1. Introduction

Replio is operated by MB "Aiteklabs" ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered sales training platform.

This policy is intended to provide the information required by applicable data-protection law, including the GDPR. It is a transparency notice and does not replace consent where consent is legally required.

2. Data Controller

The data controller responsible for your personal data is:

MB "Aiteklabs"

Registered in Lithuania

Email: privacy@aiteklabs.com

Website: https://aiteklabs.com

For privacy questions and data-subject requests, contact our privacy team at privacy@aiteklabs.com.

3. Data We Collect

3.1 Account Information

Name and email address
Organization/company name
Password (encrypted)
Account preferences and settings

3.2 Voice and Audio Data

Important Notice

Our platform processes and may record voice during training sessions. Audio is personal data, but Replio does not use it for biometric identification or authentication. Audio is transmitted to our AI service provider (Google Cloud Vertex AI, in Google Cloud's EU regions) to deliver the live conversation and transcription features.

Voice recordings from training sessions
Transcriptions of conversations
Audio quality metrics
Session timestamps and duration

3.3 Training and Performance Data

Training session history and progress
Performance scores and feedback
Interaction patterns with AI personas
Learning analytics and improvement metrics

3.4 Technical Data

IP address and device information
Browser type and version
Usage logs and session data
Cookies and similar technologies

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

Consent

For optional AI-improvement use and other processing where consent is the appropriate legal basis. You can withdraw consent at any time without affecting prior lawful processing.

Contract

To provide our services and fulfill our contractual obligations to you.

Legitimate Interest

For improving our services, security, and fraud prevention. We have conducted a balancing test per CNIL guidelines to ensure our legitimate interests do not override your fundamental rights.

Legal Obligation

To comply with applicable laws and regulations.

5. EU AI Act Compliance

As an AI-powered platform, we apply the EU AI Act obligations that correspond to Replio's intended use:

Replio is intended for training and human-supervised feedback, not for recruitment, promotion, termination, or other employment decisions. AI Act classification depends on the customer's actual intended use; employment monitoring or evaluation uses may trigger high-risk obligations and must not rely on this policy as a classification assessment.

Transparency: We clearly inform users when they are interacting with AI systems
Human Oversight: Training results and AI feedback are tools to assist, not replace, human judgment
Data Governance: We limit data sent to AI providers to what is needed for the requested feature
Risk Assessment: We regularly assess and mitigate risks associated with our AI systems
Documentation: We maintain comprehensive documentation of our AI systems and their intended purposes
Synthetic content: AI personas are presented as AI, and AI-generated videos published to social platforms through Replio are labeled as AI-generated content

6. How We Use Your Data

Providing AI-powered sales training simulations using third-party AI models
Generating personalized feedback and performance analytics
Managing your account and providing customer support
Sending service-related communications
Ensuring platform security and preventing fraud
Complying with legal obligations

AI and Data Processing

Third-party AI services process the inputs needed to provide Replio features. If you opt in, Replio may de-identify text transcripts and retain those copies for future service improvement, including possible development of proprietary models.

Voice recordings are excluded from Replio's service-improvement dataset. Operational recordings may be available to you and authorized administrators of the organization that provided the training.

You can opt out of anonymized data retention in your account settings. When opted out, your session transcriptions will not be anonymized and retained for future use.

7. Data Retention

We retain personal data only for as long as needed for the purposes described in this policy, using the following periods or criteria:

Account, profile, and operational training data: while the account is active and until deletion is completed, except where a legal obligation or an unresolved claim requires limited retention
Voice recordings and session transcripts: while the related session/account remains available, or until earlier deletion where the product provides that control
De-identified service-improvement copies: only for accounts that have not opted out; opting out triggers deletion of linked improvement copies
Application server logs: informational logs for 7 days and warning/error logs for 30 days
Billing, tax, security, consent, and compliance records: for the period required by applicable law or necessary to establish, exercise, or defend legal claims

You can request deletion of your data at any time by contacting us at privacy@aiteklabs.com or through your account settings.

Retention may differ by data category and customer configuration. When data must be retained after an account is deleted, access is restricted and the data is used only for the applicable legal or security purpose.

