Privacy Policy

1. Who we are and how to contact us

The controller responsible for this policy is Dialogis.ai s.r.o., ID No. 23985348, Sokolská 1883/8, Nové Město, 120 00 Prague 2, Czech Republic ("Dialogis", "we", "us").

Privacy contact: hello@dialogislabs.com (please use the subject "Privacy"). Postal address as above; Czech data box (datová schránka) w933rn4. We have not appointed a data protection officer because we are not required to; our privacy contact fulfils that role.

2. Who this policy is for

This policy covers three groups of people. Our role, and therefore who you should contact about your data, depends on which group you are in.

Terms with a capital letter (Customer, Mind, Operator, End User, Knowledge Sources, Conversation Data and so on) have the meaning given in the Terms of Use.

If you are an End User, the Operator of the Mind decides why and how your conversation is processed. Their name appears in the chat or on the page or profile that hosts it. Direct requests about your conversation to them first; you can also contact us and we will pass the request on and help. Our User Data Deletion page explains the steps.

This policy does not cover the separate consumer mobile app published under the Dialogis name, which has its own notice, nor the websites of Operators that embed a Mind.

3. Personal data we process

3.1 If you are a Customer or Authorised User

• Account and identity data: name, email address, password hash or Google account identifier, language, role in the workspace, workspace and business name, and acceptance records for the Terms (version and time).
• Trial data, if you build a trial Mind: the name and tagline you give it, the text you paste and the documents or audio recording you upload (the recording is transcribed and used only to learn how you write and speak), the questions you ask it, the number of answers used, your language, the time you accepted the Terms, the result of the bot check (Section 5.4) and a one-way hash of your IP address kept for 26 hours to enforce the daily limit on trials. A random token in your browser links you to your trial until you save it into a workspace. Once you save it, the original material is removed from the trial record; what the Mind learned stays in your workspace.
• Workspace and usage data: the Minds you create, their configuration, publishing settings, connected Channels and integrations (stored credentials, including calendar and CRM tokens, are encrypted), actions you take in the platform, usage against plan limits, analytics about your Minds' conversations, and product analytics: which steps you complete in the admin platform (for example creating a Mind or publishing a page) recorded with your workspace identifier, role and plan, never with your name or email (Section 13).
• Billing data: your plan and subscription history, payment status and the identifier Stripe assigns to you as its customer. Paid plans are sold by Stripe as merchant of record (Terms, Section 4.4): your billing address, tax details and payment method are collected and held by Stripe, which issues the invoice; card details never reach us.
• Support and communication data: emails and messages you exchange with us, and notices we send you.
• Notification tokens: if you allow notifications in the admin platform or a mobile app, the push token your browser or device issues, so we can alert you (for example when an answer is waiting for your review).
• Technical data: IP address, browser and device information, timestamps, session identifiers, security and error logs.
• Voice Consent records if you request a Voice Clone: the signed consent and recording metadata for the person whose voice is cloned.

3.2 If you are an End User of a Mind

Depending on how the Operator configured the Mind:

• the content of your messages and the Mind's answers, and the conversation history;
• voice: audio you speak or send, its transcript, and synthetic voice answers; for voice calls, the transcript, duration and status of the call;
• booking details, if you book a meeting through a Mind: the name, email address and time zone you give, the time you choose and the booking reference;
• contact and request details you choose to give (name, email, phone, company, what you need), and the record of the notice you were shown and whether you agreed to be contacted;
• channel identifiers needed to deliver messages: a session identifier on the web, or your Telegram user ID and username, WhatsApp phone number and profile name, or Instagram account ID and username;
• attachments you send (images, documents, voice messages);
• technical data: IP address (web only), browser and device information, page URL where the widget is embedded, timestamps, diagnostics and security logs;
• human handoff data: the conversation and details passed to the Operator's staff when a person joins;
• consent records: the version of the terms in force when you accepted them or continued the conversation, and when;
• review topic, where the Operator has switched on answer review: the sensitive topic (defined by the Operator) that caused an answer to be held, stored with that answer.

3.3 If you visit our websites or contact us

• Technical data your browser sends (IP address, user agent, pages requested, referrer) recorded in server and content-delivery logs;
• your language preference, stored in your browser;
• what you send us through forms (for example a request to access a Mind: name, email and an optional link) or by email;
• for a small sample of visits to our public website, where on the page you clicked and how far you scrolled, shown only as a heat map aggregated over many visits.

We do not use advertising or tracking cookies on our websites, and our website measurement sets no cookies and stores nothing on your device. See the Cookie & Storage Notice.

