Privacy Policy and KVKK / GDPR Privacy Notice
Version 2.1 · Effective: 16 October 2026 · Previous versions
Voiser Live translates speech at live events into other languages in real time. This notice explains which data we process, on what legal basis and for how long, with whom it is shared, and your rights under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
1. Scope and controller
This notice covers personal data processed when you use voiser.live and the organiser panel. The controller is:
| Entity | Voiser Teknoloji Limited Şirketi |
|---|---|
| Address | Defterdar Mah. Otakçılar Cad. Sinpaş Flatofis No: 78/94, 34050 Eyüpsultan / Istanbul, Türkiye |
| Tax office / No | Bayrampaşa Tax Office – 9250981194 |
| MERSİS No / Trade Registry No | 0925098119400001 · 305008-5 |
| KEP (registered e-mail) | voiser@hs01.kep.tr |
| E-mail / Phone | hello@voiser.ai · +90 216 599 10 11 |
| United Kingdom | Voiser AI Ltd (company no. 15255746), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom |
Privacy contact: hello@voiser.ai · KEP: voiser@hs01.kep.tr
2. Who is responsible for which data
There are two distinct relationships in this Service:
- For account data (name, e-mail, workspace settings, billing records, usage metrics) we are the controller.
- For event content (what is spoken in a room, transcripts, translations, summaries, uploaded files) the controller is the Customer organising the event; we process that data on its behalf and instructions as a processor (Art. 28 GDPR). The terms of that relationship are set out in the Data Processing Agreement.
If you are a participant or speaker and have a request about the translation of your speech, you must first contact the organising Customer; we cannot act on the content without its instruction, but we will forward your request and assist. The organising Customer is responsible for informing participants that speech will be translated and may be transcribed.
3. Data, purposes and legal bases
| Category | Examples | Purpose | Legal basis (KVKK / GDPR) |
|---|---|---|---|
| Account data | name, e-mail, phone, organisation, role, login records | Account creation, formation and performance of the contract, security | KVKK art. 5/2-c; GDPR art. 6(1)(b) |
| Event data | event/room names, agenda, speaker name and photo, logo, presentation files | Provision of the Service | KVKK art. 5/2-c; GDPR art. 6(1)(b) (as processor) |
| Speech data | transcribed text, translations, summaries | Real-time translation and post-event outputs | Customer's instructions; GDPR art. 28 (processor) |
| Usage data | broadcast start/end, minutes used, listener counts | Calculating entitlements, service improvement | KVKK art. 5/2-c, f; GDPR art. 6(1)(b), (f) |
| Payment and invoice data | package, amount, legal name, address, tax details, payment status (card data never reaches us) | Collection, invoicing, statutory bookkeeping | KVKK art. 5/2-ç; GDPR art. 6(1)(c) |
| Contract acceptance records | accepting person's name, e-mail and title, workspace, time of acceptance, accepted document and version, hashed network address, browser details | Proof that the contract was concluded and of its content | KVKK art. 5/2-c, ç; GDPR art. 6(1)(b), (c) |
| Technical logs | network address (hashed), error and access logs | Security, abuse prevention, fault diagnosis | KVKK art. 5/2-f; GDPR art. 6(1)(f) |
| Marketing | e-mail, preferences | Product announcements and offers | Consent: KVKK art. 5/1, Law 6563 and İYS; GDPR art. 6(1)(a) |
| Contact requests | name, business e-mail, phone, organisation, event details, note, referring page | Responding, preparing a quotation | KVKK art. 5/2-c (pre-contractual); GDPR art. 6(1)(b) |
We never store the raw audio spoken in a room. Audio is processed momentarily to produce the translation; what remains with us is the text. Our live translation provider may keep the inputs sent to it in a secure environment for up to fifty-five (55) days solely to prevent abuse of its service; these records are accessed only for that purpose and are not used to train AI models.
Audio is not processed for identification or biometric recognition and is therefore not, as a rule, special-category data under KVKK art. 6 / GDPR art. 9. If a speaker voluntarily discloses sensitive information (e.g. health, political opinion) the transcript may reflect it; such processing relies on data manifestly made public by the data subject (KVKK art. 6/3; GDPR art. 9(2)(e)).
Listeners do not need an account to join a room and are not asked for a name, e-mail or phone number. The only data processed on the listener side is the technical information needed to establish the connection and to filter out automated abuse.
We do not process your account or event data for advertising, nor sell or rent it to third parties; we do not run analytics or advertising measurement on the site (Section 8). We do not use your speech content to train general-purpose AI models. We do not make decisions producing legal effects on you based solely on automated processing or profiling (GDPR art. 22).
4. AI transparency
Translations, captions, synthetic voice, transcripts and summaries are generated by AI. Under Article 50 of the EU AI Act (Regulation (EU) 2024/1689) we indicate in the interface that they are AI output and mark exported files in a machine-readable manner. Where outputs are published to the public, the organising Customer is responsible for the required disclosure.
5. Retention
| Data | Period |
|---|---|
| Raw audio | Not stored by us; processed momentarily. The live translation provider may keep it for up to fifty-five (55) days for abuse monitoring (Section 3). |
| Transcripts, translations and post-event outputs | Period stated in your package; default twelve (12) months. Text and derived files are deleted at expiry. The Customer may delete any record earlier. |
| Account and workspace data | While the account is open; deleted or anonymised within thirty (30) days of closure. |
| Invoice and payment records | Ten (10) years under the Turkish Tax Procedure Law and Commercial Code; retained after closure until the statutory period ends. |
| Contract acceptance records (which version, who, when) | Term of the contract + ten (10) years (limitation period); at least three (3) years for distance sales. Retained for this period even after closure. |
| Technical and security logs | Two (2) years for traffic logs under Law No. 5651; other logs at most ninety (90) days. |
| Contact requests | Twenty-four (24) months from the request; deleted earlier on request. |
| Marketing permissions | Until consent is withdrawn; opt-out record kept in İYS for three (3) years. |
On deletion, files are deleted first and records second. Expired data is deleted, destroyed or anonymised in accordance with KVKK.