8. Data Sharing and Third Parties

We may share your data with:

Service Providers: Cloud hosting and storage, AI processing services, transactional email, billing, and consented analytics providers
Your Organization: If you use Replio through an employer, administrators may access your training data
Legal Requirements: When required by law or to protect our rights

We do not sell your personal data to third parties.

8.1 Categories of Third-Party Processors

We use the following third-party service providers (sub-processors):

Google Cloud (Vertex AI, Document AI)

Purpose: Live voice conversations, transcription, persona generation, session analysis, document parsing, knowledge retrieval, and image generation

Data shared: Live-session audio, transcripts, prompts, uploaded training content, questionnaire responses, and the minimum session context needed for the requested feature. Direct account identifiers are excluded where they are not required.

Safeguards: Processed in Google Cloud's EU regions (EU multi-region and europe-west4) under the Google Cloud Data Processing Addendum. Google does not use this data to train its models.

Google (Gemini API) for AI video generation

Purpose: Generation of AI video clips, only when an organization uses the video library or Social Studio features

Data shared: The video brief and keyframe image prepared by the organization's manager. No live-session audio, transcripts, or trainee personal data.

Safeguards: May be processed outside the EEA, under Google's data-processing terms and an applicable GDPR transfer mechanism such as Standard Contractual Clauses

Cloudflare

Purpose: Application hosting and content delivery, object storage for recordings, documents, and media, application logs, bot protection, and transactional email

Data shared: Request metadata (IP address, device information), stored files, application logs, and the email addresses of message recipients

Safeguards: Storage located in Europe, application containers pinned to Cloudflare's EU jurisdiction; Cloudflare Data Processing Addendum with Standard Contractual Clauses

Neon (database hosting)

Purpose: Primary and analytics databases

Data shared: Account, organization, training, and session data (recordings and documents are stored on Cloudflare, not in the database)

Safeguards: EU region, encryption at rest and in transit, data-processing terms with Standard Contractual Clauses

Payment and app-store providers (Revolut, Google Play, Apple App Store)

Purpose: Subscription billing, invoicing, and in-app purchases for the mobile app

Data shared: Billing contact details and order or subscription identifiers. Card data is handled by the payment provider and never stored by Replio.

Safeguards: Regulated payment providers; each one acts under its own terms and privacy policy for the payment itself

Identity and single sign-on providers (Google, Apple, WorkOS)

Purpose: Sign in with Google or Apple, and enterprise single sign-on through WorkOS when an organization enables it

Data shared: Name, email address, and the identifier assigned by the identity provider

Safeguards: Data-processing terms and, for transfers outside the EEA, Standard Contractual Clauses

Social platforms (TikTok, YouTube)

Purpose: Publishing AI-generated clips, only when an organization connects its own account

Data shared: The videos and captions the organization chooses to publish, and the account authorization tokens, stored encrypted

Safeguards: Publication is initiated by the organization; the platform's own terms and privacy policy apply to the published content

We require service providers that process personal data on our behalf to be bound by appropriate data-processing and confidentiality terms, including the Google Cloud Data Processing Addendum and the Cloudflare Data Processing Addendum. Customers may contact legal@aiteklabs.com for current processor and transfer information.

9. International Data Transfers

Your data is stored within the European Union and AI processing runs in Google Cloud's EU regions. Where a provider transfers data outside the EU/EEA (for example AI video generation, or the support and edge-network operations of our hosting providers), we ensure appropriate safeguards are in place, including:

EU Standard Contractual Clauses (SCCs)
Adequacy decisions by the European Commission
Binding Corporate Rules where applicable

9.1 AI Data Processing

To provide live voice conversations, transcription, persona generation, document processing, knowledge retrieval, image generation, and session analysis, relevant data is processed by Google Cloud (Vertex AI and Document AI) in Google Cloud's EU regions, under the Google Cloud Data Processing Addendum. Google does not use this data to train its models. The only AI feature that may process data outside the EEA is AI video generation (Gemini API), which receives no live-session audio, transcripts, or trainee personal data.

Data sent to AI providers: Data sent to AI providers may include live audio, transcripts, prompts, uploaded training content, questionnaire responses, and session context required for the requested feature. We do not send direct account identifiers unless they are technically necessary for that feature.

