Privacy policy – Cephor conversational assistant

1. Who is this policy for?

You are visiting a website that includes a Cephor conversational assistant (a chat window or a voice assistant). This policy explains how your personal data is processed when you use that assistant.

The assistant is technology provided by Revowind SRL (the Cephor brand). The site you are visiting may have its own privacy policy for other data collected on that site; please read that policy as well.

2. Controller

Revowind SRL acts as controller for data collected through use of the Cephor assistant (conversations and technical data linked to that use). The owner of the site you are visiting remains responsible for any other processing it carries out on its site.

3. Data collected when you use the assistant

When you open the assistant, start a conversation (text or voice) or place a phone call through the number offered, we may process the following data:

3.1 Technical data collected automatically

• IP address: recorded on the server for the session (security and proper operation of the service).
• Device type: an indication of “mobile” or “desktop”, so the experience can be adapted.
• User-Agent: the string sent by your browser (browser type and version, operating system).
• Optional metadata: browser language, time zone, screen resolution and the page from which you opened the assistant (referrer), when the embedded component sends that information.

3.2 Conversation data

• Text conversations: the messages you type and the replies generated by the assistant (content, date and time).
• Voice conversations: when you use voice mode (on the site or by phone), the audio of the conversation may be processed so replies can be given in real time and, where relevant, so the conversation can be transcribed or analysed.
• Phone number: if you call the number shown by the assistant, the number you call from may be recorded to handle the call and so the site owner can bill the service.

3.3 What we do not collect through the assistant

We do not deliberately collect, through this component, special-category data (health, racial or ethnic origin, political opinions, and so on) or browsing data outside the use of the assistant itself. Please do not share special-category data in the conversation.

4. Purposes and legal bases

Your data is processed for the following purposes, on the legal bases indicated (Regulation (EU) 2016/679 – GDPR):

Where the law requires it, or where the site you are visiting has a consent mechanism for the assistant, processing may rely on your consent (Art. 6.1.a GDPR).

5. Processors and technologies used

To run the assistant (hosting of the component, servers, voice, artificial intelligence, telephony), we rely on technical providers. Under Article 28 GDPR, contractual safeguards (processing agreements, standard clauses, and so on) are in place. Data may pass through or be processed by the following parties:

5.1 Hosting and infrastructure

• Google Cloud Platform (GCP): backend servers and file hosting (CDN) used to load the assistant component.
• Vercel Inc.: hosting of the Cephor site (cephor.io) on which this policy is published.
• Supabase Inc.: databases that store conversation metadata and the associated technical data.

5.2 Telephony

• Twilio Inc.: handling of phone calls (routing, numbers). Call data (numbers, duration) is processed by Twilio under its own terms and our contract.

5.3 Voice and artificial intelligence

• ElevenLabs Inc.: speech synthesis and voice conversational agents (recognition and generation of the voice).
• OpenAI LP: natural-language processing to understand questions and generate text replies.
• Anthropic PBC: artificial-intelligence models (Claude) used to process conversations.

5.4 Technical monitoring

• Sentry (Functional Software Inc.): error detection and performance monitoring of the application. It may receive technical data (browser, system, IP address) when an incident occurs, so we can fix the fault.

This list may change. Transfers of data outside the European Economic Area (EEA) are covered by the European Commission’s Standard Contractual Clauses (SCCs) or, where applicable, by the EU-US Data Privacy Framework for certified providers.

6. Retention

We keep data linked to your use of the assistant only for as long as the purposes described above require:

• Conversation content (transcripts, voice recordings): as a rule, no more than 90 days from the conversation, unless a legal obligation applies or the site owner has configured a shorter period.
• Technical data (IP, user-agent, metadata): for the same period as the conversation it relates to, or less if the service configuration allows it.
• Data needed for security or for claims: may be kept longer, within the limits allowed by law.

7. Your rights

Under the GDPR, you have the following rights in relation to data about you that Revowind SRL processes through the Cephor assistant:

• Right of access (Art. 15): obtain confirmation that data about you is being processed, and receive a copy.
• Right to rectification (Art. 16): have inaccurate data corrected.
• Right to erasure (Art. 17): ask for your data to be deleted, on the conditions set by the GDPR.
• Right to restriction of processing (Art. 18): ask for processing to be restricted in certain cases.
• Right to data portability (Art. 20): receive your data in a structured, commonly used format.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to withdraw consent: at any time, where processing is based on consent.

To exercise these rights, contact us at privacy@cephor.io. We will reply within one month.

8. Security

We apply appropriate technical and organisational measures to protect your data (encryption in transit, access control, choice of reliable processors). No transmission over the Internet is entirely free of risk; we work to limit that risk in line with industry practice.

9. Automated processing and artificial intelligence

The assistant uses artificial-intelligence technologies to understand your questions and generate replies (text or voice). That processing is carried out in order to provide the conversation service. Replies are generated automatically from the site’s content and from the settings chosen by the site owner; they are not legal, medical or personalised advice. For any question about your data used by these systems, you can contact us at the address above.

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The date of the latest update appears at the top of the document. If a change is substantial, we may tell you, where appropriate, through a notice in the assistant or on the Cephor site.

11. Contact

For any question about this policy or about the processing of your data through the Cephor assistant:

• Email: privacy@cephor.io
• Post: Revowind SRL – Rue de la Mitingotte, 19 – 6640 Vaux-sur-Sûre, Belgium