3.4 Data we receive from other sources

• Knowledge Sources uploaded by Customers may contain personal data about other people: the expert's own posts, talks and documents, and sometimes the names of clients, colleagues or people quoted. The Customer is responsible for having the right to use that material (Terms, Section 5.3). We process it only to build and run that Customer's Minds.
• Public web pages and social-media posts that a Customer asks us to import (for example the expert's own LinkedIn posts) are fetched through crawling services on the Customer's instruction.
• Channel providers (Telegram, Meta for WhatsApp and Instagram) send us the identifiers and message content described in Section 3.2 when you message a Mind. Telegram also carries the Knowledge Sources a Customer uploads through our Telegram knowledge bot, where the Customer has enabled it.
• Calendar services (currently Cal.com), where an Operator has connected one, send us the status and reference of bookings made through a Mind.
• Google, if a Customer signs in with a Google account, sends us the name, email address and account identifier.
• Stripe, as merchant of record, sends us the status of your subscription and payments and the customer identifier it assigned to you; it keeps your billing details itself.

We do not buy personal data from data brokers and do not enrich profiles from third-party sources.

4. Why we process personal data and on what legal basis

4.1 Where Dialogis is the controller

Where we rely on legitimate interests we have balanced them against your interests and rights, and you may object at any time (Section 11).

4.2 Where the Operator is the controller

For the content of conversations we act as the Operator's processor. That includes the review of an Operator's conversations when the Operator asks us to help improve its Mind, and the automated screening described in Section 5.4; we do not use conversation content for our own purposes beyond the security, abuse-prevention and legal purposes in Section 4.1.

Operators typically process End-User conversations to answer questions, provide support, generate leads, book meetings and improve their Mind. The Operator chooses the legal basis, usually performance of a contract or steps before one, legitimate interests, or consent (for example for passing your contact details to sales or for marketing). The Platform helps Operators comply by showing an AI disclosure and these documents before the first message, by recording consent for contact capture, and by supporting deletion requests. If you have questions about an Operator's purposes, ask the Operator.

4.3 What you have to provide

To create an account you must give an email address and either a password or a Google account; without them we cannot open a workspace. To buy a paid plan you must give the merchant of record the billing details it needs; without them the purchase cannot be completed. To build a trial Mind you must provide some material of your own and pass the bot check; nothing else is required and you may stay anonymous until you save the Mind. Everything else (name, workspace name, voice, channels, integrations, notifications) is optional and only used for the feature you turn on. End Users decide themselves what to write to a Mind; the only thing a Mind needs is the message itself.

5. AI processing

5.1 How a Mind answers

When you send a message, the Platform retrieves the most relevant passages from the Mind's Knowledge Sources, combines them with the Mind's persona instructions and recent conversation history, and sends that package to a third-party large language model, which generates the answer. For voice, a speech-to-text provider transcribes what you said and a text-to-speech provider reads the answer aloud. During ingestion, Knowledge Sources are transcribed (audio and video), read (web pages), OCR-processed (scanned documents), summarised and converted into vector embeddings so they can be searched.

5.2 Which providers see what

The providers currently used are listed with their location and role on our Sub-processor List. In summary: Google Cloud hosts everything in Frankfurt and provides embeddings, the sensitive-topic check in Section 5.4 and, where configured, Gemini models; OpenAI and Google provide the language models that generate answers; ElevenLabs provides speech-to-text, text-to-speech, real-time voice calls and voice clones; Mistral provides OCR; Apify and Jina fetch web pages and public posts on the Customer's instruction; Cloudflare runs the bot check when a trial Mind is built. Each provider receives only the data needed for its task.

5.3 No training on your data

We do not use Customer Content, conversations or Outputs to train or fine-tune general-purpose AI models. Our providers process your data only to return a result to us and are contractually prohibited from using it to train their models. They keep inputs and outputs only as long as their data-processing terms allow for abuse monitoring and operating the service (for OpenAI, up to 30 days); the voice provider keeps voice-call audio and transcripts in our account under its terms, and we delete them as described in Section 9.

5.4 Automated checks, and no automated decisions with legal effects

A Mind provides information and assistance. Neither we nor the Platform make decisions about you based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR). Operators are contractually prohibited from using Minds for such decisions and for any use listed in Annex III of the AI Act.

Some automated checks do run, none of them with such effects: a bot check (Cloudflare Turnstile) when a trial Mind is built, which looks at technical signals from your browser to tell people from scripts; rate limits and a daily limit on trials per visitor (based on a hash of the IP address); the safety systems of our model providers, which may refuse to generate certain content; and, where the Operator has turned it on, an answer review: a language model classifies whether your question touches a sensitive topic, and if so the Mind's answer is held, for up to 24 hours, until the Operator approves, edits or discards it. You are told in the chat when an answer is being held. The classifier sees your question and the Mind's draft answer only; the topic it matched is stored with the held answer so that the Operator can see why it was held; it decides nothing about you.

