Privacy policy
Talk9 – Privacy policy (talk9.si)
1. Who we are and how to contact us
Talk9 d.o.o., Rimska ploščad 6, 2250 Ptuj, Slovenia, registration number 7510616000, tax number 37623818 (hereinafter: Talk9, we), is the provider of the Talk9 platform with telephone voice assistants for business customers.
Please send questions regarding the protection of personal data to info@talk9.si or by post to our address, marked “data protection”.
This policy applies from 1 September 2026 and replaces all previous versions.
2. Two roles: when we are the controller and when we are the processor
Talk9 processes personal data in two different roles. The role determines who is responsible for the processing and whom you contact to exercise your rights.
| Role | For which data | Who decides on the purpose | Whom to contact |
|---|---|---|---|
| Talk9 as controller | data of visitors to the talk9.si website, of persons who contact us, of customers and their platform users, data on use of the service | Talk9 | us (section 1) |
| Talk9 as processor | data of persons who call our customers' phone numbers (callers): speech, transcript, summary, collected data, phone number | the customer who uses the assistant on its number | the customer whose number you called; we help them respond |
When you call a customer's number, the controller of your data is therefore the customer (the company or institution you called). Talk9 processes the data on its behalf, according to its instructions and on the basis of a data processing agreement under Article 28 GDPR. Details for callers are in section 4.
3. Processing for which Talk9 is the controller
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Responding to an inquiry via the web form, e-mail or phone | name, e-mail address, phone, company, content of the message | legitimate interest (answering your question), Article 6(1)(f) GDPR; when concluding a contract, point (b) | 12 months after the last contact if no contract is concluded |
| Demo call on our demonstration number | speech during the call, recording and transcript of the demo call, phone number | consent you give at the start of the demo call, point (a) | 365 days; you can withdraw your consent at any time |
| Concluding and performing the contract with the customer | data of the customer's contact persons and representatives: name, position, e-mail address, phone | contract or, for legal entities, legitimate interest, points (b) and (f) | for the duration of the contract and 5 years after its termination (limitation periods) |
| User accounts on the platform | name, e-mail address, role, login log, settings | contract, point (b) | for the duration of the account; login log 12 months |
| Billing and accounting | invoicing data, usage data (number, time, duration and status of calls, without content), payment data via the payment provider | legal obligation (tax and accounting regulations), point (c) | 10 years from the end of the year in which the invoice was issued |
| Operating statistics and service improvements | usage data without call content and without callers' phone numbers | legitimate interest (development and stability of the service), point (f) | permanently, in aggregated form |
| Platform security, detection of abuse | technical logs (IP address, time, action, account identifier) | legitimate interest (security), point (f) | up to 365 days |
| Customer support and troubleshooting | data from the support request; access to the customer's call content only to the extent set out in the data processing agreement | contract, point (b) | 12 months after the request is closed; access to call content is logged for 12 months |
| Direct marketing to existing customers | e-mail address of the contact person | legitimate interest, point (f), with the option to object in every message | until objection or until termination of the contract |
| Newsletter for subscribers | e-mail address | consent, point (a) | until withdrawal |
We do not use the content of our customers' calls (speech, recordings, transcripts, summaries) for training models, product development, demonstrations or quality control. For demonstrations we use only our own demo calls.
4. Information for callers: what happens to your data during a call
If you called a company or institution and were answered by a Talk9 voice assistant, you spoke with an artificial intelligence system acting on behalf of that company or institution (the customer). At the start of the call, the assistant introduces itself as a digital assistant or an artificial intelligence system. At any time during the call you can ask to speak with a member of staff.
What happens during the call. Your speech is converted into text in real time, a language model prepares the answer and speech synthesis speaks it. This processing takes place at our subprocessors in the European Union (section 5). The assistant does not recognise emotions, does not identify you by your voice and does not make decisions with legal effect on you.
What remains after the call. It depends on the setting chosen by the customer. At the start of the call, the assistant tells you which one applies.
| The call is not recorded (configuration A) | The call is recorded (configuration B) | |
|---|---|---|
| Call recording | is not created | is created and kept for as long as the assistant tells you (7 days by default, at most 365 days) |
| Verbatim transcript | is not stored; it exists only in working memory during the call | is created after the call and kept as long as the recording |
| Structured summary and collected data (e.g. your callback number, type of request, preferred appointment, message) | are stored for handling your request, 7 days by default, backups for up to a further 7 days | are stored, 7 days by default |
| Your phone number | after the period expires, it is replaced with a neutral label in the call history | the same |
| Where they are stored | structured summary in the EU | EU |
The customer can receive the collected data by e-mail or in its own system (e.g. calendar, booking software). From there on, the customer's rules apply to them.
