Privacy Policy

Information on the processing of personal data pursuant to Art. 13 / Art. 14 GDPR. Last updated: 04.10.2026.

1. Controller

The controller responsible for the processing of personal data within the meaning of Art. 4 (7) GDPR is:

Benjamin Lison
Lindoza (sole proprietorship)
Am Kohlgarten 10
38442 Wolfsburg
Germany
Email: software@lindoza.com

2. Competent supervisory authority

Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection Lower Saxony)
Prinzenstraße 5
30159 Hannover
https://lfd.niedersachsen.de

3. What is Lindoza? — Briefly and honestly

Lindoza is a voice AI training room: you describe a person (e. g. your boss, a customer, a family member) and practice a difficult conversation in a spoken role-play — before it happens in real life. In doing so, we process particularly sensitive data (your voice, your descriptions of other people, conversation contents on topics such as conflict, job applications, relationships). We take this seriously — and disclose what happens.

4. What data we process

Obligation to provide the data (Art. 13 (2)(e) GDPR). Providing your email address is contractually required for account creation and authentication — without it Lindoza cannot be used. Providing your voice audio data is required for the core function (practice sessions); without it the spoken role-play is not possible. Other data (persona descriptions, wallet top-up for paid sessions) arevoluntary — if you do not provide them, you can use the service without the conversation function or with the free trial allowance.

4.1 Account data

• Email address — for login (magic link) and for transactional notifications
• Wallet balance and top-up history — for billing
• IP address + user agent — briefly in server logs for abuse detection

4.2 Content data

• Persona descriptions — texts that you yourself create about fictional or real people (name, character, typical phrases, triggers)
• Voice audio — the voice you speak while conducting a practice session (biometric data, Art. 9 GDPR). Processed exclusively live for transcription and not stored — see retention period.
• Transcripts — your spoken language is automatically converted into text
• Conversation history — your sentences + AI-generated responses of the persona
• Pattern recognition — AI-based analysis of your conversation style (pauses, word choice, topics) for personal reflection

4.3 Payment data

• Credit card data is processed not by us, but directly by Stripe (PCI-DSS Level 1, EU contractual partner Stripe Payments Europe Ltd. in Ireland). We only see the payment confirmation + amounts.

5. What we use the data for (processing purposes)

5.1 Provision of the practice sessions

Purpose: to provide you with the core tool — conducting spoken conversations with AI personas.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR),explicit consent for biometric and, where applicable, health-/life-related data (Art. 9(2)(a) GDPR).

5.2 Account management & wallet

Purpose: login, authentication, billing of your balance.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

5.3 Analysis of your own sessions

Purpose: to show you patterns (e. g. „You speak faster in moments of stress“) so that you can improve.
Legal basis: performance of a contract + your legitimate interest in your personal reflection (Art. 6(1)(b), (f) GDPR).

5.4 Security & abuse prevention

Purpose: to protect the platform against attacks, fraud and automated abuse.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

5.5 Legal obligations

Purpose: fulfilment of statutory retention and reporting obligations (e. g. tax law for Stripe invoices).
Legal basis: legal obligation (Art. 6(1)(c) GDPR).

6. Retention period

• Account data: until account deletion; thereafter max. 30 days in backups, then complete deletion.
• Voice audio: is not stored — the voice is processed exclusively live for real-time transcription (transport via LiveKit, speech recognition via Deepgram at the EU endpoint with model-improvement opt-out) and not retained. Only the text transcript is persisted.
• Transcripts + persona texts: until you delete them yourself or close your account.
• Wallet-/payment receipts: 10 years (statutory tax retention obligation, § 147 AO).
• Server logs (IP, etc.): max. 14 days.

7. Who has access (recipients / sub-processors)

We use carefully selected service providers who help us to provide Lindoza. With each of them we have a data processing agreement (DPA) pursuant to Art. 28 GDPR and — where data flows to third countries — EU Standard Contractual Clauses 2021/914 + where applicable the EU-US Data Privacy Framework.

