Privacy policy

1. Introduction

This privacy policy describes how Revowind SRL (company number BE 0745.825.575), publisher of the Cephor service, collects, uses, shares and protects your personal data in accordance with Regulation (EU) 2016/679 (the « GDPR ») and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

By using the Cephor services, you acknowledge that you have read this policy. If you do not accept these terms, please do not use our services.

2. Controller

3. Data we collect

In providing our services, we collect and process the following categories of data:

3.1 Identity and account data

• First name and last name
• Email address
• Password (stored in encrypted form)
• Information linked to your Experiences (site URLs, extracted content, assistant settings, and so on)

3.2 Conversation data (visitors to your sites)

When visitors interact with a Cephor Experience embedded on your site (voice or text), we may process:

• Content of the exchanges (transcripts, messages)
• Telephone numbers (for voice calls)
• Date, time and duration of conversations
• Voice recordings of calls (for AI processing and service quality)
• Technical metadata (IP address, user-agent, device type)

3.3 Technical data

• IP address
• Browser type and version
• Operating system
• Connection data and access logs
• Session identifiers

3.4 Billing data

• Payment information (processed by Stripe)
• Transaction history and credit consumption

4. Purposes and legal bases

Your data is processed for the following purposes, on the corresponding legal bases:

5. Processors and technology partners

To provide our services, we use processors and technology partners. In accordance with article 28 of the GDPR, appropriate safeguards (processing agreements, standard clauses, and so on) are in place with each of them.

This list may change to include new technologies or to improve our services. We will inform you of any significant change by updating this policy.

5.1 Hosting and infrastructure

• Vercel Inc. (United States) – Hosting of the web application (frontend). Transfer covered by the EU-US Data Privacy Framework or the Standard Contractual Clauses (SCCs).
• Google Cloud Platform (GCP) – Backend and file hosting (CDN). Data may be processed in the European Union depending on the configured region; transfers outside the EEA are covered by the SCCs or the Data Privacy Framework.
• Supabase Inc. – Databases. Infrastructure hosted in the European Union (configured region) where applicable; transfers outside the EEA are covered by the SCCs.

5.2 Telecommunications

• Twilio Inc. (United States) – Telephony (voice calls). Transfer covered by the Standard Contractual Clauses (SCCs) of the European Commission.

5.3 Artificial intelligence and voice

• ElevenLabs Inc. – Voice synthesis and voice conversational agents. Data processed under contractual safeguards and, where applicable, the SCCs.
• OpenAI LP (United States) – Natural-language processing. Transfer covered by the SCCs.
• Anthropic PBC (United States) – Artificial intelligence (Claude models). Transfer covered by the SCCs.

5.4 Payments

• Stripe Inc. (United States) – Payment processing. Stripe is PCI-DSS level 1 certified. Transfer covered by the Data Privacy Framework or the SCCs.

5.5 Email delivery

• Resend Inc. – Sending of transactional and notification emails. Data processed under contractual safeguards and, where applicable, the SCCs.

5.6 Monitoring and service quality

• Sentry (Functional Software Inc.) (United States) – Monitoring of errors and application performance. Sentry may collect technical data (browser type, operating system, IP address) and session recordings to help us identify and fix technical problems. Transfer covered by the SCCs.

6. International data transfers

Some of our processors are established outside the European Economic Area (EEA), in particular in the United States. For these transfers, we ensure that appropriate safeguards are in place:

• EU-US Data Privacy Framework: for certified companies (Vercel, Stripe, and others).
• Standard Contractual Clauses (SCCs): approved by the European Commission for other transfers.
• Additional measures: encryption of data, pseudonymisation where possible, and risk assessment.

You can obtain a copy of the appropriate safeguards by contacting us at privacy@cephor.io.

7. How long we keep data

We keep your personal data only for as long as necessary for the purposes for which it was collected:

• Account data: for the whole time you use the service, then 3 years after your account is closed (to deal with possible complaints).
• Conversation data (transcripts, recordings): 90 days at most, unless a legal obligation requires otherwise or a shorter retention is set in the configuration.
• Billing data: 10 years, in accordance with Belgian legal accounting obligations.
• Technical logs: 12 months at most.

8. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction:

• Encryption of data in transit (TLS) and at rest where relevant (AES-256)
• Secure authentication with password hashing (bcrypt)
• Strict access control and the principle of least privilege
• Monitoring and logging of access
• Regular backups
• Selection of processors that offer appropriate security safeguards

We undertake to keep improving our security measures as threats and industry practice evolve.

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation that your data is processed and receive a copy.
• Right to rectification (Art. 16): have inaccurate data about you corrected.
• Right to erasure (Art. 17): ask for your data to be deleted in certain circumstances.
• Right to restriction (Art. 18): restrict the processing of your data in certain cases.
• Right to portability (Art. 20): receive your data in a structured, commonly used format.
• Right to object (Art. 21): object to processing of your data based on legitimate interest.
• Right to withdraw consent: at any time, where processing is based on consent.

To exercise these rights, contact us at privacy@cephor.io. We will reply within one month, in accordance with the GDPR.

Complaint to a supervisory authority: if you consider that the processing of your data breaches the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority:

10. Cookies and similar technologies

10.1 Strictly necessary cookies

These cookies are essential to the operation of the service and are exempt from consent under the ePrivacy Directive:

• Session cookies: keeping you signed in during your visit.
• Authentication cookies: secure identification after sign-in.
• Preference cookies: remembering your interface choices.

10.2 Monitoring technologies

To ensure the quality and stability of our service, we use technical monitoring technologies:

• Sentry: error detection and performance improvement. Sentry may record sessions (clicks, navigation) to help us resolve technical problems. This data is used only for debugging and improving the service, and is not used for advertising or commercial profiling.

These technologies are used in our legitimate interest in ensuring the proper operation and continuous improvement of our service (Art. 6.1.f GDPR).

10.3 Advertising cookies

We use no advertising cookies, marketing trackers or commercial profiling.

11. Automated processing and artificial intelligence

Our service relies on artificial-intelligence technologies for:

• Speech recognition and synthesis
• Understanding natural language
• Generating appropriate replies
• Managing conversations (voice and text)

This automated processing is carried out in order to perform the contract. You can contact our team with any question or request for human intervention.

12. Data of visitors to your sites

As a professional user of Cephor, you are the controller of the personal data of visitors who interact with your Experiences on your sites. Cephor acts as processor for that data, within the scope of the Service.

You agree to inform your visitors that a conversational assistant (voice/text) is used and to meet your own obligations under the GDPR (information, legal basis, data-subject rights, and so on).

13. Changes to this policy

We may update this privacy policy to reflect changes in our practices, our technology partners or the applicable rules.

Material changes: if a material change affects your rights or the way your data is processed, we will inform you by email or by a notice on the platform at least 15 days before the changes take effect.

Exceptions: changes may apply on shorter notice or immediately in the event of a legal or regulatory obligation, a decision of a data-protection authority, a security need, or a change of processor offering equivalent or stronger safeguards.

The date of the last update is shown at the top of this document.

14. Contact

For any question about this privacy policy or the processing of your personal data, contact us:

• Email: privacy@cephor.io
• Post: Revowind SRL – Rue de la Mitingotte 19 – 6640 Vaux-sur-Sûre, Belgium