Privacy Policy

1. Who we are

VoiceCosmos is operated by number7even UG (haftungsbeschränkt), based in Munich, Germany. See our Imprint for full details. Privacy questions: privacy@number7even.com.

2. What data we collect

• Account data: name, email, phone, role, organisation
• Voice recordings + transcripts: only during ARIAN sessions you initiate
• Voice biometric vectors: only with explicit GDPR Article 9 consent at enrollment
• Usage data: session timestamps, conversation outcomes, module usage
• Technical data: IP address, browser, device type (for security and abuse prevention)

When you process YOUR guests\' data through ARIAN, you are the Controller and we are the Processor under our Data Processing Agreement.

3. PII redaction at the edge

Voice transcripts pass through a redaction layer before reaching the LLM or being persisted. Names, addresses, payment numbers, government IDs, and dates of birth are hashed or masked. Raw PII never enters our prompts or general logs.

4. Lawful basis

• Contract performance: account, billing, conversation processing
• Legitimate interest: abuse prevention, security, product analytics
• Explicit consent: voice biometric (Article 9), marketing communications
• Legal obligation: tax records, regulatory disclosures

5. Your rights

Access, rectification, deletion, portability, objection, withdrawal of consent. All available programmatically via your tenant cockpit. Manual requests to privacy@number7even.com — response within 30 days.

6. Retention

• Account data: lifetime of account + 30 days post-cancellation
• Voice recordings: 90 days unless tenant retention policy extends
• Transcripts: 12 months by default (tenant configurable)
• Voice biometric: until consent withdrawn
• Billing records: 10 years (German tax law)

7. Sub-processors and international transfers

Primary infrastructure is EU-hosted (Frankfurt). Sub-processor list available in the DPA. International transfers (where unavoidable) covered by Standard Contractual Clauses + supplementary measures.