Privacy policy
This policy explains what happens with the data you send through the request forms and the demo chat on atbild.lv (also reached via zvanis.lv and zvanis.com) and voxintelligence.ai, what happens when you call the Zvanis sales line, and what the sites themselves collect. It is written to be read, not to be scrolled past.
Who is responsible
The data controller is SIA "Vox Intelligence", registration number 40203784899, VAT No. LV40203784899, registered address Atlantijas iela 23, Rīga, LV-1015, Latvia. Zvanis and Vox Intelligence are products of SIA "Vox Intelligence"; the company is represented by its Board Member Sanda Veisa. Questions about your data: info@zvanis.lv.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Company name, contact person, email, phone (optional), country, industry, calls per day, assistant language, chosen plan, your message | To reply to your request, arrange a demo and prepare an offer or agreement | Steps taken at your request before entering into a contract (GDPR art. 6(1)(b)) |
| From the same request: industry, calls per day, country, assistant language, chosen product or plan and the needs you described | Market and product analytics: to understand, in totals, which industries need the assistant and at what volumes, and to improve the product. The results contain no names, emails or company names, and we make no decisions about any specific company or person | Legitimate interest in developing the service and researching the market in aggregate (art. 6(1)(f)). You can object to it (art. 21(1)): say so in your request or write to info@zvanis.lv, and we will leave your request out of the totals |
| Name, company and email, only if you ticked the separate box for news | News about Zvanis and Vox Intelligence and offers for your industry by email | Your consent (art. 6(1)(a)) and article 9 of the Latvian Law on Information Society Services. The box is not a condition of your request, and you can withdraw consent at any time |
| Consent record: time, policy version, exact wording of the box, language, website and hashed IP address. After withdrawal: time of withdrawal and a pseudonymised fingerprint of the email | To prove what you agreed to and when, and to stop sending to you after you withdraw | Obligation to demonstrate consent (art. 7(1)) and accountability (art. 5(2)); after withdrawal, legitimate interest in respecting your choice (art. 6(1)(f)) |
| Text of the demo chat on voxintelligence.ai and the email you enter before the voice demo or after the free replies | To answer you in the conversation, receive your request, check answer quality and stop abuse. Text processing includes masking personal ID numbers and card data | Your request (art. 6(1)(b)); quality and security: legitimate interest (art. 6(1)(f)) |
| A call to the Zvanis sales line: your phone number, the conversation text (speech is turned into text), a summary and, if you ask for it, a callback request (name, preferred time, question). Routine call audio is not recorded; diagnostic test exceptions are described separately. At the start of the call the assistant says that it is an AI and that the conversation is transcribed | So that the AI voice assistant can answer your questions, note a callback request and our colleague can contact you; to check answer quality and stop misuse. Text processing includes masking personal ID codes and card data | Your request and steps before entering into a contract (art. 6(1)(b)); quality and security: legitimate interest (art. 6(1)(f)) |
| Hashed IP address and browser type at the time of sending | To stop automated spam and abuse of the form. The IP address itself is not stored, only an irreversible hash | Legitimate interest in protecting the service (art. 6(1)(f)) |
We do not sell your data or share it with other companies for their own purposes. We send news and offers only if you ticked the separate box. We do not make automated decisions about you.
Demo call requested on the website
When you enter a number and request a demonstration, our assistant calls that number. We process the number and country, language and voice, consent version and time, verification and call status, call times, duration and cost records. Turnstile, salted phone/IP hashes, rate counters and an automatic emergency stop protect against abuse. Request calls only for a number you control or are authorised to use.
We carry out your requested demo and take steps before a possible contract (GDPR Article 6(1)(b)), record your explicit callback request/consent (Article 6(1)(a)) and protect the service under legitimate interest (Article 6(1)(f)). The call chain uses LMT for outbound connection, Deepgram for speech recognition, Google Gemini for replies, Azure Speech or Google Text-to-Speech for synthesis, Hetzner and Supabase. Calls are transcribed as text; routine demo audio is not retained. Separately enabled diagnostic tests may have their own recording notice and retention.
