1. Introduction

Replio is operated by MB "Aiteklabs" ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered sales training platform.

This policy is intended to provide the information required by applicable data-protection law, including the GDPR. It is a transparency notice and does not replace consent where consent is legally required.

2. Data Controller

The data controller responsible for your personal data is:

MB "Aiteklabs"

Registered in Lithuania

Email: privacy@aiteklabs.com

Website: https://aiteklabs.com

For privacy questions and data-subject requests, contact our privacy team at privacy@aiteklabs.com.

3. Data We Collect

3.1 Account Information

Name and email address
Organization/company name
Password (encrypted)
Account preferences and settings

3.2 Voice and Audio Data

Important Notice

Our platform processes and may record voice during training sessions. Audio is personal data, but Replio does not use it for biometric identification or authentication. Audio is transmitted to our AI service provider to deliver the live conversation and transcription features.

Voice recordings from training sessions
Transcriptions of conversations
Audio quality metrics
Session timestamps and duration

3.3 Training and Performance Data

Training session history and progress
Performance scores and feedback
Interaction patterns with AI personas
Learning analytics and improvement metrics

3.4 Technical Data

IP address and device information
Browser type and version
Usage logs and session data
Cookies and similar technologies

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

Consent

For optional AI-improvement use and other processing where consent is the appropriate legal basis. You can withdraw consent at any time without affecting prior lawful processing.

Contract

To provide our services and fulfill our contractual obligations to you.

Legitimate Interest

For improving our services, security, and fraud prevention. We have conducted a balancing test per CNIL guidelines to ensure our legitimate interests do not override your fundamental rights.

Legal Obligation

To comply with applicable laws and regulations.

5. EU AI Act Compliance

As an AI-powered platform, we comply with the EU AI Act requirements:

Replio is intended for training and human-supervised feedback, not for recruitment, promotion, termination, or other employment decisions. AI Act classification depends on the customer's actual intended use; employment monitoring or evaluation uses may trigger high-risk obligations and must not rely on this policy as a classification assessment.

Transparency: We clearly inform users when they are interacting with AI systems
Human Oversight: Training results and AI feedback are tools to assist, not replace, human judgment
Data Governance: We limit data sent to AI providers to what is needed for the requested feature
Risk Assessment: We regularly assess and mitigate risks associated with our AI systems
Documentation: We maintain comprehensive documentation of our AI systems and their intended purposes

6. How We Use Your Data

Providing AI-powered sales training simulations using third-party AI models
Generating personalized feedback and performance analytics
Managing your account and providing customer support
Sending service-related communications
Ensuring platform security and preventing fraud
Complying with legal obligations

AI and Data Processing

Third-party AI services process the inputs needed to provide Replio features. If you opt in, Replio may de-identify text transcripts and retain those copies for future service improvement, including possible development of proprietary models.

Voice recordings are excluded from Replio's service-improvement dataset. Operational recordings may be available to you and authorized administrators of the organization that provided the training.

You can opt out of anonymized data retention in your account settings. When opted out, your session transcriptions will not be anonymized and retained for future use.

7. Data Retention

We retain personal data only for as long as needed for the purposes described in this policy, using the following periods or criteria:

Account, profile, and operational training data: while the account is active and until deletion is completed, except where a legal obligation or an unresolved claim requires limited retention
Voice recordings and session transcripts: while the related session/account remains available, or until earlier deletion where the product provides that control
De-identified service-improvement copies: only for accounts that have not opted out; opting out triggers deletion of linked improvement copies
Application server logs: informational logs for 7 days and warning/error logs for 30 days
Billing, tax, security, consent, and compliance records: for the period required by applicable law or necessary to establish, exercise, or defend legal claims

You can request deletion of your data at any time by contacting us at privacy@aiteklabs.com or through your account settings.

Retention may differ by data category and customer configuration. When data must be retained after an account is deleted, access is restricted and the data is used only for the applicable legal or security purpose.

8. Data Sharing and Third Parties

We may share your data with:

Service Providers: Cloud hosting and storage, AI processing services, transactional email, billing, and consented analytics providers
Your Organization: If you use Replio through an employer, administrators may access your training data
Legal Requirements: When required by law or to protect our rights

We do not sell your personal data to third parties.

8.1 Categories of Third-Party Processors

We use the following categories of third-party service providers:

AI Service Providers

Purpose: AI-powered persona generation, session analysis, and real-time voice conversations

Data shared: Live-session audio, transcripts, prompts, training descriptions, questionnaire responses, and the minimum session context needed to provide the requested AI feature. Direct account identifiers are excluded where they are not required.

