Privacy Policy

Spiiksi, a registered auxiliary business name of Maunu Group Oy (Business ID 2773843-5), is the controller of the personal data described in this Privacy Policy. For privacy-related questions, contact privacy@spiiksi.fi.

We collect the following categories of data: • Account information: name, email address, hashed password, or Google sign-in identifier • Usage information: event, channel, and interpretation session logs and usage data, and account activity such as sign-in times and acknowledgements of service notices • Audio data: during interpretation sessions, audio streams are processed in real time by OpenAI and Microsoft Azure. Event audio is not stored unless the customer specifically requests recording. • Recordings: sessions of the website demo are recorded (the source and interpreted audio, and technical data for investigating translation quality). The demo tells you about the recording before you use it. Event audio and its transcript are recorded only at the customer's request. • Contact and feedback: the name, email address and message you provide in the contact form or in demo feedback. You can choose to attach the recording of that demo to your feedback. • Help chat: the questions you ask the help assistant on the site and its answers. They are sent to OpenAI to produce the answers. When you are signed in, the assistant can read your own account details (organizations, balances, plans and events) to answer you, but cannot change anything. Chats may be saved to improve the assistant and our help content; a saved chat is linked to your account if you were signed in. • Technical information: IP address, browser type, device type, operating system, and consent settings • Payment information: billing and payment details are handled by Stripe and PayPal. We do not store payment card details • Sign in with Apple: if you sign in with Apple in the iOS app, the identifier Apple gives us and the email address you choose to share • Messages and calls: in chats, customer support chats and calls, the text you write, the voice messages, images and files you send, transcripts of what is spoken, and their translations into each participant's language. Call audio is interpreted in real time and is not recorded. • Phone contacts: only when you choose to import contacts from your phone, the names, phone numbers and email addresses in your address book are copied to your Spiiksi contact list • Custom voices: an organization can record a speaker reading a consent statement and 10–30 seconds of their speech. The recording is sent to Google, which makes and stores a voice that only that organization's events can use. This is done only with the speaker's consent. • Mobile app: a push notification token for your device. The camera is used only to read QR codes on your device and the microphone only while you speak; neither is recorded unless you send a voice message.

We use your data for the following purposes: • To provide and maintain the Service • To manage user accounts • To deliver interpretation features through AI models • To handle billing and payment processing • To provide customer support and service communications • To monitor, improve, and develop the Service, including reviewing demo recordings to improve translation quality • To respond to inquiries and feedback • To measure site usage and marketing effectiveness where you have given consent • To answer questions in the help chat and, where chats are saved, to review them to improve the assistant and our help content • To deliver messages, translations and notifications • To comply with legal obligations

We process personal data on the following GDPR bases: • Performance of a contract: account management and service delivery • Legitimate interests: service security, fraud prevention, product improvement (including demo recordings), and responding to inquiries • Legal obligation: accounting, tax, and reporting requirements • Consent: optional analytics, advertising-related measurement, and marketing communications where you have given consent When we record event audio at a customer's request, we process it on the customer's behalf as a processor, and the customer is responsible for informing the event's participants. A custom voice is made only with the explicit consent of the speaker whose voice it is. In customer support chats we process the customer's messages on behalf of the organization that serves them.

We use the following service providers to operate the Service: • OpenAI – real-time speech recognition, translation and speech synthesis, transcription of recordings, and the help assistant's answers • Microsoft Azure – speech recognition and speech synthesis • Stripe – payment processing • PayPal – payment processing • Google OAuth – sign-in with a Google account (optional) • Google reCAPTCHA – protecting forms against spam and abuse • Google Analytics / Google tag – website analytics and advertising-related measurement where you have given consent • Google Gemini – speech synthesis and organizations' custom voices • Mistral AI – speech recognition, translation and speech synthesis in some interpretation engines • Apple – Sign in with Apple (optional) and push notifications on iOS • Expo (650 Industries) and Google Firebase Cloud Messaging – delivering push notifications to the mobile app • Integrations an organization connects itself (for example Twilio, SIP, Microsoft Teams or Planning Center) – data passes through them under the organization's own agreement with that provider We send email through our own email service (Maunu Group Oy). We disclose data to these providers only to the extent necessary to provide the Service. We do not sell personal data to third parties.

We retain personal data for as long as your customer relationship or user account remains active, or as otherwise needed to provide the Service. After account deletion, we remove your data within 30 days unless legislation requires a longer retention period. • Demo recordings: 90 days. A recording attached to feedback is kept as long as the feedback. • Help chats: 90 days after the last message. • Event recordings: until the customer deletes them or asks us to, and no longer than 12 months after the event unless agreed otherwise with the customer. • Contact and feedback messages: 24 months after the last correspondence. • Accounting records: as required by the Finnish Accounting Act, vouchers for 6 years and financial statements for 10 years from the end of the financial year. • Customer support chats: 30 days, or the period the organization sets • Other chats and their attachments: until the conversation or your account is deleted, or for the period set for that conversation • Imported contacts: until you remove them or delete your account • Custom voices: until the organization deletes the voice or its account

Under GDPR, you have the right to: • Access your personal data • Correct inaccurate or incomplete data • Request erasure of your data • Restrict processing • Receive your data in a portable format where applicable • Object to processing based on legitimate interests You can submit requests to privacy@spiiksi.fi. We aim to respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi).

We protect personal data with appropriate technical and organizational safeguards. These include HTTPS encryption for data in transit, bcrypt password hashing, JWT-based authentication, role-based access control, and regular security reviews.

We use browser local storage and, where needed, technically necessary cookies to manage authentication and sessions. If you arrive through an invite link, we store that link's referral code in a strictly necessary spiiksi-ref cookie for up to 30 days so the code is ready on the signup form. It is used only to credit the referral, is never shared with third parties or used for tracking, and is deleted as soon as the account is created. In addition, we use Google tag identifiers for analytics and advertising-related measurement only if you have given consent. You can accept or reject these optional purposes in the consent banner. We also count page views, daily visitors and how long pages are on screen on our own server without cookies or anything else stored in your browser. A visitor is recognised for one day only, by a hash of their IP address and browser identifier combined with a random value that changes every day and is then discarded. The IP address is not stored. Totals (page views and time on screen per page, and visitors per day) are kept for up to about a year. In addition, for 30 days we keep the course of each visit under an identifier derived from that hash: where the visit came from (for example a search engine, social media or a campaign link, without the full referring address), which pages were viewed and for how long, on blog posts which sections were read for how long and which links were clicked, the device type, browser and operating system, the site address (spiiksi.fi or spiiksi.com), the approximate location (country and city) derived from the IP address, and whether a demo was started or a message was sent. The content of a message and any contact details are not linked to the visit. Because the random value changes daily, visits on different days cannot be linked to the same visitor. This is based on our legitimate interest in understanding how the Service is used. The mobile app keeps your sign-in in the device's secure storage and your settings, such as your language, on the device. They are removed when you sign out or delete the app.

We will notify you of material changes by email or through the Service at least 14 days before they take effect. If you continue using the Service after the changes become effective, we will treat that as acceptance of the updated policy.

Privacy-related inquiries: privacy@spiiksi.fi