Before the call we verify access to your number using a one-time SMS code. The code is not stored as plain text; the message is sent through our Android SMS Gate gateway with an LMT SIM. The code verifies the number and does not subscribe you to marketing.
Completed demo call requests, consent, status and cost records are retained for 365 days. Conversation text follows the workspace’s 30-day demo retention. The full recipient number in the request is cleared at final status; Turnstile hashes after one day and IP hashes after 30 days.
How long we keep it
- Requests: twelve months from the date you sent them, then deleted. If we sign an agreement, the data moves into that relationship and is kept under the agreement's terms.
- News list: name, company, email and the consent record until you withdraw, but no longer than twenty-four months from the date of consent. After that we ask again or delete.
- After withdrawal: the fact of withdrawal and its proof, in pseudonymised form, for three years from the date of withdrawal, so that we can demonstrate compliance if a complaint or inspection arises. It holds no name or email.
- Demo chat text: thirty days.
- Calls to the sales line: conversation text, summary and callback request thirty days. Routine call audio is not retained; see the separate diagnostic test section.
- Market analytics: totals only, without personal data. These may be kept longer because nobody can be identified from them.
- Website analytics data (Google Analytics 4): event data is stored for 2 months and user data for 14 months. Resetting user data retention on new activity is enabled: each new activity by a user restarts the 14-month period. Browser cookie storage is separate:
_gaand_ga_*are both configured to expire after up to 2 years (730 days), but the observed expiry in the tested Chromium browser is up to 400 days because of its browser limit. Browsers may apply shorter limits, and cookies can be deleted earlier.
How to withdraw consent for news
Every email has an "Unsubscribe" link, or write to info@zvanis.lv. Withdrawing is as easy as agreeing, free of charge, and does not affect your request. Withdrawal does not affect the lawfulness of processing before it.
Who processes it on our behalf
| Provider | What for | Where |
|---|---|---|
| Supabase | Database where requests, consent records and demo conversations are stored | Frankfurt, Germany (EU) |
| Vercel | Hosting of the sites and the functions that receive the forms | Functions run in Frankfurt (EU); Vercel Inc. is a US company bound by EU standard contractual clauses |
| Hetzner Online | Our server that runs the demo chat, the voice assistant and the call connection | Helsinki, Finland (EU) |
| SIA "Latvijas Mobilais Telefons" (LMT) | Telephone operator that connects your call to our server | Latvia (EU) |
| Deepgram | Speech-to-text during the call (the audio stream is not stored) | Processed at the Deepgram EU endpoint; Deepgram, Inc. is a US company |
| Microsoft (Azure Speech) | The assistant's voice: turns reply text into speech (text and audio are not stored) | Sweden (EU) |
| Google (Gemini API) | Language model that writes the demo chat and voice assistant replies (processes conversation text and separately requested personal assistant actions) | Google LLC is a US company bound by EU standard contractual clauses |
| Anthropic | Backup language model if the main one is unavailable | Anthropic PBC is a US company bound by EU standard contractual clauses |
| Resend | Sends the notification email to us, and news to those who agreed | Emails are sent from Ireland (EU); account and sending-log data is stored in the US. Resend Inc. is a US company bound by EU standard contractual clauses |
| Cloudflare | Domain name service, forwarding of our mailboxes and the human check on forms | EU network; Cloudflare Inc. is a US company bound by EU standard contractual clauses |
| Google Workspace / Gmail | The mailbox where the notification arrives | Google Ireland Ltd (EU) |
| Google (Google Analytics 4) | Website traffic and acquisition channel analytics (with Consent Mode v2; only upon your consent) | Google Ireland Ltd (EU) / Google LLC (US, bound by EU standard contractual clauses) |
Cookies and website operation
On atbild.lv we use the following technical and analytical values:
- Strictly necessary technical values: stored in your browser's
localStorage— language preference (zvanis.lang), your cookie consent decision (zvanis.consent), and demo workspace address (zvanis.appUrl, only if opened via a specific link). These values never leave your device. - Analytics cookies (Google Analytics 4):
_gaand_ga_*are both configured to expire after up to 2 years (730 days) from creation or renewal. In the tested Chromium browser, both actually expire after up to 400 days; other browsers may apply their own limits. These cookie lifetimes are separate from the 2-month GA4 event data retention and 14-month user data retention. Purpose: to measure visitor traffic, acquisition channels, and usability in aggregate to improve our services. Legal basis: your consent (GDPR art. 6(1)(a)).