Safeguards: Data-processing terms and, where required for transfers outside the EEA, an applicable GDPR transfer mechanism such as Standard Contractual Clauses

Cloud Storage Providers

Purpose: Secure storage of voice recordings and platform assets

Data shared: Voice recordings, session data

Safeguards: EU-based storage, encryption at rest and in transit

Email Service Providers

Purpose: Transactional emails (account notifications, password resets, invitations)

Data shared: Email addresses only

Safeguards: Appropriate data-protection and confidentiality terms

We require service providers that process personal data on our behalf to be bound by appropriate data-protection and confidentiality terms. Customers may contact legal@aiteklabs.com for current processor and transfer information.

9. International Data Transfers

Your data is primarily stored within the European Union. If we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place, including:

EU Standard Contractual Clauses (SCCs)
Adequacy decisions by the European Commission
Binding Corporate Rules where applicable

9.1 AI Data Processing

To provide live voice conversations, transcription, persona generation, document processing, and session analysis, relevant data is processed by third-party AI service providers. Depending on the configured service and region, processing may occur outside the European Economic Area.

Data sent to AI providers: Data sent to AI providers may include live audio, transcripts, prompts, uploaded training content, questionnaire responses, and session context required for the requested feature. We do not send direct account identifiers unless they are technically necessary for that feature.

Safeguards: Where a restricted transfer occurs, we use an applicable GDPR transfer mechanism and contractual safeguards. Contact privacy@aiteklabs.com for information relevant to your deployment.

10. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Access

Request a copy of your personal data

Rectification

Correct inaccurate or incomplete data

Erasure

Request deletion of your data (Right to be Forgotten)

Restriction

Limit how we process your data

Portability

Receive your data in a portable format (JSON, CSV)

Objection

Object to certain processing activities

Withdraw Consent

Withdraw consent at any time

Lodge Complaint

File a complaint with your local supervisory authority

To exercise your rights, contact us at privacy@aiteklabs.com. We will respond without undue delay, within one month as required by GDPR.

You can export your data directly from your account settings in a structured, machine-readable format.

You may lodge a complaint with your local data protection authority: CNIL (France), BfDI (Germany), DPA (Greece), AEPD (Spain), CNPD (Portugal).

11. Automated Decision-Making (GDPR Article 22)

Our platform uses AI to generate performance scores and feedback during training sessions.

11.1 No Legal or Significant Effects

AI-generated assessments are training tools only. They do not produce legal effects or similarly significantly affect you. Final decisions regarding employment, performance reviews, or career advancement remain with your employer/manager.

11.2 Your Rights Regarding AI Decisions

You have the right to:

Request human review of any AI-generated assessment
Express your point of view regarding AI feedback
Contest AI decisions that you believe are inaccurate
Obtain a clear explanation of how the AI reached its assessment

11.3 How to Exercise These Rights

Contact privacy@aiteklabs.com with subject line 'Human Review Request' to request human review of any AI assessment.

12. Data Security

We implement robust security measures to protect your data:

Encryption in transit and appropriate protection for stored data
Access controls and authentication requirements
Employee training on data protection
Incident response procedures
Security controls appropriate to the infrastructure and providers used

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

13. Cookies and Similar Technologies

We use cookies to enhance your experience on our platform.

13.1 Cookie Categories

Strictly Necessary

Required for platform functionality (authentication, security, session management). These cookies do not require consent.

Analytics

Help us understand how you use our platform to improve it. Requires your consent.

Marketing

Used only if marketing or campaign technologies are enabled and you consent. Replio does not currently load marketing trackers by default.

You can manage your cookie preferences at any time through the cookie banner or your account settings. You can also configure your browser to reject cookies, though this may affect platform functionality.

We will not set non-essential cookies until you have provided your consent through our cookie banner.

14. Children's Privacy

Replio is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@aiteklabs.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes in advance where required by law, using email or the platform as appropriate. The "Last updated" date at the top indicates when the policy was last revised.

16. Contact Us

For privacy-related questions or to exercise your rights:

Privacy contact

Email: privacy@aiteklabs.com

MB "Aiteklabs", Lithuania

We aim to respond to all requests without undue delay, within one month as required by GDPR.

17. The Recito Mobile App

Recito is our mobile study app, built on the same platform and operated by the same data controller. When you use Recito, this Privacy Policy applies, with the following app-specific details:

Sign-in uses Google OAuth only; we receive your name, email address and Google account identifier. The app does not collect your contacts, your location or advertising identifiers.
Study materials you scan or upload, generated quizzes and your study progress are stored on our servers so your data survives a reinstall and follows your account across devices.
Voice conversations with the AI coach are processed as described in section 3.2. Transcripts of these conversations are stored on your device and in your account; you can permanently delete all of them at any time from the app (Profile > Privacy > Delete conversation history).
Microphone access is requested only when you start a voice session and is used solely for the live conversation.
You can delete your account and all associated data directly in the app (Profile > Delete my account), or by contacting privacy@aiteklabs.com.