PolyphonOS Privacy Notice

Version dated 21 October 2026.

1. Who is responsible

Polyphonos OÜ, registration number 17497507, VAT ID EE103025940, Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond 10117, Estonia, is the controller for this website and for its own business-contact, account-administration, billing, security, and service-operation data. Contact: [email protected]. This notice explains those activities and our role when an organization uses a separate PolyphonOS tenant application.

The organization operating a tenant may act as controller for its own contacts, messages, documents, and workflow data, or as processor for its own client. Its role is stated in the accepted order. PolyphonOS processes that Customer Personal Data on documented instructions as processor or subprocessor, respectively, under a Data Processing Agreement. The relevant controller's privacy notice, not this website notice, explains the purposes and legal basis for that data. Please contact that organization first about its messages or records. We will help it handle requests under the agreement.

2. Website visits

Website requests pass through Cloudflare before reaching the origin server. Cloudflare processes connection data to deliver and protect the website, as described in section 7, on the basis of Article 6(1)(f) GDPR (our legitimate interest in a secure, working website).

When you visit this informational website, the origin server receives the IP address, requested page, date and time, browser or device information, and technical error or security events. The website container can also record request and error events. We use these data to deliver the page, protect the service, diagnose failures, and prevent abuse (Article 6(1)(f) GDPR, our legitimate interest in a secure, working website). The website container keeps no more than three 10 MB routine log files; older entries are overwritten as files rotate by size, so their calendar duration varies with traffic. Origin access and error records are retained for site security and fault diagnosis until the applicable server rotation or deletion process removes them; records needed for an incident, legal duty, or claim may be preserved separately until that matter ends. We do not state a fixed calendar maximum for origin records without a verified host policy. We do not run website analytics, advertising trackers, or nonessential cookies. The website's Inter and DM Sans fonts are served from our own website files; your browser does not need to request them from Google Fonts.

3. Inquiries and business relationship

If you email us or use our contact or order form, we process your name, email address, company name where supplied, message, plan preferences, and related correspondence to answer the inquiry and follow up on a requested trial or contract. Form submissions pass through our Platform service to our business mailbox; we send a receipt to the address supplied and a copy to our team. Our basis is Article 6(1)(f) GDPR for ordinary business inquiries, or Article 6(1)(b) where the person is the contracting party or requests pre-contract steps. Business contact details, order records, invoices, and payment information are processed to perform and administer a contract (Article 6(1)(b), where applicable), to comply with accounting and tax obligations (Article 6(1)(c)), and to maintain reasonable business records and handle claims (Article 6(1)(f)). We do not sell contact data.

4. Tenant accounts and service operation

For authorized tenant users, we process account identifiers, contact details, roles, authentication and access records, support requests, security events, and usage records needed to operate and secure the service, provide support, calculate agreed charges, prevent abuse, and maintain an audit trail. The usual basis for PolyphonOS-controlled administration and security processing is Article 6(1)(f) GDPR: our legitimate interest in operating and protecting the contracted business service. Accounting or other legally required records are processed under Article 6(1)(c). An employee of a business customer is not personally party to our B2B service contract merely because they have an account; we do not rely on Article 6(1)(b) for that account on that basis. The customer organization decides which users have access and is responsible for informing its staff about its own processing.

When acting as a processor for a tenant, we may receive instructions, conversations, uploaded files, customer records, communications, and workflow inputs or outputs. The precise categories depend on the enabled functions and the organization's use. We do not use Customer Personal Data for our own marketing or train our own general model on it. We process it to deliver the contracted service, including permitted integrations and AI inference, subject to the organization's instructions and the Data Processing Agreement.

5. Where data comes from, and what is required

We receive information directly when you visit the site, send a form, email us, or use an account. A customer organization or its administrator can supply a user's name, work email, role, and access entitlement when inviting that user. Enabled identity, communication, document, or other connected services can supply identifiers, messages, files, and events that the organization has authorized us to receive. For PolyphonOS-controlled business administration, we may receive a contact's professional details from the customer organization or its representatives. Tenant conversation and document data received from third parties remains under the customer organization's controller instructions; that organization must give the relevant Article 13 or 14 notice to affected people.

