# Privacy Policy

> Learn how Chatterence protects your privacy and handles data with our GDPR-compliant, privacy-first approach.

Last updated: June 10, 2026

## Data Controller

Alan Curtis

C. Veintidós de Mayo de 1986, 69, Las Palmas de Gran Canaria, 35008, Spain

Contact: firstcontact@alancurtisagency.com

## Data We Collect

Chatterence operates on a privacy-first principle. We collect minimal data:

- **Privacy-Friendly Analytics (Umami):** We use Umami Analytics, a privacy-focused, cookie-free analytics tool self-hosted on our EU servers. It collects anonymized data including page views, referrers, browser type, and country (from anonymized IP). No personal data or cookies are used, ensuring full GDPR compliance.
- **Server Access Logs:** IP addresses (anonymized), timestamps, and page views for security and performance monitoring. Automatically deleted after 30 days.
- **Essential Cookies:** Only one technical HTTP cookie (NEXT_LOCALE) to remember your language preference. No tracking or advertising cookies. The Web Assistant chat widget uses browser localStorage and sessionStorage instead of cookies: see the Web Assistant section below.
- **Contact Forms & Appointments:** When you click 'Join the Waiting List' or 'Schedule a Call', you are redirected to secure forms managed by our data processor Brevo. Information collected may include name, email, and phone number for appointment scheduling purposes.
- **Voice Interaction:** When you use the voice mode of our Web Assistant, audio is processed through one of the following paths: (1) Pipeline mode, your speech is transcribed to text by Deepgram (speech-to-text), processed by the AI, and the response is synthesized to audio by Google Cloud Text-to-Speech (Chirp 3 HD). (2) Live mode, audio is streamed natively to Google Gemini Live 2.5 Flash for real-time conversational interaction. In both modes, all processing occurs on servers located in the European Union.

## Legal Basis

We process data based on: legitimate interest (Article 6(1)(f) GDPR) for website functionality, security and anonymous widget operational statistics; consent (Article 6(1)(a) GDPR) for newsletter subscriptions and for interaction with the Web Assistant in text or voice mode (consent version 1.1 explicitly covers both modalities); contract execution (Article 6(1)(b) GDPR) for appointment requests.

## Data Sharing

We do not sell, rent, or share your data with third parties. Our service providers are:

- **Vercel Inc.:** Infrastructure provider with servers in the EU. They process data according to their privacy policy and GDPR compliance.
- **Brevo (Sendinblue):** Data processor for contact forms and appointment scheduling. Located in France (EU), fully GDPR compliant.
- **Google Cloud / Vertex AI:** AI processing provider for the Web Assistant including: text conversation via Google Vertex AI, native audio conversation via Gemini Live 2.5 Flash (live mode), and text-to-speech synthesis via Google Cloud TTS Chirp 3 HD (pipeline mode). All processing occurs with guaranteed data residency in the European Union (europe-west1). No data leaves the EU.
- **Deepgram Inc.:** Speech-to-text provider for the Web Assistant voice pipeline mode. Audio is streamed to Deepgram's EU endpoint for real-time transcription only. No audio is stored. Deepgram acts as a data processor under our data processing agreement.

## Third-Party Services

We use the following third-party services:

### Brevo (formerly Sendinblue)

Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France, RCS Paris: 498 019 298, VAT: FR80498019298

**Purpose:** Processing contact forms, managing waiting list subscriptions, and scheduling appointments

**Data Location:** France/European Union

[Data Processing Agreement](https://www.brevo.com/legal/termsofuse/#data-processing-agreement-dpa) | [Privacy Policy](https://www.brevo.com/legal/privacypolicy/)

### Google Cloud / Vertex AI

Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland

**Purpose:** AI processing for the Web Assistant including: text conversation via Google Vertex AI, native audio conversation via Gemini Live 2.5 Flash (live mode), and text-to-speech synthesis via Google Cloud TTS Chirp 3 HD (pipeline mode). All processing in EU.

**Data Location:** European Union (europe-west1, Belgium)

[Data Processing Terms](https://cloud.google.com/terms/data-processing-terms) | [Privacy Policy](https://cloud.google.com/terms/cloud-privacy-notice)

### Deepgram

Deepgram, Inc., San Francisco, CA, United States

**Purpose:** Speech-to-text transcription for the Web Assistant voice pipeline mode. Audio is streamed in real time and transcribed; no audio is stored by Deepgram.

**Data Location:** European Union (EU endpoint, api.eu.deepgram.com)

**Transfer Mechanism:** Standard Contractual Clauses (SCCs) Art. 46(2)(c) GDPR + EU data residency

[Data Processing Agreement](https://deepgram.com/dpa) | [Privacy Policy](https://deepgram.com/privacy)

### Google Cloud Text-to-Speech (Chirp 3 HD)

Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland

**Purpose:** Text-to-speech synthesis for the Web Assistant voice pipeline mode. Generates spoken audio responses using Chirp 3 HD voices. All processing occurs in the EU.

