Privacy Policy

1Data Controller

Dirivian B.V. is the data controller for the processing of personal data as described in this policy.

2Contact Details

For questions about your personal data or this privacy policy, please contact us via:

• Email: privacy@voicehelden.nl (or: info@voicehelden.nl)

3What Personal Data We Collect

We only collect personal data that is necessary for the purposes described below, including but not limited to:

• Identity and contact data (such as name, email address, phone number)
• Technical data (such as IP address, browser type, operating system)
• Usage data (such as pages visited, time on site, click behaviour)
• Transaction data when you make purchases (such as payment details and invoice data)

4Purposes and Legal Bases

We process personal data for clearly defined purposes and on the basis of a legal ground, for example:

• Performance of a contract (e.g. service delivery, orders)
• Partner applications: assessing your application as a partner and contacting you about it, as a step taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Data from the partner form is stored in our CRM (HighLevel).
• Legal obligations (e.g. statutory retention requirements)
• Legitimate interest (e.g. improving the website, analytical purposes, fraud prevention)
• Consent (e.g. marketing communications, where you have given explicit consent)

5Cookies and Tracking

We use cookies and similar technologies for functional, analytical and marketing purposes. Functional technologies are needed to make the website work and to remember your cookie choice; we always use those. Everything beyond that loads only after you click “Accept all” in the cookie banner. If you choose “Essential only”, none of the items below load, now or later.

After your consent we load:

• PostHog — product analytics: which pages and buttons visitors use. The data is held on servers in the European Union.
• OpenAI Ads measurement pixel (OpenAI, L.L.C., United States) — to measure whether our ads in ChatGPT lead to a sign-up or an enquiry. OpenAI receives your IP address, details about your browser and device, the page you are viewing and the event you trigger: a page view, a click on “Try 30 days free”, or the submission of the call-back form or the partner form. We do not pass on your name, email address or phone number this way. OpenAI decides for itself how it uses this data further; see the OpenAI privacy policy.
• Google Tag Manager (Google) — the tag manager we use to load measurement scripts on the pages of our site that still run on our older technology.

The legal basis for this is your consent (Article 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act). You can withdraw that consent at any time through the cookie preferences at the bottom of every page, where you make a new choice. Withdrawal applies going forward and does not affect what has already been measured. The transfer to OpenAI falls under International Transfers.

6Retention Periods

We do not retain personal data longer than necessary for the purpose for which it was collected, unless legislation requires longer periods. General guidelines:

• Transaction and invoice data: up to 7 years (statutory retention requirement)
• Log files and analytics: generally up to 12 months
• Contact and service requests: as long as needed for handling and complaints
• Partner applications: as long as needed to assess and follow up the application; if no partner agreement is concluded, we delete the application afterwards

7Third-Party Processors

We may share personal data with processors who perform services on our behalf, such as hosting providers, payment processors, email services, our CRM (HighLevel, for enquiries and partner applications made through the website) and Koalendar (for scheduling a demo or a partner introduction; the calendar sits as a widget on our demo page and receives the name, email address and time slot you enter there). We enter into data processing agreements and take appropriate measures to protect your data.

8International Transfers

When using international service providers, data may be transferred outside the EU/EEA. In that case we apply appropriate safeguards, such as standard contractual clauses or other legal safeguards.

In practice this concerns the United States: Google LLC and OpenAI, L.L.C. for the AI services in section 10, and — only if you consent to it — OpenAI, L.L.C. for the measurement pixel in section 5. For those transfers we rely on the European Commission’s standard contractual clauses or, where the recipient is certified under it, on the EU‑US Data Privacy Framework.

9Security Measures

We take appropriate technical and organisational measures to protect personal data and Google user data against unauthorised access, disclosure, alteration, loss, or destruction.

We protect sensitive data using appropriate security measures, including encryption during transmission and encryption at rest, access controls, authentication and authorisation mechanisms, secure storage, and regular monitoring and security reviews.

Access to personal data and Google user data is limited to authorised personnel and service providers who need such access to provide and maintain our services. We do not sell Google user data or use it for advertising purposes.

OAuth access tokens and other authentication credentials are stored securely and are protected against unauthorised access. When access to a user's Google account is no longer required, we revoke the applicable access and delete the associated credentials in accordance with our retention and deletion practices.

We regularly review and update our technical and organisational security measures to protect the confidentiality, integrity, and availability of user data.

10AI Processing and Google User Data

Our assistant uses AI to hold conversations, summarise messages and draft replies. We do not develop, host or train any AI or ML model of our own, and we do not fine-tune any model on your data. We use hosted third-party AI services only, called server-to-server from our own environment:

• Google LLC — Gemini API, for the assistant's speech and text processing
• OpenAI, L.L.C. — API platform, for drafting suggested replies in our email channel

We hold a paid API account with both providers. Under the terms of both providers, inputs to and outputs from paid APIs are not used to train or improve their models.

Google user data is never used for AI training. Information we receive through Google APIs, including Google Calendar data, is not used to develop, improve or train any AI or ML model, whether generalised or personalised. We do not sell this data and we do not use it for advertising.

When the assistant needs to know whether a time slot is available, it receives only the derived availability for the requested window: the start and end times of busy blocks. The content of calendar entries — titles, descriptions, locations and attendees — never leaves our environment and is never presented to an AI model.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: "VoiceHelden's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

11Rights of Data Subjects

You have rights regarding your personal data, including the right of access, rectification, erasure, restriction of processing, objection and data portability. You may also withdraw your consent where processing is based on consent. For mobile messages you can opt out by replying "STOP". To exercise your rights, contact us via the details above.

12Automated Decision-Making

We do not carry out automated decision-making that produces legal effects or similarly significantly affects you. If we do make automated decisions, we will inform you clearly and, where required, provide appropriate safeguards.

13Complaint to the Supervisory Authority

If you believe we are not handling your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority: www.autoriteitpersoonsgegevens.nl.