5.5 Transparency under the AI Act

Every Mind discloses that it is an AI at the start of a conversation and labels synthetic voice. Our AI Transparency Notice describes the system, its limitations, the models used and human oversight.

6. Voice data and voice clones

• Speech recognition: audio you speak is sent to the speech-to-text provider to be transcribed. Streamed web audio is not stored by us beyond the transcript; voice messages sent on messaging channels are stored with the conversation together with their transcript.
• Voice calls: where a Mind offers a voice call, your speech is streamed in real time to our voice provider (ElevenLabs), which transcribes it, generates the answers with our platform and speaks them back. Calls are limited to 10 minutes. After the call we store its transcript, duration and status with the conversation; the provider keeps the call audio and transcript in our account under its data-processing terms until we delete them.
• Synthetic voice: answers may be read out by a stock synthetic voice or, where the Operator has a Voice Clone, by a voice modelled on the expert. It is always disclosed as AI-generated.
• Voice Clones: we create a Voice Clone only on a Customer's request and only with the explicit, written consent of the person whose voice is recorded. The recordings and the resulting voice model are stored with our voice provider and used only for that Customer's Minds. The person may withdraw consent at any time by contacting the Customer or us; we delete the clone within 30 days of withdrawal, of the Customer's request, or of the end of the Customer's contract.
• No identification by voice: we do not create voiceprints to identify or authenticate people, and voice data is never used to recognise who is speaking.

7. Who we share personal data with

• Sub-processors that host and operate the Platform on our behalf under written data-processing terms: cloud hosting, identity provider, AI model, speech and OCR providers, web-fetching services, bot protection, push notifications and our business email. The current list, with locations and safeguards, is at dialogislabs.com/legal/subprocessors. We notify Customers at least 30 days before adding a sub-processor.
• Operators: if you are an End User, the Operator of the Mind and its team receive your conversation, contact details and consent records.
• Channel providers: Telegram, and Meta for WhatsApp and Instagram, transport your messages under their own terms and privacy policies, which apply independently of ours.
• Integrations chosen by the Operator: CRM systems and webhooks the Operator connects (for example HubSpot, Pipedrive, Raynet, Flowii, GramCRM or AutoCRM) and calendar services for bookings (currently Cal.com). Data is sent there only as the Operator configures and with the notice or consent described in Section 4.2.
• Merchant of record: Stripe sells paid plans in its own name (Terms, Section 4.4) and is an independent controller of the purchase and payment data you give it at checkout; its privacy policy applies to that. We receive subscription and payment status.
• Professional advisers and authorities: lawyers, accountants and auditors under confidentiality; courts and authorities where the law requires or allows it, including under Section 19 of the Terms of Use.
• Business transfers: if we merge with, are acquired by, or transfer our assets to another company, personal data may be transferred to the successor, who will be bound by this policy.

We do not sell personal data and do not share it with advertisers.

8. International transfers

The Platform is hosted in the European Union (Google Cloud, europe-west3, Frankfurt, Germany), and our identity and email providers run in the EU (Amazon Web Services, Stockholm and Ireland). Some providers process data in the United States: OpenAI (language models), ElevenLabs (speech and voice), Google LLC (Gemini API and push notifications), Cloudflare (bot check), Stripe (payments) and Amazon Web Services (for support access to EU-hosted services). Calendar services an Operator connects (Cal.com, USA) receive booking details on the Operator's instruction. For those transfers we rely on:

• the EU-U.S. Data Privacy Framework where the provider is certified under it (Commission adequacy decision of 10 July 2023); and
• the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), supplemented where necessary by additional measures such as encryption and data minimisation.

The mechanism used for each provider is stated in the Sub-processor List. The adequacy decision behind the Data Privacy Framework was upheld by the General Court on 3 September 2025 (Latombe v Commission, T-553/23) and is under appeal before the Court of Justice (C-703/25 P); with every provider for which we cite the Framework we also have Standard Contractual Clauses in place, so the transfers remain covered if the Framework is invalidated. You can request a copy of the relevant safeguards at hello@dialogislabs.com.

Messaging channels are different, because you choose them. When you talk to a Mind on WhatsApp or Instagram, Meta Platforms Ireland Ltd processes your messages under its own terms; its transfers to the United States rely on the Data Privacy Framework and SCCs. Telegram is established in the United Arab Emirates, which has no EU adequacy decision, and does not offer Standard Contractual Clauses. When you talk to a Mind on Telegram, your messages and the Mind's replies are necessarily exchanged with Telegram, because that is the service you are using to hold the conversation; the transfer is necessary to perform the conversation you asked for (Article 49(1)(b) GDPR), and the Operator who connects Telegram accepts it as controller. We send Telegram nothing beyond the conversation itself and what is needed to deliver it.