6. Who we share data with (sub-processors)
We work with a limited number of service providers to deliver the Service. Each accesses only the data needed for its task and processes it on our instructions under a data processing agreement:
| Category | What it does | Data location |
|---|---|---|
| Cloud infrastructure provider | Servers, database, file storage and delivery of audio from speaker to listener; audio is not stored in delivery | European Union |
| AI providers | Transcribe and translate speech in real time and generate translated audio and post-event summary texts; may keep inputs for up to 55 days solely for abuse monitoring | European Union and outside the EU (momentary processing) |
| Payment provider | Collects card payments (card data never reaches us) | European Union and United States |
| E-mail provider | Account and notification e-mails | United States |
| Security verification provider | Filters automated and malicious requests | Outside the EU (including the United States) |
| Customer relationship service | Holds contact requests for the sales team | United States |
The current list of sub-processors by name is provided to enterprise customers on request; enterprise customers receive at least thirty (30) days' notice by e-mail of a material change, with the right to object under the DPA. Beyond this, we share your data only where required by law or by a lawful request from a competent authority.
7. Data location and international transfers
Your account, event and transcript data are hosted on servers within the European Union. The provider generating live translation may also operate on servers outside the EU; speech data may therefore be transferred momentarily outside the EU while the translation is produced. That transfer takes place to produce the translation and is not persistent, apart from the records the provider keeps for a limited period for abuse monitoring. For payment, e-mail, security verification and contact-request services, data may be processed on the providers' servers outside the EU (including the US).
- Under KVKK: transfers from Türkiye abroad (including to the EU) are made under KVKK art. 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on a Board adequacy decision, the Board's standard contract (signed with the relevant provider and notified to the Board) or one of the statutory occasional-transfer grounds.
- Under GDPR: transfers outside the EU/EEA (to Türkiye, the US etc.) rely on the European Commission's Standard Contractual Clauses (2021/914), the EU–US Data Privacy Framework or other appropriate safeguards under art. 46 GDPR, with a transfer impact assessment where required.
8. Cookies and browser storage
The site uses only strictly necessary cookies (language preference, session) and browser storage, which are used without consent. We do not use analytics or advertising cookies. If we add such a tool, we will first ask for your consent through a cookie banner and update this policy and the Cookie Policy.
- Browser storage: settings such as theme, interface language and caption font size are kept only on your device and are not sent to us.
The full list of cookies, their purposes and retention periods is set out in our Cookie Policy (voiser.live/cookies).
9. Security
- Data is encrypted in transit and at rest.
- Only people invited to your workspace can access its data, to the extent their role allows; changes are logged.
- Files are served through an access-controlled server; no permanent sharing links are generated.
- Your card details never reach us; payment is taken on the own secure page of a payment provider that complies with the card data security standard (PCI-DSS).
- For abuse-rate limiting and acceptance records your network address is stored as an irreversible hash, not in clear.
No system can promise absolute security. If a breach affecting your data occurs we notify the Turkish Personal Data Protection Board within 72 hours under KVKK, the competent supervisory authority within 72 hours under GDPR, and you without undue delay. For breaches affecting event content we notify the controlling Customer within 72 hours at the latest.
10. Your rights
Under KVKK art. 11 and GDPR arts. 15–22 you have the right to:
- Learn whether your personal data is processed and, if so, request information (right of access).
- Learn the purpose of processing and whether data is used in line with that purpose.
- Know the third parties to whom data is transferred, domestically or abroad.
- Request rectification of incomplete or inaccurate data.
- Request erasure or destruction under the conditions set by law (right to be forgotten).
- Request that rectification and erasure be notified to third-party recipients.
- Request restriction of processing and object to processing (GDPR arts. 18, 21).
- Receive your data in a structured, commonly used, machine-readable format (data portability, GDPR art. 20).
- Object to a result against you produced solely by automated analysis.
- Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
- Claim compensation for damage caused by unlawful processing.
- Lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr) or, if you are in the EU, with the supervisory authority of your country.
11. How to exercise your rights
Send requests to hello@voiser.ai (from the e-mail address registered on your account), to our registered e-mail voiser@hs01.kep.tr, or in writing to the address in Section 1, in accordance with the Turkish Communiqué on Procedures for Applications to Data Controllers. Requests are handled free of charge within thirty (30) days (one month under GDPR, extendable by two further months for complex requests). If your request concerns event content, the controller is the organising Customer; we will forward your request and assist.
12. Children
The Service is intended for business use and not for persons under 18. We do not knowingly collect personal data from children; if we learn that we have, we delete it.
13. Changes
We may update this policy from time to time. We will notify material changes to the e-mail address on your account. The effective date and version number appear at the top; previous versions are available at voiser.live/privacy/archive.
14. Contact
| Entity | Voiser Teknoloji Limited Şirketi |
|---|---|
| Address | Defterdar Mah. Otakçılar Cad. Sinpaş Flatofis No: 78/94, 34050 Eyüpsultan / Istanbul, Türkiye |
| Tax office / No | Bayrampaşa Tax Office – 9250981194 |
| MERSİS No / Trade Registry No | 0925098119400001 · 305008-5 |
| KEP (registered e-mail) | voiser@hs01.kep.tr |
| E-mail / Phone | hello@voiser.ai · +90 216 599 10 11 |
| United Kingdom | Voiser AI Ltd (company no. 15255746), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom |
In case of discrepancy between the Turkish and English versions, the Turkish version prevails.