cookie choice; we always use those. Everything beyond that loads only after you click “Accept all” in the cookie banner. If you choose “Essential only”, none of the items below load, now or later.

After your consent we load:

• Our product analytics service — which pages and buttons visitors use. The data is held on servers in the European Union.
• The measurement pixel of the advertising platform we advertise on (United States) — to measure whether our ads on that platform lead to a sign-up or an enquiry. The advertising platform receives your IP address, details about your browser and device, the page you are viewing and the event you trigger: a page view, a click on “Build your own AI receptionist”, the submission of the call-back form, a click on the calendar button of the partner sign-up or the confirmed start of your trial in the web app. We do not pass on your name, email address or phone number this way. The advertising platform decides for itself how it uses this data further.
• Our visitor statistics service — visitor statistics on the pages of our site that still run on our older technology: which pages you view and how you reached the site. We do not use this service for advertising: advertising storage and advertising data are switched off, as are the link with visitors’ accounts at the provider and ad personalisation. The provider receives, among other things, your IP address, details about your browser and device, the page you are viewing and the identifiers in the analytics cookies. The provider may also process this data in the United States and partly decides for itself how it uses it further.

The legal basis for this is your consent (Article 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act). You can withdraw that consent at any time through the cookie preferences at the bottom of every page, where you make a new choice. Withdrawal applies going forward and does not affect what has already been measured. The transfer to the advertising platform and to the provider of our visitor statistics service falls under International Transfers.

When you open the live chat window, your browser stores a functional session key that lets us recognise your conversation if you reload the page. That key is strictly necessary for the chat you start yourself, is not used for tracking and is only written once you open the window. It therefore falls outside the choice in the cookie banner.

6Retention Periods

We do not retain personal data longer than necessary for the purpose for which it was collected, unless legislation requires longer periods. General guidelines:

• Transaction and invoice data: up to 7 years (statutory retention requirement)
• Log files and analytics: generally up to 12 months
• Contact and service requests: as long as needed for handling and complaints
• Call-back requests, in our CRM and in the spreadsheet in our office suite: as long as needed to handle your request and any complaints, and no longer than 12 months after the request; after that we delete them
• Transcripts and reports of call-back calls (in our CRM and in our mailbox), recordings, transcripts and reports of demo calls (at our telephony provider and in our mailbox), the appointments made in them in our calendar and role-played reservations in our demo reservation system: as long as needed to follow up your request and any complaints, and no longer than 12 months after the call; after that we delete them
• Partner applications: as long as needed to assess and follow up the application; if no partner agreement is concluded, we delete the application afterwards. If one is concluded, we keep the partner record for as long as the agreement runs and, after that, the self-billing invoices and their specification for another seven years (statutory retention requirement; article 6.6 of the partner agreement)
• Live chat conversations: 12 months after the conversation has ended, unless it is still needed for an ongoing request. After that we delete the conversation. If you would like that sooner, you can ask us; see Rights of Data Subjects.

7Third parties and processors

We may share personal data with processors who perform services on our behalf, such as our hosting provider, our payment service, our email service, our own CRM (for enquiries and partner applications made through the website; it runs at our hosting provider in the EU, in the Netherlands, with that hosting provider as our processor) and our booking tool (for scheduling a demo or a partner introduction; the calendar sits as a widget on our demo page and receives the name, email address and time slot you enter there). We enter into data processing agreements and take appropriate measures to protect your data.

Our service email is sent through our email service. That is for example an internal email notification to voicehelden when an account is created — containing your name and email address, where available, the registration date and time, sign-in method and account ID — and, where you have turned it on in the web app, an email to you with a summary of a call or a reminder before the end of your trial week. Our email service also receives the recipient’s email address and technical information used to deliver the email.

If you sign up with a partner code, we show that partner — without your name, your email address or the content of your calls — your plan, your subscription status, the month you started and the amount invoiced per paid invoice, because we owe them a commission on it (Art. 6(1)(b) GDPR, performance of the partner agreement). In doing so the partner is an independent controller and not a processor acting for us. If you would rather a partner did not see this, sign up without a partner code.

The live chat runs on our own servers at our hosting provider in the Netherlands; that hosting provider is our processor for this. As soon as you start a conversation or submit the offline form, we send ourselves an internal email notification through our email service so that we see your question. That notification contains your name, your email address if you gave one, and the first lines of your message.