At a glance — structured by processing category:

• Database & authentication: Supabase (🇪🇺 Frankfurt, EU main processing — no third-country transfer for account, persona and session data; no audio — this is not persisted)
• Web hosting & serverless functions: Vercel (🇪🇺 Frankfurt compute + 🇺🇸 edge cache, with DPF + SCCs 2021/914)
• Speech and AI processing (voice pipeline): specialized providers for speech recognition, AI role-play (LLM), speech synthesis and voice transport (predominantly 🇺🇸 USA, each with SCCs 2021/914 + additional data protection measures such as log retention limits, zero-retention mode and EU endpoints, insofar as available with the respective provider)
• Background analysis jobs: job orchestration provider (🇺🇸 USA, with SCCs 2021/914)
• Payment processing: Stripe (EU contractual partner SPEL in 🇪🇺 Ireland + 🇺🇸 PCI vault affiliates, with SCCs 2021/914)
• Transactional emails: Resend (🇺🇸 USA, with SCCs 2021/914)
• Marketing conversion tracking on the public landing page (only after cookie consent, see section 11.3): Google LLC (🇺🇸 USA, with EU-US Data Privacy Framework + SCCs 2021/914)
• Product analytics & session replay: PostHog Inc. (main processing 🇪🇺 EU cloud, with EU-US Data Privacy Framework + SCCs 2021/914). Exclusively on the public marketing pages and only after cookie consent — not in the logged-in app area (see section 11.4).

A complete list of the individual providers including data categories, region, technical protective measures and data processing agreements is made available on request to software@lindoza.com. Supervisory authorities, auditors and business customers whose compliance requires it receive the list immediately.

8. Third-country transfers (USA)

Several of our sub-processors process data in the USA. The legal basis for these transfers is:

• the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023), insofar as the respective provider is certified;
• in addition or as an alternative, EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021);
• in each case accompanied by technical protective measures such as AES-256 encryption, DTLS-SRTP for voice streams, TLS 1.2+ in transit.

We are aware that US authorities may have access rights under the CLOUD Act and FISA 702. We actively minimize third-country exposure (e. g. EU endpoint at Deepgram, EU region at Vercel, Supabase Frankfurt) and continuously close gaps (see internal roadmap: ElevenLabs EU residency, EU region for Anthropic as soon as available).

For our Google Ads conversion tracking (see section 11.3) we use Google Consent Mode v2 with the additional setting ads_data_redaction. Before your consent, Google sends no identifying data and sets no cookies; only anonymous, cookieless pings for statistical measurement of advertising success are transmitted. A connection to Google's infrastructure (at the TCP level with IP header) is unavoidable when the tag script is loaded — Google contractually commits not to use these IPs for identification or profiling in cookieless mode. After your explicit consent, this is upgraded to full conversion tracking including cookies.

9. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR) — which data we process about you
• Rectification (Art. 16 GDPR) — of incorrect data
• Erasure (Art. 17 GDPR) — of your data ("right to be forgotten")
• Restriction (Art. 18 GDPR) — of processing
• Data portability (Art. 20 GDPR) — your data in a machine-readable format
• Withdrawal of consent (Art. 7 (3) GDPR) — at any time with effect for the future
• Complaint to the supervisory authority (Art. 77 GDPR) — to the LfD Niedersachsen (see section 2)

Directly in the app: under Settings → Account you can delete people, sessions and your entire account at any time with a single click — without any query, without any residual data. For all other rights, write to us at software@lindoza.com.

10. Automated decisions / profiling

We do not make any automated individual decisions within the meaning of Art. 22 GDPR. The AI-based pattern recognition of your sessions serves exclusively your personal reflection — it leads to no legal effect concerning you or an impairment of your rights.

11. Cookies & tracking

11.1 Technically necessary cookies

We set technically necessary cookies (session cookie for login, CSRF token). These are required for the operation of the app (Art. 6(1)(b) GDPR / § 25 (2) No. 2 TDDDG) and require no consent.

11.2 Cookieless analytics (Plausible)

If we activate the cookieless analytics tool Plausible, it runs in a GDPR-compliant manner: servers in Germany (Falkenstein), no cookies, no cross-site trackers, no personal data. We will name it here as soon as it is active.

11.3 Marketing conversion tracking (Google Ads + Consent Mode v2)

With Google Ads conversion tracking we measure the effectiveness of our advertising (e. g. how many visitors sign up after seeing a Google ad). Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use Google Consent Mode v2 and operate the tracking in two stages:

• Before / without your consent (default): The gtag.js script does load, but sends exclusively anonymous, cookieless pings. No cookies are set, no advertising IDs or click IDs are transmitted, and through the setting ads_data_redaction Google removes remaining identifiers server-side. At the TCP level — unavoidable when loading a script — your IP address is transmitted as part of the HTTP request; Google contractually commits not to use it for identification, profiling or personalization in cookieless mode. From these cookieless pings, Google statistically estimates („modeled conversions“) the advertising success without any individual person being tracked. Legal basis: legitimate interest in data-minimized measurement of advertising success (Art. 6(1)(f) GDPR). § 25 (1) TDDDG does not apply, as no information is stored or read on your device in the default state.
• After your consent („Accept all“): We upgrade via gtag('consent', 'update', 'granted') to full conversion tracking. In doing so, conversion cookies (max. 90 days, Google default) are set and conversions are individually attributed to your visit. Legal basis: consent (Art. 6(1)(a) GDPR + § 25 (1) TDDDG) via our cookie banner.