Consent principle (Consent Mode v2): by default, all analytics and advertising storage parameters are set to denied before any analytics tag loads. Analytics cookies are created and data sent ONLY if you click "Accept" in the cookie banner. If you click "Decline", no analytics cookies are created. Advertising cookies are not used. You can change or withdraw your consent at any time by clicking "Cookie settings" in the footer of any page.
voxintelligence.ai uses only strictly necessary cookies (the human check and the demo session), no analytics and no advertising; details on its "Cookies" page. The hosting provider keeps standard server logs (IP address, requested page, time) for security, for a short period.
Your rights
You can ask what data we hold about you, have it corrected or deleted, restrict its processing and receive it in a machine-readable form. You can object to processing based on legitimate interest, including market analytics. You can object to direct marketing at any time without giving a reason, and we then stop sending news. Write to info@zvanis.lv; we answer within a month. You can also complain to the Data State Inspectorate of Latvia (dvi.gov.lv).
Changes
When the policy changes, we update its version date. We communicate material changes as appropriate to their impact. If a new purpose requires consent, we request it separately; a policy update is not itself consent.
When the introductory window is enabled, its dismissal time may be saved in the browser as zvanis.intro.dismissed. This is an interface preference, not an advertising identifier.
Business customer data
SIA “Vox Intelligence” is the controller for our website requests and own communication channels. When the assistant serves a customer company’s channel, that company is the controller and we process data on its behalf under a data processing agreement. Customer retention periods and connections follow that agreement; our demo periods do not automatically apply.
Diagnostic test-call exception
A call transcript is not an audio recording. A separately enabled diagnostic mode may record calls from authorised test numbers with an appropriate notice. These recordings have a retention period of up to 7 days and restricted administrator access. This exception does not automatically apply to every customer call.
Connecting a personal Google account in the dashboard
This section applies to users who have personal Google connection enabled in the dashboard. It does not mean Google integration is included in every company plan. Connection is optional; you grant access through Google’s permission screen.
Basic access allows reading your Google account email, Gmail message metadata and short snippets, and primary calendar events. We use this information to display it in the personal assistant view at your request. This connector does not persist copies of messages or events in our database.
If you request an AI summary or invoice extraction, selected message metadata and snippets are sent to Google Gemini for processing. Full message bodies and attachments are not read. Results appear in the dashboard; invoices are not paid automatically and replies are not sent.
If you enable mail management, we request an additional Gmail permission separately. This allows selected messages to be moved to Gmail Trash or restored after your confirmation. The connector does not permanently delete messages; Google’s rules govern subsequent retention in Gmail Trash.
To maintain the connection we store account identification, granted permissions and an encrypted refresh token. Disconnecting in the dashboard requests Google access revocation and deletes the connection record. You can also revoke access in your Google account security settings. This does not itself delete messages, calendar events or separate security audit records.
The purpose is to provide the connection and dashboard features you request. The legal basis is performance of the requested service (GDPR Article 6(1)(b)); security event records rely on our legitimate interest in protecting the service (Article 6(1)(f)). Google permissions define the scope of technical access.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. We do not use this data for advertising, sell it or use it to train general-purpose AI models.