If you ask for a call back through the call-back form on our website, or through the demo form on one of our product pages, your phone number and, if you enter it, your name, together with the consent sentence under the form and the page you sent it from, go to our own CRM and to an automated workflow at our automation service, a provider based in Germany. That workflow runs on servers in the EU (Frankfurt, Germany). It records your request in a spreadsheet in our office suite and starts the call back. That call is held by our AI assistant. It runs on our own servers at our hosting provider in the Netherlands and uses our speech AI provider for speech processing (see section 10). The call runs through our telephony provider, which is based in the United States: it receives your phone number and the traffic data of the call, and the audio of the call passes through that provider. We do not record the call-back call, and our telephony provider does not store a recording of it. Instead, the AI service that holds the conversation converts the call into written text (a transcript) while it takes place, so that we can check what was said and agreed. Recordings of call-back calls we made up to and including 17 September 2026 may still be held by our telephony provider. If you want to schedule an introductory meeting during the call, the assistant uses our automation service to find a free slot in our calendar in our office suite and puts the appointment there, with your name and phone number. After the call, we store the transcript and a short report of the call in our own CRM (at our hosting provider in the EU, in the Netherlands) and send them to our internal mailbox at our email service. The report states your name and phone number, whether an appointment was made and a summary of the call. All of these providers are our processors for this. The demo form on our product page for restaurants follows the route in the next paragraph. The purpose and legal basis are under Purposes and Legal Bases, the retention periods under Retention Periods.

If you request a demo call on our product page for restaurants, your request follows its own route. Your name, your phone number and the consent sentence go to our own CRM, and your phone number goes to our demo assistant for restaurants, which runs on our own servers at our hosting provider in the Netherlands. It calls you through our telephony provider and holds the conversation using our speech AI provider for speech processing (see section 10). If you role-play a reservation during that call, the assistant enters it in our demo reservation system at studio.voicehelden.nl, which runs on our own server at our hosting provider in the EU (Belgium), with the details you give for it, such as a name, date, time and number of guests. These providers are our processors for this.

8International Transfers

When using international service providers, data may be transferred outside the EU/EEA. In that case we apply appropriate safeguards, such as standard contractual clauses or other legal safeguards.

In practice this concerns the United States: our speech AI provider and our text AI provider for the AI services in section 10, our office suite and our email service for the spreadsheet of call-back requests, the call reports and transcripts in our mailbox, our service email (such as the account notification, the call summary and the trial‑week reminder in section 7) and the appointments in our calendar in section 7 (these providers may also store this data outside the EU), our telephony provider for the telephony of the call-back and demo calls in section 7 (it processes these calls mainly in the United States), and — only if you consent to it — the advertising platform for the measurement pixel and the provider of our visitor statistics service in section 5. For those transfers we rely on the European Commission’s standard contractual clauses or, where the recipient is certified under it, on the EU‑US Data Privacy Framework. For our telephony provider, these are the standard contractual clauses incorporated in that provider’s data processing addendum. Our automation service, which processes the call-back requests, runs in the EU.

9Security Measures

We take appropriate technical and organisational measures to protect personal data and Google user data against unauthorised access, disclosure, alteration, loss, or destruction.

We protect sensitive data using appropriate security measures, including encryption during transmission and encryption at rest, access controls, authentication and authorisation mechanisms, secure storage, and regular monitoring and security reviews.

Access to personal data and Google user data is limited to authorised personnel and service providers who need such access to provide and maintain our services. We do not sell Google user data or use it for advertising purposes.

OAuth access tokens and other authentication credentials are stored securely and are protected against unauthorised access. When access to a user's Google account is no longer required, we revoke the applicable access and delete the associated credentials in accordance with our retention and deletion practices.

We regularly review and update our technical and organisational security measures to protect the confidentiality, integrity, and availability of user data.

10AI Processing and Google User Data

Our assistant uses AI to hold conversations, summarise messages and draft replies. We do not develop, host or train any AI or ML model of our own, and we do not fine-tune any model on your data. We use hosted third-party AI services only, called server-to-server from our own environment:

• Our speech AI provider (United States) — for the assistant’s speech and text processing
• Our text AI provider (United States) — for drafting suggested replies in our email channel

We hold a paid API account with both providers. Under the terms of both providers, inputs to and outputs from paid APIs are not used to train or improve their models.

Google user data is never used for AI training. Information we receive through Google APIs, including Google Calendar data, is not used to develop, improve or train any AI or ML model, whether generalised or personalised. We do not sell this data and we do not use it for advertising.

When the assistant needs to know whether a time slot is available, it receives only the derived availability for the requested window: the start and end times of busy blocks. The content of calendar entries — titles, descriptions, locations and attendees — never leaves our environment and is never presented to an AI model.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: "VoiceHelden's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

11Rights of Data Subjects

You have rights regarding your personal data, including the right of access, rectification, erasure, restriction of processing, objection and data portability. You may also withdraw your consent where processing is based on consent. For mobile messages you can opt out by replying "STOP". To exercise your rights, contact us via the details above.

12Automated Decision-Making

We do not carry out automated decision-making that produces legal effects or similarly significantly affects you. If we do make automated decisions, we will inform you clearly and, where required, provide appropriate safeguards.

13Complaint to the Supervisory Authority

If you believe we are not handling your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority: www.autoriteitpersoonsgegevens.nl.