Data transfer to the USA: transfer to the USA on the basis of the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Google LLC is certified) as well as additionally on the basis of EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021).

Withdrawal / objection: You can withdraw your consent at any time via „Cookie settings“ in the footer — from the withdrawal onwards no more full conversion cookies are set and we send Google only cookieless pings. If you do not want these either (Art. 21 GDPR objection against legitimate interest), an informal email to software@lindoza.com suffices. Additionally, you can deactivate ad personalization in your Google account at myadcenter.google.com. Further information in the Google privacy policy.

Data minimization: We have configured the tag with send_page_view: false — gtag sends no automatic page-view beacons. Google receives data exclusively when an explicit conversion event is triggered (currently: successful sign-up in onboarding). On no page — neither the landing page nor the logged-in app area — are URLs, click paths, contents of your sessions, personas, transcripts or voice audio transmitted to Google.

11.4 Product analytics & error tracking (PostHog)

To improve our public marketing pages we use PostHog. Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data processing takes place in the EU cloud (region eu.i.posthog.com); PostHog Inc. is based in the USA as the parent company.

Where & when: PostHog loads exclusively on our public marketing pages (home page, legal texts) and only after your consent. In the logged-in app area no PostHog runs — there no product events, interactions or sessions are recorded whatsoever.

What we record:

• Page views & interaction metadata (autocapture: which buttons/links are clicked) on the marketing pages.
• Session replays: recording of mouse, scroll and click interactions on the marketing pages. All input fields are masked — entered contents are not recorded.
• Error traces (JavaScript exceptions) for stability improvement. Sets first-party analytics cookies (ph_*).
• No voice audio, no persona contents, no transcripts — these arise exclusively in the app area, in which PostHog does not load at all.

Legal basis: consent (Art. 6(1)(a) GDPR + § 25 (1) TDDDG) via the cookie banner. Before your click on „Accept all“, no PostHog script loads, there is no connection to PostHog servers and no transmission of your IP address.

Data transfer to the USA: main processing takes place in the EU cloud. Insofar as PostHog Inc. (USA) receives data as the parent company, this happens on the basis of the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, PostHog is certified) as well as EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021).

Retention period: event data max. 12 months, then automatic deletion or aggregation.

Withdrawal: cookie consent can be withdrawn at any time via „Cookie settings“ in the footer. After withdrawal, no further events or session replays are recorded.

11.5 Pseudonymous first-party cookies (lz_anon, lz_attr)

In addition to the cookies listed under 11.1 we set two of our own, purely pseudonymous cookies. Both are first-party cookies of lindoza.com, are httpOnly and SameSite=Lax, expire after 180 days, are never shared with third parties and do not allow cross-site recognition.

lz_anon — pseudonymous visitor ID: a random identifier (UUID) with no personal reference. It connects the steps of one visit (page view, button click, sign-up) and serves as the bucketing key for our A/B tests. It contains no name, no email address and no device identifiers. On our landing pages we also record under this ID whether someone scrolled at least one screen height and whether the page was visibly open for 15 seconds, each with the page visited and whether it was opened inside the Instagram, Facebook or TikTok app. This shows us whether a page gets read or left right away. No other content, click paths or screen recordings are captured.

lz_attr — origin of the first visit: records how somebody found us: a channel classification (e.g. “Google Ads”, “organic search”, “direct”), the UTM parameters of the address called up, the advertising platforms’ click identifiers (gclid, gbraid, wbraid, msclkid), the referrer host (the domain only, e.g. “google.com”, never the full address), the first page visited and the timestamp. The cookie is written only on the very first visit and never overwritten afterwards. If somebody signs up later, this origin is recorded once against the account so that we can evaluate which channels actually bring users.

Where they are set: on all pages of lindoza.com including the blog (/blog/…) and the tools (/tools/…). On blog and tools pages only lz_attr is set, no visitor ID.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring which channels lead to our offering and in improving it). Objection: you can delete or block both cookies in your browser at any time; using the website and app is not affected.

12. Voice AI: what we protect in particular

Your voice and your descriptions of other people are the most sensitive things that reach us. We commit to:

• No training use — neither Lindoza nor our sub-processors train AI models with your data.
• Audio is not stored — your voice is only processed live for transcription and not retained; only the transcript is persisted (as long as you keep it).