**Data Location:** European Union (europe-west1, Belgium)

[Data Processing Terms](https://cloud.google.com/terms/data-processing-terms) | [Privacy Policy](https://cloud.google.com/terms/cloud-privacy-notice)

## Your Rights

Under GDPR, you have the right to:

- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Request restriction of processing
- Data portability
- Object to processing
- Withdraw consent at any time for newsletter subscriptions
- Lodge a complaint with the supervisory authority. Our competent authority is the Agencia Española de Protección de Datos (AEPD), C. Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es

The rights listed above, in particular Articles 15 (access), 17 (erasure), and 20 (portability) GDPR, apply equally to any voice data and transcriptions processed through the Web Assistant.

To exercise these rights, contact us at the email above or use the unsubscribe link in any newsletter.

## Data Retention

Server logs are automatically deleted after 30 days. Language preference cookies expire when you close your browser. Contact form data and newsletter subscriptions are retained according to Brevo's data retention policy or until you request deletion. Voice messages stored in the key-value store have a 24-hour TTL (refreshed with each new message in the conversation). Voice transcriptions are persisted in the database and follow the tenant-specific retention policy.

## Important Notice About External Services

When you click buttons to join our waiting list or schedule appointments, you will be redirected to forms hosted by Brevo. This ensures professional handling of your data with enterprise-grade security and GDPR compliance.

## Security

We implement industry-standard security measures including HTTPS encryption for all web traffic, WSS (WebSocket Secure) encrypted transport for real-time voice streaming, JWT-based authentication for the voice service, security headers, and regular security audits.

## International Transfers

Your data is processed within the European Union. All our service providers, Vercel, Brevo, and Google Cloud, process data exclusively within the EU. Deepgram, Inc. is a US-incorporated company; however, all voice data is processed exclusively via Deepgram's EU endpoint (api.eu.deepgram.com) and does not leave the European Union. The transfer to Deepgram is legitimised under Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, supplemented by Deepgram's EU data residency guarantee. A copy of the applicable SCCs can be obtained by contacting us.

## Contact Us

For privacy-related questions, contact us at: firstcontact@alancurtisagency.com

## CHATTERENCE Web Assistant, AI System

CHATTERENCE Web Assistant is an AI-powered conversational assistant embedded on this website. It supports text and voice interaction. Below we describe how the system works and how your data is handled.

### Voice Processing

You can interact with the Web Assistant via voice in two modes: (1) Pipeline mode, your speech is transcribed to text by Deepgram (STT), processed by the AI, and the response is spoken back via Google Cloud Text-to-Speech Chirp 3 HD. (2) Live mode, audio is streamed natively to Google Gemini Live 2.5 Flash for real-time bidirectional voice conversation. Both modes run on infrastructure hosted in the European Union (europe-west1).

### AI Provider and Data Residency

All AI processing, both text and voice, occurs via Google Vertex AI and Deepgram, with guaranteed data residency in the European Union. No data transits outside the EU. Google and Deepgram process data as sub-processors under our respective data processing agreements.

### Voice Data Handling

Voice messages are temporarily stored in an encrypted key-value store with a 24-hour time-to-live (TTL), refreshed with each new message in the conversation. Transcriptions of voice messages are persisted in our database (Turso) and follow the tenant-specific data retention policy. No raw audio recordings are retained beyond the 24-hour TTL window.

### EU AI Act Disclosure (Art. 50)

In compliance with Article 50 of the EU AI Act, a pre-recorded audio disclosure is played before every live voice session begins, informing the user that they are about to speak with a virtual assistant. The disclosure message is: "Stai per parlare con un assistente virtuale" (or the equivalent in the user's language).

### Consent

The existing privacy consent covers interaction with the Web Assistant in text or voice. The microphone is activated only upon your explicit action (tap or hold the voice button). No audio is captured without your active input.

### Anonymous Widget Telemetry

On pages where the Chatterence widget is present, we collect anonymous technical operational statistics (widget load, response times): no cookies, no persistent identifiers, URLs without parameters, country-level geolocation only. These statistics contain no identifying data. Legal basis: our legitimate interest in monitoring widget load reliability and response performance to maintain service quality (Article 6(1)(f) GDPR).

### Chat Data Storage

When you use the chat, after your explicit consent, your browser stores a session identifier, your preferences and the encrypted conversation history, and a server-side user profile linked to your conversation is created. See the widget's own privacy notice, shown before you start a chat, for details.

### System Creator

CHATTERENCE Web Assistant is developed by AC Agency using generative artificial intelligence technology from Google and other EU-compliant providers. It is not created by Google.

## Changes to This Policy

We may update this privacy policy. Changes will be posted on this page with an updated revision date.

---

https://www.chatterence.ai/en/privacy