Last Updated: October 9, 2026
Data Controller: Lokutor AI, registered in Spain.
Data Protection Officer: privacy@lokutor.com
This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Lokutor platform, APIs, and services ("Services"). We comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
When you register, we collect: name, email address, company name, role, and payment information (processed by Stripe). When you add funds, Stripe also collects the billing address and, if you give one, the tax ID needed to calculate tax on the payment; we keep the country, the tax ID and the amounts for our tax records.
Voice data you submit for processing (e.g., text-to-speech input, speech-to-text audio, voice agent conversations) is processed to deliver the requested Services. This may include your voice recordings, which could constitute biometric data under applicable law (Illinois BIPA, GDPR Art. 9, etc.).
We process voice data only as necessary to deliver the Services you request. We do not use voice data to identify or profile individuals.
Model training. We do not currently train or fine-tune models on customer voice data or conversations. We may do so in future for conversations on free accounts (accounts that have never added funds), in order to improve agent behaviour. If we do, we will say so here and give at least 30 days’ notice before it begins, and accounts that have added funds will remain excluded unless they opt in. We will not begin training on voice data without first establishing the lawful basis that voice data requires, which in the EU is a higher bar than ordinary personal data because voice can constitute biometric data under GDPR Article 9.
Speech APIs (TTS, STT, noise cancellation) process audio in-flight. The audio is not written to disk as a stored recording.
Voice Agent conversations, transcripts, and associated metadata may be stored for quality assurance, debugging, and evaluation purposes for up to 90 days, unless you request earlier deletion.
Recording of Voice Agent call audio is off unless enabled for that Agent. Where recording is enabled:
Free accounts. On free accounts (accounts that have never added funds), recording is enabled and cannot be disabled, and Lokutor personnel may listen to recordings to diagnose faults and improve the Services. For this specific purpose Lokutor acts as a controller rather than a processor, relying on legitimate interests (Art. 6(1)(f)) in operating and improving free use of the Services; the interest is disclosed here and on the call itself, access is restricted to personnel who need it, and the 90-day limit applies. After its first top-up, an account can disable recording entirely, in which case no call audio is written to disk at all. If you would rather no audio were retained, add funds and turn recording off.
We collect: API request logs (timestamps, endpoints, status codes, latency), character/minute counts for billing, IP addresses, browser/device information, and general usage analytics.
Documents and URLs you upload as knowledge base content for Voice Agents are stored and processed to enable retrieval during agent conversations.
We process personal data based on the following legal grounds under GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Providing and operating the Services (TTS, STT, Voice Agents, API) | Performance of a contract (Art. 6(1)(b)) |
| Processing voice/audio for real-time STT and TTS | Performance of a contract (Art. 6(1)(b)) |
| Recording calls on free accounts, and staff review of those recordings, to operate and improve free use | Legitimate interests (Art. 6(1)(f)) — disclosed on the call; avoidable by adding funds and turning recording off |
| Billing, the prepaid balance, payment processing and tax calculation | Performance of a contract (Art. 6(1)(b)) |
| Account management, security, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Service analytics and improvement | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance, regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Product updates and newsletters about Lokutor’s own services, sent to registered users | Legitimate interest (Art. 6(1)(f)) and Art. 21.2 of Spain’s LSSI (communications to existing customers about similar services); you can opt out at any time, see section 2.3 |
| Marketing communications to anyone who is not a registered user | Consent (Art. 6(1)(a)), opt-in only |
Under GDPR Article 9 and certain US state laws (including Illinois BIPA), voice data may be classified as biometric data. We process biometric voice data solely to deliver the Services (speech recognition and synthesis). We do not create permanent voice profiles or use voice data for identification/authentication purposes. We do not sell biometric data to third parties.
When you use Voice Agent phone features, you are responsible for compliance with applicable telecommunications laws, including:
If you register a Lokutor account, we may occasionally email you news about Lokutor’s own products and services, such as new models, languages, features and pricing changes. We only use your name and email address for this, and we send these emails through our email provider, Sender (see section 13).
You can stop them at any time, free of charge: every email contains a one-click unsubscribe link, and you can also write to privacy@lokutor.com. Unsubscribing does not affect your account or service emails such as billing receipts, security notices and password resets.
We share personal data with the following categories of recipients:
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
Our primary data processing occurs within the EU (AWS eu-west-1, Ireland). Certain data may be transferred to the United States for infrastructure management and third-party service providers. We rely on the following transfer mechanisms:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of Account + 30 days after deletion |
| Voice agent conversations & transcripts | 90 days (unless extended by you) |
| Call recordings (where recording is enabled) | 90 days, or sooner on request |
| API usage logs (for billing) | 12 months |
| Knowledge base documents | Duration of the associated Agent + 30 days |
| Payment records | 7 years (legal requirement) |
| Phone number records | Duration of number ownership + 30 days |
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under GDPR:
To exercise these rights, email privacy@lokutor.com. We will respond within 30 days.
If you are a California resident, you have additional rights under the CCPA/CPRA:
Residents of other US states (Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Texas, Iowa, Nebraska, Delaware) have similar rights. Contact privacy@lokutor.com to exercise them.
We implement appropriate technical and organizational measures to protect your personal data, including:
The Services are not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us immediately at privacy@lokutor.com.
The Services may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their privacy policies.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last Updated" date at the top indicates the latest revision.
Data Protection Officer: privacy@lokutor.com
General Inquiries: support@lokutor.com
Mail: Lokutor AI — Privacy Team
Spain (registered office address to be provided)
The following third-party sub-processors process data on our behalf:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting & compute, speech recognition and synthesis | All service data, including call audio | EU (Ireland) |
| Supabase | Database, authentication & file storage | Account data, agent configuration, transcripts, recordings, knowledge documents | EU (Frankfurt) |
| Stripe, Inc. | Payment processing | Payment details, billing info | USA |
| Telnyx | Telecom services | Phone numbers, call metadata | USA |
| Cerebras Systems | LLM inference (primary) | Transcripts and agent instructions (real-time) | USA |
| OpenRouter, routing to Wafer (DeepSeek-V4.1-Flash) | LLM inference (backup) and post-call summary & evaluation | Transcripts and agent instructions (real-time, zero data retention required) | USA |
| Groq | LLM inference (last-resort backup) | Transcripts (real-time) | USA |
| Google Cloud (Gemini) | Web search for agents that turn it on | Search queries | USA |
| Composio | CRM and calendar integrations you connect | Caller identifiers, call summaries and booking details sent to your connected tools | USA |
| Sender (UAB “Sender”) | Newsletter and product update emails | Name, email address, email engagement | EU (Lithuania) |
Sub-processors are updated periodically. Current list: https://lokutor.com/legal/sub-processors