12.1 Persona data of third parties (Art. 14 GDPR)

Lindoza is a practice room: you create personas with whom you practice. Insofar as you enter data of real third parties (boss, partner, family members) in doing so, the following applies:

• You are the controller (Art. 4 (7) GDPR) for the contents of your persona descriptions. Lindoza acts in this respect as a processor (Art. 28 GDPR) — we process this data exclusively to provide the practice function according to your inputs.
• Please do not use real names or clearly identifiable details of third parties — they have not authorized us to do so. Pseudonyms, initials or nicknames are sufficient for realistic practice.
• We do not analyze persona contents to identify third parties, do not pass them on to external recipients (beyond the sub-processors named in section 7) and do not use them for our own purposes.
• Informing all potentially affected third parties pursuant to Art. 14 GDPR is impossible for us due to a lack of contact data; in this respect we rely on Art. 14 (5)(b) GDPR (disproportionate effort) and document this balancing internally.

12.2 Camera analysis on your device (optional)

Before each round you can choose “audio only” (default) or “with camera”. Only with the camera and only after your consent does the following apply:

• What is measured: visible behaviour during your answers — eye contact with the camera, smiling, head movement and facial movement (eyebrows and mouth), plus the technical light and sharpness of the image. After the round, hands and posture are added from the recording: whether a hand touches your face, hair or neck, whether your arms are crossed, whether your upper body sinks during the round, how much you gesture while speaking and whether your hands are in the picture. We do not infer emotions, personality or health from it, say nothing about appearance, body or clothing, and do not identify you by your face.
• Where: only on your device, in your browser. We use the open-source library MediaPipe (Face Landmarker during the round; Pose Landmarker and Hand Landmarker for the follow-up analysis after the round). We serve the program and the models ourselves from lindoza.com, not from Google servers; the usage reports to Google built into the library are technically blocked. No image, no video and no facial or body points leave your device (the only exception, with separate consent only: still images of key moments, section 12.3). Your AI conversation partner does not receive a camera image; the image is not sent to LiveKit or to our analytics tools either (session replay masks it).
• Recording on your device: with the camera on, your browser records the round (picture only; with “Keep recording to watch” picture and sound, including your AI conversation partner’s voice) and stores it only locally in its storage (IndexedDB) under lindoza.com, because the follow-up analysis of hands and posture runs on this recording after the round. It starts as soon as you open the round’s feedback on this device; if you close the page before it finishes, it resumes the next time you open it. The recording is not transmitted to us or to third parties; we have no access to it. If “Keep recording to watch” is off, Lindoza deletes it as soon as the follow-up analysis is done (with “Analyse key moments in more detail”, only once the still images have been sent too, see 12.3), at the latest after 24 hours the next time you open the app on this device. If the switch is on, you can watch, download and delete it at any time in the round’s feedback — but only on the device you practised with; Lindoza deletes it after 7 days the next time you open the app on this device. In both cases Lindoza deletes it immediately when you log out on this device, delete your account or withdraw your consent. Downloaded files stay with you; Lindoza does not delete them. Your browser may also delete local data itself (for example when you clear site data or storage runs low).
• What is stored: a handful of numbers per answer (e.g. “looked into the camera 82% of the time”, average smile, head movement in degrees per second; from the follow-up analysis e.g. share of time with a hand at the face, with crossed arms, with gestures while speaking) with the respective answer of your round (Supabase, Frankfurt), plus the time and version of your consent and your most recent choice.
• In rehearsals of a presentation: The same camera analysis is available in the run-through, in partial rehearsals and in the dress rehearsal. There the numbers apply per section of your talk instead of per answer and are stored with the rehearsal. In addition, your browser finds the stressed points in your voice and checks in the follow-up analysis whether a hand movement falls on them (“gesture on stress”); the points in time stay on your device, only the count per section is stored (e.g. “a gesture at 5 of 12 stressed points”). With “Keep recording to watch”, the local recording contains the sound of your own microphone. As with every rehearsal, the audio for speech recognition goes to Deepgram (EU endpoint) and is deleted afterwards; it is never stored.
• Recipients: to create your feedback, these numbers are sent together with the round’s transcript to Anthropic (USA); for the transfer to the USA see section 8. Image, video and recording are not sent to anyone (exception with separate consent: section 12.3).
• Purpose: feedback on how you come across visually, in your feedback.
• Legal basis: your consent (Art. 6(1)(a) GDPR). It is voluntary; without it every round runs with audio only, without any disadvantage.
• Retention: the numbers remain in your feedback until you delete your account. They are included in the data export (Settings).
• Withdrawal: at any time under Settings → Privacy, with effect for the future (Art. 7(3) GDPR). Afterwards every round starts with audio only; in a round that is already running, no more numbers are stored from that moment on, and the camera switches off after your next answer, or at the latest when the round ends.