Who is the controller and whom to contact. The controller of your data is the customer you called. The legal basis for the processing and for any recording is determined by the customer. Information about this is in its privacy policy. You exercise your rights (access, rectification, erasure, objection) with the customer. If you send the request to us, we will forward it to the customer within two working days and help them respond.
Healthcare institutions. In pharmacies and other healthcare institutions, the assistant does not give medical advice, does not make diagnoses and does not perform triage. If there is a medical question, it transfers you to a member of staff. The assistant is not used on on-call lines or emergency medical lines.
5. Recipients, subprocessors and location of processing
We process data in the European Union. To operate the service, we use the following providers (subprocessors), which process data only according to our instructions, on the basis of written data processing agreements and without the right to use the data for their own purposes or for training models. This list is valid as of 12 November 2026. Customers are notified of changes in advance under the data processing agreement.
| Provider | Purpose | Location of processing |
|---|---|---|
| Wavix | telephony, phone numbers, call recording (configuration B only) | EU (Frankfurt) |
| LiveKit Cloud | audio transmission and voice agent, access to language models | EU (eu-central) |
| Soniox | speech-to-text, voice synthesis, transcription of the recording (configuration B only) | EU |
| Google (Gemini) and OpenAI (GPT) | language model during the call and for the summary (configuration B) | EU |
| Microsoft Azure OpenAI | summary in configuration A | EU |
| Microsoft Azure Speech | backup voice synthesis | EU |
| Supabase | platform database, user accounts | EU (Frankfurt) |
| Siel | storage of summaries and collected data in configuration A | Slovenia |
| Render | web application hosting | EU (Frankfurt) |
| Brevo | e-mail notifications to customers | EU |
| BulkGate | SMS notifications to callers, if enabled by the customer (without call content) | EU; delivery via operators may involve third countries |
| Stripe | billing and payments (without callers' data) | EU / USA |
Some providers are headquartered outside the EU (USA). We have concluded the European Commission's standard contractual clauses with them or use their EU structures, and processing takes place in EU regions with regional restriction enabled. Transfers to third countries are possible only for SMS delivery via telecommunications operators and for payments via Stripe (EU–US Data Privacy Framework). You can request a copy of the safeguards via the contact in section 1.
We may also disclose data to our accounting service, legal advisers and state authorities where required by law.
6. Your rights
When Talk9 is the controller, you have the right of access to your data, rectification, erasure, restriction of processing, data portability and objection. You can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal. Send your request to the contact in section 1. We respond within one month. For more complex requests, we may extend this period by two months, in which case we will inform you.
When Talk9 is the processor (callers, section 4), address your request to the customer you called. We forward any request we receive to the customer within two working days.
If you believe that we process your data unlawfully, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
7. Website and cookies
The talk9.si website uses strictly necessary cookies that are required for it to function and for which consent is not required. We use analytics and marketing cookies only with your consent, which you give in the cookie settings and can change at any time.
| Cookie / tool | Purpose | Type | Duration |
|---|---|---|---|
| cookie_consent, cookie_consent_meta | stores your choice in the cookie settings | necessary | until you delete it in your browser |
| t9_form_abc, t9_form_ab_clanek | shows the same version of the inquiry form on your next visit | necessary, no personal data | until you delete it in your browser |
| sb-…-auth-token | login to internal access (employees only) | necessary | until logout |
| Lovable visit analytics | page view statistics; does not use cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors | cookie-free | – |
| PostHog (ph_…_posthog) | statistics of visits and clicks on the website | analytics, with consent | 12 months |
| Google Ads via Google Tag Manager (_gcl_au, _gcl_aw and Google advertising cookies) | measuring inquiries submitted from ads and remarketing to website visitors | marketing, with consent | up to 13 months |
The website's server logs (IP address, time, requested page, browser) are kept for 365 days to ensure security.
8. Security and changes to this policy
We protect data with encryption in transit and at rest, personal accounts with two-factor authentication, access restriction based on the principle of least privilege, logging of access to call content, separation of customer data, automatic deletion once retention periods expire and a written security incident response procedure. Our employees and subcontractors are bound by confidentiality and trained in the secure handling of data.
We may change this policy. The current version is always published on talk9.si with its effective date. We notify customers of material changes by e-mail.