Privacy policy

This policy explains how [Company legal name] (“we”) handles personal data on this website, in our panel and in the assistant we provide to businesses for their own websites.

Who is responsible

For this website and for your account in our panel, we are the controller:

[Company legal name]
[Street and number]
[Postcode and city]
[Country]

For conversations between a business’s website visitors and the assistant, the business that installed the assistant is the controller. We process those conversations on its behalf under our data processing agreement. If you chatted with the assistant on another company’s website, please contact that company first; we will help it answer your request.

You can reach us about privacy at privacy@lovaai.example.

What we collect on this website

• Server logs. When you open a page, our hosting provider records technical data such as your IP address, the time, the page and your browser. [REVIEW: hosting provider and log retention period]
• Analytics, only with your consent. If you allow it in the cookie banner, we measure visits with [REVIEW: analytics tools, e.g. Google Analytics 4, Microsoft Clarity]. Without consent, no analytics run. You can change your choice at any time with the cookie settings link at the bottom of every page.
• Our assistant on this website. If you use the chat window on this site, the section on conversations below applies, with us as the business.
• Messages you send us. If you email us, we use your message and address to reply.

Legal bases: our legitimate interest in running and securing the website (Art. 6(1)(f) GDPR) and, for analytics, your consent (Art. 6(1)(a) GDPR).

Your account in our panel

• Account data: your name, email address, company name, website address and the settings you make. Passwords are stored only as a salted hash.
• Billing: payments are handled by Polar, which acts as the seller and handles taxes. We receive your subscription status and billing contact, not your card details.
• Account emails: we send emails about your account, such as address confirmation, password resets and the end of your trial.
• Closing your account: you can close your account in the panel at any time. We then delete the account, your company’s assistant, its knowledge sources, conversations and leads.
• Abuse prevention: to stop misuse of free trials, we keep a keyed hash of the IP address used to sign up.

Legal bases: performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Conversations with the assistant

When a visitor uses the assistant on a website, we process the following on behalf of that website’s business:

• the messages of the conversation, and a short summary of it;
• in voice calls, the audio, which is turned into text in real time and is not recorded;
• the pages the visitor viewed during the visit and the pages the assistant opened;
• contact details the visitor chooses to give, such as a name, phone number or email address;
• if the visitor uses the contact form, a record of their consent: when it was given, the text shown, the business’s privacy link and the page;
• a random visitor ID kept in the visitor’s browser, and a keyed hash of the IP address used for rate limits.

The assistant runs on ElevenLabs, which provides the speech recognition and synthesis, the language model and the search over the business’s knowledge sources. ElevenLabs deletes conversation transcripts after 90 days. In our database, conversations, visits and leads are kept for the period the business chooses (between 3 and 36 months, 12 months unless it sets otherwise) and are then deleted automatically; a lead counts from its last change. The business can delete a single conversation or lead, or all data of one person, at any time; the copies at ElevenLabs are deleted as well.

Recipients and transfers

We use service providers to run the service; they are listed on our subprocessors page. Some of them are located outside the European Union, in particular in the United States. ElevenLabs processes conversations in the United States; it is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the EU standard contractual clauses, on which transfers to it rely. [REVIEW: basis for the other providers]

How long we keep data

• Account data: while your account exists, then [REVIEW: period] for legal and tax obligations.
• Server logs: [REVIEW: period].
• Conversations, visits and leads: the period the business chooses, 12 months unless it sets otherwise (see above).

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority. [REVIEW: competent authority for our seat]

To use these rights, write to privacy@lovaai.example.

Information for Türkiye (KVKK)

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), [Company legal name] is the data controller for the data described above for this website and our panel.

• Purposes and legal grounds: providing the service and performing the contract, fulfilling legal obligations, and our legitimate interests in security and abuse prevention (KVKK Art. 5).
• Transfers abroad: some service providers process data outside Türkiye, as described above. [REVIEW: legal ground for transfers abroad under KVKK Art. 9]
• Your rights (KVKK Art. 11): to learn whether your data is processed, to request information about it, to learn the purpose of processing, to know the recipients, to request correction or deletion, to object to results of automated analysis, and to claim compensation for damage caused by unlawful processing.

Applications can be sent to privacy@lovaai.example.

Changes

We update this policy when our processing changes. The date at the top shows the latest version.