Privacy Policy

The data controller is AI VOICE Single-Member P.C. (AI VOICE ΜΟΝΟΠΡΟΣΩΠΗ ΙΚΕ), Kolokotroni 3, 19016 Artemida, Attica, Greece, VAT No. EL802638503, Tax Office: KEFODE Attikis, G.E.MI. No. 180020501000.

For any matter concerning personal data: aivoice@aivoice.gr.

• Contact form: full name, email, phone (optional), business (optional), your message and the IP address the form was submitted from, to protect against abuse.
• Digital assistant (chatbot): the text of the conversation and, only with your consent, the details you enter in the assistant's form. Details in the "Digital assistant" section.
• Orders and customer account: the details of your order and your account. Details in the "Orders, payments and account" section.
• Usage data: aggregated, anonymous visitor statistics (pages, country, device type) without cookies and without storing your IP address.
• Server log files for the operation and security of the website. We do not keep an access log with visitors' IP addresses.

We do not collect special categories of data through the website.

The website offers an artificial intelligence (AI) digital assistant. You are talking to software, not to a person. The assistant answers questions based on the information on the website. It does not make decisions that produce legal effects for you (Article 22 GDPR).

What is recorded

• The conversation text: your messages and the assistant's replies, time and language. Deleted automatically after 90 days.
• The details in the assistant's form, only if you choose to leave your details and tick the consent box: full name and email (required); phone, business, topic and message (optional); plus the time and the version of the consent text. Deleted automatically after 12 months, or earlier if you ask.
• Technical conversation data without text and without personal details: a random identifier, times, language, whether the form was opened or a person was requested. Used for billing and statistics. Once the text is deleted, they are not linked to anyone.

What is not recorded: your IP address is not stored. It is used only temporarily, in hashed form, to protect against spam, and is discarded within about 10 minutes. No device or browser details are recorded and no cookies are used. To continue the conversation when you move to another page, one technical key is stored in your browser for as long as the tab stays open (see the Cookie Policy).

AI provider: the replies are generated by the model of Anthropic, PBC (USA), acting as a processor. With every reply, the conversation history (up to 24 messages) is sent to it. The details in the form are never sent to the AI provider. However, anything you type in the conversation itself is sent, so please do not type personal details into the chat. Anthropic does not use the data to train models and deletes it within 30 days. Exceptions are conversations flagged for breaching its usage policy (kept for up to 2 years) or where the law requires it.

Legal basis: answering your questions relies on our legitimate interest in serving visitors and on taking steps at your request before entering into a contract (Article 6(1)(f) and (b) GDPR). The details in the assistant's form rely on your consent (Article 6(1)(a)), which you can withdraw at any time.

Finding a conversation: because we do not link conversations to a cookie, IP address or email, to exercise your rights for a conversation without a form we need the date, the time and some detail of its content.

Order: full name, email, mobile phone and, if you provide them, business name, VAT number, address and notes; the product, the amount and the payment status. We need them to fulfil the order and issue the legally required receipt or invoice.

Invoice: if you ask for an invoice, we collect your business name, VAT number, tax office, business activity and address, to issue the document. Receipts and invoices, with the Unique Registration Number (MARK) of the Greek tax authority (AADE), and refunds are kept for as long as tax law requires.

Acceptance of terms: we record the time you accepted the Terms of Contract, the exact version accepted and, where requested, your consent to the service starting immediately. This proves what was agreed.

Payment: payment is made to the licensed payment service provider Scan & Pay. We do not see or store card details.

Expiry reminders: before your access expires, we email the address on your account 30 days and 7 days before, and on the day it expires. We record which reminder was sent and when; this record is deleted together with your account. Reminders are part of the service, not advertising.

Customer account: to sign in to your account we use your email and a one-time code we send you. We record your email, name, phone, language, the time of your last sign-in and the applications you have access to. Codes and sessions are stored only in hashed form.

Devices: for each sign-in to your account we keep only the type of browser and operating system (e.g. "Safari · iOS"), the time you signed in and the time of last use. We do not keep your IP address. These details are deleted when the session expires or is ended.

"My data": in your account you can see and download everything we keep about you, sign out devices and request deletion.

Requests about your data: we reply within one month at the latest. We keep a record of each request (email, type of request, dates), even after deletion, as proof that we handled it. On deletion we erase your account, sign-ins, access history, reminders and form messages. Orders, receipts and invoices are kept for as long as tax law requires.

Legal basis: performance of the contract (Article 6(1)(b) GDPR) for the order, the account, devices and reminders; tax law for invoice details, receipts and invoices (Article 6(1)(c)); and our obligation to show that we handle your requests, for the record of requests (Article 6(1)(c)).

• Responding to requests via the contact form: taking pre-contractual steps and legitimate interest (Article 6(1)(b) and (f) GDPR).
• Digital assistant: as described in the "Digital assistant" section.
• Orders, payments and account: performance of the contract and legal obligation under tax law (Article 6(1)(b) and (c)).
• Visitor statistics: legitimate interest in improving the website (Article 6(1)(f)), as the data is anonymous and no cookies are used.
• Website security: legitimate interest.

• Hosting: Hetzner Online GmbH (Germany, EU), as processor. The website, the digital assistant, the database and the backups are hosted there.
• AI provider of the digital assistant: Anthropic, PBC (USA), as sub-processor. It receives only the conversation text.
• Payments: Scan & Pay, a licensed payment service provider. It receives the details needed for the payment.
• Email delivery (notifications, sign-in codes, order confirmations): Brevo / Sendinblue SAS (France, EU).
• Company email: Google Workspace (Google Ireland Limited), where we receive messages and notifications.
• The company's accountant, for issuing and keeping receipts and invoices.
• Analytics: Plausible Analytics (Plausible Insights OÜ, Estonia, EU), without cookies and without personal data.

We do not sell your data or transfer it to third parties for advertising purposes.

The website and the database are hosted in Germany (EU).

Exception: the digital assistant. The conversation text is transferred to Anthropic, PBC (USA) to generate the replies. It is stored in the USA and may be processed in countries in the USA, Europe, Asia and Australia. The transfer relies on the European Commission's Standard Contractual Clauses (Article 46 GDPR), which are included in Anthropic's Data Processing Addendum.

Emails we receive through Google Workspace may also be stored outside the EEA, under Google's data processing terms and the Standard Contractual Clauses.

You can ask for more information about these safeguards at aivoice@aivoice.gr.

• Contact form messages: 12 months from the last contact, unless an engagement follows.
• Digital assistant conversation text: 90 days. At the AI provider: up to 30 days, with the exceptions in the "Digital assistant" section.
• Digital assistant form details: 12 months, or until you withdraw your consent.
• Orders, receipts/invoices and acceptance of terms: as long as tax law requires (as a rule 5 years from the end of the financial year) or as needed to defend legal claims.
• Customer account: while you have active access and up to 12 months after it ends, or earlier if you ask for deletion. Sign-in codes expire within minutes and sessions after 30 days.
• Backups: deleted data may remain in a backup for up to 30 more days.
• Visitor statistics: aggregated only, with no identification of individuals.
• Server log files: for a limited period; they are deleted automatically when the server renews them, for example with each software update.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw any consent. To exercise them, write to aivoice@aivoice.gr. We respond within one month.

If you believe your rights are being infringed, you can contact the Hellenic Data Protection Authority (www.dpa.gr).

The website and the digital assistant operate exclusively over HTTPS. Access to messages, conversations and orders is restricted to the responsible company staff, and backups are kept.

This policy may be updated. The date of the last update is shown at the top of the page.