12.3 Still images of key moments (optional, separate consent)

Only if you additionally switch on “Analyse key moments in more detail” under “With camera” and give separate consent do individual images leave your device. Then:

• What: after the round, Lindoza picks at most 12 moments from your feedback and the camera numbers (for example opening, close, strongest moment, turning point, looking away, hand at face or crossed arms, sinking posture). Your browser cuts three still images at each moment from the recording on your device (just before, during, just after; at most 36 images, long side at most 768 pixels) and sends them to Lindoza together with the text of your answer at that point and the question before it — only from the device you practised on, and only while the recording is still there. Without “Keep recording to watch”, the recording stays on your device after the follow-up analysis until the images have been sent, for at most 24 hours.
• Background blurred: Your device blurs the background before an image leaves it: Lindoza keeps only you sharp and blurs other people, photos, posters, screens and writing in the room. If this cannot be done reliably, the image does not leave your device. It cannot be ruled out entirely that more stays sharp: what you wear or hold stays visible; parts of the room right next to you may stay sharp, especially busy patterns and writing (such as a logo wall); and a person directly beside or behind you may stay sharp if their face is not detected, or yours is not at that moment. If someone else is in the picture, better leave the switch off for that round. This happens entirely in your browser with a model that Lindoza serves itself; no request goes to third parties for it.
• Recipient: Lindoza passes images and text on immediately to the AI model of Anthropic (USA). This is a transfer to the USA (see section 8). The provider processes them to write the observations. Anthropic may keep them for a limited time under its terms, for example to detect misuse; we currently have no commitment that it does not keep them at all.
• What is stored: only the text of the observations (at most one per moment, with moment and position in your recording) with your round (Supabase, Frankfurt), plus the number of images, model, cost and the time and version of your consent. Lindoza does not store the images — not in the database, not in logs, not in analytics or error tools.
• Content: Lindoza instructs the AI model to describe only behaviour (gaze, gestures, posture, facial movement) and technical points (light, framing), and before storing discards every observation in which it detects statements about emotions, appearance, clothing, body, health, age, gender, sexual identity, origin, religion or belief, disability or other people. Individual mistakes are still possible; mark them as “Not accurate”. The observations do not count towards any progress or profile.
• Purpose: more detailed feedback on your visible presence at individual moments.
• Legal basis: your consent (Art. 6(1)(a) GDPR). It is voluntary; without it every image stays on your device, with no disadvantage.
• Retention: the texts stay with your round until you delete it or your account. They are included in the data export.
• Withdrawal: at any time under Settings → Privacy, also on its own; afterwards no image leaves your device any more, not even from rounds already recorded. Withdrawing the camera consent ends this consent as well.

13. Security

We encrypt your data in transit (TLS 1.2+, DTLS-SRTP for voice) and at rest (AES-256 in our EU databases). Access to the system is secured by multi-factor authentication, role-based access control and audit logs.

14. Data protection impact assessment (DPIA, Art. 35 GDPR)

Due to the systematic processing of biometric data (voice audio), the use of new AI technologies (LLM, TTS, STT) and the sensitivity of the typical conversation contexts (conflict, relationship, mental health), Lindoza carries out a data protection impact assessment pursuant to Art. 35 GDPR and updates it regularly. Result: the identified risks are manageable through the measures named in section 7 (DPA + SCCs), section 12 (persona notices) and section 13 (encryption). We make a summary of the DPIA available on request in the case of a legitimate interest at software@lindoza.com.

15. AI transparency under the EU AI Act (Art. 50)

Lindoza uses generative AI (Anthropic Claude for role-play responses; ElevenLabs for speech synthesis; Deepgram for speech recognition). In every practice session you are talking to an AI, never to a human. The responses of your persona are algorithmically generated.

This transparency obligation arises from Art. 50 of Regulation (EU) 2024/1689 (EU AI Act), which is fully applicable to affected AI providers from 02.08.2026. We label all AI outputs accordingly and ensure that synthetic audio remains recognizable as such.

16. Changes to this privacy policy

We update this policy when something changes in our data processing (new sub-processor, new function). We communicate substantial changes by email to all users. You can always see the currently valid version here with the update date at the top.

Last updated: 04.10.2026. If you have questions, write to us at software@lindoza.com.