Privacy Policy — OnVoice
Last updated: July 16, 2026
This notice describes how personal data of visitors of onvoice.io and users of the OnVoice mobile app is processed under Regulation (EU) 2016/679 ("GDPR").
1. Data Controller
The data controller is Claudio Curzi, acting as a natural person.
Contact: hello@onvoice.io
2. Data We Collect — Website
a) Data you provide — waitlist form
When you join the waitlist we collect: email address (required), name (optional) and professional role (e.g. tour guide, agency — optional).
b) Direct communications
If you write to hello@onvoice.io, we process your email address and the content of your message in order to reply.
c) Browsing data
The site is hosted on Vercel and uses Vercel Analytics, a cookieless statistics tool that collects aggregated, anonymous data (page visited, country, device type). This data cannot identify you.
3. Data We Collect — OnVoice Mobile App
OnVoice doesn't require creating a password-based account: the app generates an anonymous device identifier (a random code, not linked to your identity) on first launch, used once to create or retrieve your profile server-side. From then on the app uses a server-issued user identifier, not the device ID.
a) Live broadcast audio
When you broadcast a session (as a "guide"), your microphone captures your voice and streams it in real time to participants through our audio infrastructure provider (LiveKit, Cloud or dedicated depending on the deployment — see section 6). Audio is never recorded or stored: it exists only for the duration of the live session and is destroyed when the session ends.
b) Camera
Used exclusively to scan a session's QR code ("Scan QR" feature). No photos or videos are captured or stored.
c) Profile and preferences
On first launch we ask your role (freelance guide, agency, other) to tailor the product; you may optionally provide a contact email. We also receive a referral code if you were invited by another user.
d) Session data
When you create or join a session, we store its title, type (tour/course), start/end time and join code, to compute aggregate usage statistics (e.g. how many sessions were started). This is distinct from the audio itself, which is never saved.
e) Feedback
At the end of a session you may optionally leave a rating (1-5) and a text comment, linked to the session and your profile.
f) Device permissions
The app requests: microphone (to broadcast), camera (QR scanning only, optional), notifications (to show "on air"/"listening" status while running in the background), and Bluetooth (to route audio to connected headsets/earphones). None of these permissions is used for purposes other than described here.
4. Purposes and Legal Basis
| Purpose | Legal basis |
|---|---|
| Notifying you about the OnVoice launch and offering early access (website) | Consent (Art. 6.1.a GDPR), given by submitting the form |
| Replying to your enquiries | Legitimate interest / pre-contractual measures (Art. 6.1.b/f) |
| Aggregated site usage statistics | Legitimate interest (Art. 6.1.f) |
| Providing the live audio broadcast service (app) | Performance of a contract / pre-contractual measures (Art. 6.1.b) |
| Aggregated app usage statistics and infrastructure cost monitoring | Legitimate interest (Art. 6.1.f) |
We do not perform profiling or automated decision-making. Your data is never sold or shared with third parties for marketing purposes.
5. Retention
Waitlist data is kept until the public launch of OnVoice and in any case no longer than 12 months after launch, unless you sign up for the service. Contact emails are kept for as long as needed to handle your request. Session audio is never stored. Session data (title, type, timing), profile data (role, optional email, referral) and feedback are kept for as long as you use the app or until you request deletion (see section 7).
6. Recipients and Transfers Outside the EU
Data is processed through providers acting as data processors:
- Supabase (database storing waitlist form data, user profiles, session data and feedback)
- Vercel Inc. (hosting for the site, serverless functions, and analytics)
- LiveKit (real-time audio broadcast infrastructure; depending on the session this may be the shared Cloud service, a dedicated cloud instance, or a customer's own on-premises server — audio in transit always flows through here, never stored)
Some providers may process data outside the European Union (notably in the United States). In such cases, transfers rely on appropriate safeguards under Arts. 44-49 GDPR (EU-US Data Privacy Framework adequacy decision and/or Standard Contractual Clauses).
7. Your Rights
Under Arts. 15-22 GDPR you have the right to: access your data, rectify it, erase it, restrict its processing, receive it in a portable format, object to processing, and withdraw consent at any time (without affecting the lawfulness of prior processing).
To exercise your rights, write to hello@onvoice.io. You also have the right to lodge a complaint with your supervisory authority (in Italy: Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).
8. Minors
The site and the app are aimed at professionals (guides, agencies, organizers) and are not intended for children under 16. We do not knowingly collect data from minors.
9. Changes
Any changes to this notice will be published on this page with an updated date. In case of substantial changes affecting waitlist subscribers, we will notify you by email.