Privacy policy

1. Data controller

The controller of your personal data is VINI CAPITAL, MB (company code 306644371, registered office Švyturio g. 20-14, LT-10212 Vilnius, Lithuania), trading as “kalba.ai”.

Data protection contact: Augustas Vinikas, augustas.vinikas@kalba.ai, tel. +370 612 08887. General contact: labas@kalba.ai. We have not appointed a data protection officer, as Article 37 GDPR does not require us to.

2. What data we collect

• First name, last name, email address, phone number (when you register, use a contact form or book a meeting)
• Company name and job title
• Phone numbers (for calling campaigns)
• The content of conversations with the AI voice agent “Aistė”, including demo conversations on the website (microphone audio is transmitted only once you start a conversation yourself and allow your browser to use the microphone)
• Call recordings and automatic transcripts (to provide the service and ensure its quality)
• Technical usage data (sessions, IP addresses, browser information)

3. Purposes and legal bases

• Website operation and security (error monitoring, protection against automated requests) - legitimate interest (Art. 6(1)(f) GDPR)
• Contact forms, registration, meeting bookings - entering into a contract and steps before a contract (Art. 6(1)(b) GDPR)
• Demo conversations with “Aistė” - providing a service you started (Art. 6(1)(b) GDPR)
• Optional marketing cookies (Meta Pixel) - consent (Art. 6(1)(a) GDPR); without consent, Meta Pixel is not loaded at all
• Calling campaigns and their quality assurance - legitimate interest (Art. 6(1)(f) GDPR), see section 4
• Compliance with legal obligations (e.g. accounting) - legal obligation (Art. 6(1)(c) GDPR)

4. Call recording and its legal basis

Calls made by the AI voice agent “Aistė” may be recorded and transcribed for quality assurance, service delivery and dispute resolution. We tell you about the recording at the start of the call.

We base call recording on our legitimate interest (Art. 6(1)(f) GDPR) in ensuring service quality and, in certain cases, on consent. We set the final legal basis for each campaign in light of the applicable law.

5. Automated processing and AI analysis

After a call ends, its recording and transcript may be analysed automatically with artificial intelligence tools (for example, for a call summary or a quality assessment). This analysis is automated processing.

We do not take decisions based solely on automated processing that produce legal or similarly significant effects for you within the meaning of Article 22 GDPR.

6. Recipients of data

We sign data processing agreements with our processors; they process data only on our instructions.

Services that run in your browser (they receive your IP address and technical browser data):

• Meta Pixel (Meta Platforms Ireland Ltd.) - marketing statistics; loaded only if you consent in the cookie banner
• Cloudflare Turnstile - protection against automated requests on public forms (a necessary security measure)
• Error and performance monitoring service - error events and page performance measurements; the data is received and stored in the European Union
• Voice technology service - the voice of the demo conversation; the session opens only when you start the conversation yourself; data may be processed in the USA
• Meeting booking service - booking a meeting time on the booking pages
• Content delivery networks - delivering the website's video and image content

On the server side, processors in the following categories may process data on our instructions (Article 13(1)(e) GDPR allows recipients to be named by category):

• Cloud database provider (Ireland, EU)
• Website hosting provider (Dublin, EU)
• Email delivery service (USA) - contact form messages and emails about meetings
• Meeting booking service (USA)
• Telephony and SMS operator (USA) - calls and messages (e.g. a booking link)
• Voice AI technology provider (USA)
• AI model providers (USA) - transcription of call recordings and conversation analysis
• Internal team communication platform (USA) - a notification to our team about a booked meeting: first name, meeting time, the name of the person hosting the meeting and the booking source. Phone number, email address, last name and company are not shared through this channel

We give the specific names and legal details of our processors on request (labas@kalba.ai), and business clients receive the full list of sub-processors, with processing locations and transfer mechanisms, as an annex to their contract.

7. Transfers outside the EEA

Some of the providers named in section 6 are US entities. When we transfer data outside the European Economic Area, we apply appropriate safeguards: the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) or, where the provider is certified, the EU-US Data Privacy Framework. Website hosting (Dublin), the main database (Ireland) and error monitoring (EU) operate within the European Union.

8. Cookies and similar technologies

On our website we use:

• cookie-consent (browser localStorage) - your cookie choice (“accept” / “decline”); necessary
• NEXT_LOCALE (cookie, valid for 1 year) - your language choice; functional
• cc-theme (localStorage) - your theme choice (light/dark); functional
• sentryReplaySession (sessionStorage) - an error monitoring session marker, used only to link an error record; it disappears when you close the browser tab
• sb-* (cookies) - the session of signed-in users; necessary
• Meta Pixel cookies (e.g. _fbp) - marketing statistics; set only if you consent. If you decline or make no choice, the Meta Pixel script is not loaded at all and no data is sent to Meta
• Third-party technologies - Cloudflare Turnstile and (on booking pages) the meeting booking service may use their own cookies or storage that they need in order to work

You can withdraw your consent by clearing the website's data in your browser (localStorage) or by writing to us at labas@kalba.ai.

9. Data retention

• Client relationship data - for the duration of the relationship and 3 years after the service contract ends
• Accounting documents - 10 years (legal obligation)
• Contact form messages are not stored in the database - they are delivered only to our mailbox

10. Your rights

Under the GDPR, you have the right to:

• Get information about the data we process and a copy of it
• Have inaccurate data corrected
• Have your data erased
• Restrict processing
• Data portability
• Object to processing for direct marketing and opt out of calls at any time
• Withdraw your consent where processing is based on consent

To exercise your rights, write to labas@kalba.ai (or augustas.vinikas@kalba.ai). You can also opt out of calls during the conversation by saying “remove me” - the number is added to the do-not-call list straight away.

11. Right to lodge a complaint

If you believe your data is not being processed properly, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI): L. Sapiegos g. 17, Vilnius, vdai.lrv.lt. We would be grateful if you contacted us first - we will try to resolve the matter directly.

12. Contact

For privacy questions, write to labas@kalba.ai. The rules for using our services are on the terms of use page.