Last Updated: August 20, 2026
Data Controller: Lokutor AI, registered in Spain.
Data Protection Officer: privacy@lokutor.com
This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Lokutor platform, APIs, and services ("Services"). We comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
When you register, we collect: name, email address, company name, role, and payment information (processed by Stripe).
Voice data you submit for processing (e.g., text-to-speech input, speech-to-text audio, voice agent conversations) is processed to deliver the requested Services. This may include your voice recordings, which could constitute biometric data under applicable law (Illinois BIPA, GDPR Art. 9, etc.).
We process voice data only as necessary to deliver the Services you request. We do not use voice data to identify or profile individuals.
Model training. We do not currently train or fine-tune models on customer voice data or conversations. We may do so in future for free-plan conversations, in order to improve agent behaviour. If we do, we will say so here and give at least 30 days’ notice before it begins, and paid plans will remain excluded unless they opt in. We will not begin training on voice data without first establishing the lawful basis that voice data requires, which in the EU is a higher bar than ordinary personal data because voice can constitute biometric data under GDPR Article 9.
Speech APIs (TTS, STT, noise cancellation) process audio in-flight. The audio is not written to disk as a stored recording.
Voice Agent conversations, transcripts, and associated metadata may be stored for quality assurance, debugging, and evaluation purposes for up to 90 days, unless you request earlier deletion.
Recording of Voice Agent call audio is off unless enabled for that Agent. Where recording is enabled:
Free plans. On free plans, recording is enabled and cannot be disabled, and Lokutor personnel may listen to recordings to diagnose faults and improve the Services. For this specific purpose Lokutor acts as a controller rather than a processor, relying on legitimate interests (Art. 6(1)(f)) in operating and improving a free tier; the interest is disclosed here and on the call itself, access is restricted to personnel who need it, and the 90-day limit applies. Any paid plan can disable recording entirely, in which case no call audio is written to disk at all. If you would rather no audio were retained, use a paid plan with recording off.
We collect: API request logs (timestamps, endpoints, status codes, latency), character/minute counts for billing, IP addresses, browser/device information, and general usage analytics.
Documents and URLs you upload as knowledge base content for Voice Agents are stored and processed to enable retrieval during agent conversations.
We process personal data based on the following legal grounds under GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Providing and operating the Services (TTS, STT, Voice Agents, API) | Performance of a contract (Art. 6(1)(b)) |
| Processing voice/audio for real-time STT and TTS | Performance of a contract (Art. 6(1)(b)) |
| Recording calls on free plans, and staff review of those recordings, to operate and improve the free tier | Legitimate interests (Art. 6(1)(f)) — disclosed on the call; avoidable by using a paid plan with recording off |
| Billing, subscription management, payment processing | Performance of a contract (Art. 6(1)(b)) |
| Account management, security, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Service analytics and improvement | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance, regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications (new features, newsletters) | Consent (Art. 6(1)(a)) — opt-in only |
Under GDPR Article 9 and certain US state laws (including Illinois BIPA), voice data may be classified as biometric data. We process biometric voice data solely to deliver the Services (speech recognition and synthesis). We do not create permanent voice profiles or use voice data for identification/authentication purposes. We do not sell biometric data to third parties.
When you use Voice Agent phone features, you are responsible for compliance with applicable telecommunications laws, including:
We share personal data with the following categories of recipients:
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
Our primary data processing occurs within the EU (AWS eu-west-1, Ireland). Certain data may be transferred to the United States for infrastructure management and third-party service providers. We rely on the following transfer mechanisms:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of Account + 30 days after deletion |
| Voice agent conversations & transcripts | 90 days (unless extended by you) |
| Call recordings (where recording is enabled) | 90 days, or sooner on request |
| API usage logs (for billing) | 12 months |
| Knowledge base documents | Duration of the associated Agent + 30 days |
| Payment records | 7 years (legal requirement) |
| Phone number records | Duration of number ownership + 30 days |
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under GDPR:
To exercise these rights, email privacy@lokutor.com. We will respond within 30 days.
If you are a California resident, you have additional rights under the CCPA/CPRA:
Residents of other US states (Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Texas, Iowa, Nebraska, Delaware) have similar rights. Contact privacy@lokutor.com to exercise them.
We implement appropriate technical and organizational measures to protect your personal data, including:
The Services are not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us immediately at privacy@lokutor.com.
The Services may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their privacy policies.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top indicates the latest revision.
Data Protection Officer: privacy@lokutor.com
General Inquiries: support@lokutor.com
Mail: Lokutor AI — Privacy Team
Spain (registered office address to be provided)
The following third-party sub-processors process data on our behalf:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting & compute | All service data | EU (Ireland, Paris) |
| Stripe, Inc. | Payment processing | Payment details, billing info | USA |
| Telnyx | Telecom services | Phone numbers, call metadata | USA |
| Groq | LLM inference | Transcripts (real-time, not stored) | USA |
| Google Cloud (Gemini) | LLM inference & evaluation | Transcripts (real-time) | USA |
| Vercel | Frontend hosting & analytics | Usage analytics, HTTP logs | USA |
Sub-processors are updated periodically. Current list: https://lokutor.com/legal/sub-processors