Safeguards: Where a restricted transfer occurs, we use an applicable GDPR transfer mechanism and contractual safeguards. Organizations that need a documented EU-only processing commitment can contact privacy@aiteklabs.com.

10. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Access

Request a copy of your personal data

Rectification

Correct inaccurate or incomplete data

Erasure

Request deletion of your data (Right to be Forgotten)

Restriction

Limit how we process your data

Portability

Receive your data in a portable format (JSON, CSV)

Objection

Object to certain processing activities

Withdraw Consent

Withdraw consent at any time

Lodge Complaint

File a complaint with your local supervisory authority

To exercise your rights, contact us at privacy@aiteklabs.com. We will respond without undue delay, within one month as required by GDPR.

You can export your data directly from your account settings in a structured, machine-readable format.

You may lodge a complaint with your local data protection authority, or with our lead supervisory authority, the State Data Protection Inspectorate of Lithuania (VDAI). Examples: CNIL (France), BfDI (Germany), HDPA (Greece), AEPD (Spain), CNPD (Portugal).

11. Automated Decision-Making (GDPR Article 22)

Our platform uses AI to generate performance scores and feedback during training sessions.

11.1 No Legal or Significant Effects

AI-generated assessments are training tools only. They do not produce legal effects or similarly significantly affect you. Final decisions regarding employment, performance reviews, or career advancement remain with your employer/manager.

11.2 Your Rights Regarding AI Decisions

You have the right to:

Request human review of any AI-generated assessment
Express your point of view regarding AI feedback
Contest AI decisions that you believe are inaccurate
Obtain a clear explanation of how the AI reached its assessment

11.3 How to Exercise These Rights

Contact privacy@aiteklabs.com with subject line 'Human Review Request' to request human review of any AI assessment.

12. Data Security

We implement robust security measures to protect your data:

Encryption in transit (TLS) and encryption at rest for stored data
Access controls and authentication requirements
Employee training on data protection
Incident response procedures
Database and AI processing in EU regions, file storage located in Europe

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

13. Cookies and Similar Technologies

We use cookies to enhance your experience on our platform.

13.1 Cookie Categories

Strictly Necessary

Required for platform functionality (authentication, security, session management). These cookies do not require consent.

Analytics

Help us understand how you use our platform to improve it. Requires your consent.

Marketing

Used only if marketing or campaign technologies are enabled and you consent. Replio does not currently load marketing trackers by default.

You can manage your cookie preferences at any time through the cookie banner or your account settings. You can also configure your browser to reject cookies, though this may affect platform functionality.

We will not set non-essential cookies until you have provided your consent through our cookie banner.

14. Children's Privacy

Replio is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@aiteklabs.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes in advance where required by law, using email or the platform as appropriate. The "Last updated" date at the top indicates when the policy was last revised.

16. Contact Us

For privacy-related questions or to exercise your rights:

Privacy contact

Email: privacy@aiteklabs.com

MB "Aiteklabs", Lithuania

We aim to respond to all requests without undue delay, within one month as required by GDPR.

17. The Recito Mobile App

Recito is our mobile study app, built on the same platform and operated by the same data controller. When you use Recito, this Privacy Policy applies, with the following app-specific details:

Sign-in uses Google OAuth or Sign in with Apple only; we receive your name, email address and the account identifier of the provider you chose. The app does not collect your contacts, your location or advertising identifiers.
Study materials you scan or upload, generated quizzes and your study progress are stored on our servers so your data survives a reinstall and follows your account across devices.
Voice conversations with the AI coach, the study materials you add and your quiz answers are sent to Google Cloud AI services through our EU servers to run the coach, the quizzes and note scanning, as described in sections 3.2 and 9.1. The app asks for your permission before the first use. Transcripts of these conversations are stored on your device and in your account; you can permanently delete all of them at any time from the app (Profile > Privacy > Delete conversation history).
Microphone access is requested only when you start a voice session and is used solely for the live conversation.
You can delete your account and all associated data directly in the app (Profile > Delete my account), or by contacting privacy@aiteklabs.com.