9. How long we keep personal data

When a retention period ends, we delete or anonymise the data, unless we must keep it to establish, exercise or defend legal claims, in which case it is isolated and kept only for that purpose.

10. Security

We protect personal data with technical and organisational measures that include: hosting in certified EU data centres; bot protection on the trial builder; encryption in transit (TLS) and at rest; encrypted storage of integration credentials and tokens; role-based access control and least-privilege access for our staff; separate production, staging and development environments; logging and monitoring of security events; automated backups; regular dependency updates; and confidentiality obligations for everyone who works with us. Annex 2 of the Data Processing Agreement describes the measures in more detail.

If a personal-data breach affects you, we will notify the competent supervisory authority within 72 hours where required and inform you without undue delay where the breach is likely to result in a high risk to you. Where we act as a processor, we notify the Operator within 48 hours of becoming aware so that they can meet their own obligations.

No online service is completely secure. Please do not share passwords, payment card numbers or other sensitive information in a chat, and keep your own sign-in credentials safe.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten") where there is no overriding reason to keep it;
• restrict processing in the situations set out in Article 18 GDPR;
• data portability: receive data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

How to exercise them. Email hello@dialogislabs.com with the subject "Privacy", or write to our postal address. Customers can also manage much of their data directly in the platform (edit the workspace, delete Minds, Knowledge Sources and conversations, disconnect channels). The User Data Deletion page gives step-by-step instructions. We may ask you to confirm your identity, for example by writing from the email address linked to the account or the channel you used. We respond within one month; for complex or numerous requests we may extend by two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive.

If we are a processor. Where your request concerns a conversation with a Mind, the Operator is the controller. We will forward your request to the Operator, inform you that we have done so, and act on the Operator's instruction or, where the Operator cannot be reached, delete the data ourselves within 30 days as the Terms of Use allow.

Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live or work or where the alleged infringement occurred. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. We would appreciate the chance to address your concern first.

12. Children

The Dialogis platform is for adults. Minds must not be directed at children under 16 (under 15 in the Czech Republic) unless the Operator has told us and implemented the protections the law requires. If you believe a child has provided personal data through a Mind, contact the Operator or us and we will delete it.

13. Cookies and browser storage

Our websites, the admin platform, the chat widget and hosted pages use only strictly necessary cookies and browser storage (sign-in sessions, security tokens, your language choice, the token that links you to your trial Mind, the storage our push-notification library needs if you allow notifications, and the chat session so a conversation can continue). We use no advertising or social-media tracking technologies. Hosted Mind pages, the chat widget and the Telegram voice mini-app load their fonts and code libraries from our own domains as well; the only third-party resources that load anywhere, each strictly necessary (bot check, checkout, push notifications), are named in the Cookie & Storage Notice.

We measure how our public websites are used with analytics software we host ourselves. It sets no cookies, stores nothing on your device, keeps no IP addresses and cannot recognise a visitor across days; the result is statistics, not personal data. In the admin platform the same software additionally records which product steps you complete together with your workspace identifier, role and plan. Because the workspace identifier can be linked to you, that is pseudonymous personal data, processed on the basis of our legitimate interest in seeing where customers get stuck (Article 6(1)(f)); you can object by emailing us or, where your browser still offers the setting, by switching on its Do Not Track signal, which stops the measurement entirely. Details are in the Cookie & Storage Notice.

14. Marketing communications

We may send existing customers occasional emails about new features, plans and events, relying on the existing-customer exception in Czech Act No. 480/2004 Coll. and Article 13 of the ePrivacy Directive. Every such email includes an unsubscribe link, and you can also opt out by emailing us. We do not send marketing to End Users of Minds; any marketing by an Operator is the Operator's responsibility and requires the opt-in the law demands.

15. Changes to this policy

We will update this policy when the service, our providers or the law change. The version and effective date appear at the top of the page, and previous versions are listed at dialogislabs.com/legal. For material changes we will notify Customers by email and in the platform at least 30 days in advance where the change affects them adversely.

16. Contact

Dialogis.ai s.r.o. · Sokolská 1883/8, Nové Město, 120 00 Prague 2, Czech Republic · ID No. 23985348 · Data box w933rn4 Privacy requests: hello@dialogislabs.com (subject "Privacy") Deletion instructions: dialogislabs.com/privacy/data-deletion WhatsApp-specific notice for Operators' chatbots: dialogislabs.com/privacy/whatsapp