A browser must transmit its IP address and requested resource to receive the website; without those data we cannot deliver the page. Sending an email or form inquiry is optional, but we cannot reply without a return address and enough information to understand the request. A user's work identity and authorization are needed to give them tenant access; without them access cannot be granted. Business identity and invoice information required by law or an accepted order must be provided for us to contract and bill. Other optional details need not be supplied unless a specific enabled workflow requires them. We do not obtain a person's data from a public list merely because they have not contacted us.

6. AI and connected services

An enabled AI task can transmit the task-relevant prompt, conversation context, document excerpt, image, tool result, or generated output to an authorized inference service. PolyphonOS routes AI requests through its AI Runtime, which applies the configured tenant and provider policy. An OpenRouter-routed request passes through OpenRouter and an eligible underlying model provider; other authorized routes may use DigitalOcean or a verified Azure deployment. A channel integration such as WhatsApp, where the organization authorizes it, exchanges the message and delivery data needed to operate that channel with its provider. We do not represent a planned integration as already enabled for every tenant.

During a pilot, SMS and voice channels require the organization's express order and authorization. The communication service can use Twilio to send or receive messages and calls and to receive delivery or call events. The data can include sender and recipient phone numbers, message text, call audio or other voice content where the selected function uses it, call and message identifiers, timestamps, status, and related technical data. These can be Customer Personal Data. Twilio also processes certain account and communications usage data for its own purposes under its published terms. The current SMS and voice adapters call Twilio's standard API endpoint. Twilio's region documentation identifies US1 as the default processing region unless a supported regional route is configured. Processing in the United States is therefore possible for an enabled channel; handling by telecommunications networks and support personnel may also occur outside the EU. Even supported regional processing does not make all account and usage data EU-only. The customer's processing schedule must identify the enabled channel, provider, data, locations, and any required transfer safeguard. An EU-only commitment for another tenant function does not silently extend to a separately authorized phone channel. The organization must give affected people the notices and obtain any consent or other lawful basis required for the communication. A later order must separately define the channel's scope.

During a pilot, general, reusable Talent development may use developer subscription tools outside the EU only after an independent review of source and content verifies that the exact material contains no customer-provided or customer-derived data, customer confidential information, personal data, or information that can identify someone when combined with other reasonably available data. Customer tasks, tenant artifacts, logs, credentials, and customer-derived examples are excluded. Removing direct identifiers or pseudonymizing material alone does not make it non-personal. If the classification is uncertain, we must use an authorized EU route or pause the work. This exception does not authorize sending Customer Personal Data to a non-EU development tool.

Our OpenRouter adapter currently requests zero-data-retention and denial of provider data collection and defaults to an EU regional endpoint. These are request settings, not a guarantee of an upstream provider's retention, role, or region. OpenRouter's published EU-only API-payload addendum applies only after an election in an applicable order or other written agreement. An EU-only AI commitment can apply only to the specific route and provider arrangement documented in the Customer's accepted processing schedule and verified in the actual configuration. If that route cannot be established, the affected customer-data request must fail or wait rather than use an unapproved provider or region. Account, billing, security, support, and other operational records, and separately authorized third-party integrations, may be processed outside the selected application-server region under applicable safeguards. This Notice makes no blanket EU-only commitment for the service.

Where an organization enables voice recognition in its tenant, a voice message a user records there is compared with the voiceprints of the organization's members who have agreed to it, so that the digital employees know who is speaking and address that person. A voiceprint is a numerical representation of a person's voice and is biometric data under Article 9 GDPR. It is created and used only after that person's explicit consent, asked once in the tenant application with the options to agree, to decide later or to decline (Article 9(2)(a) GDPR); the consent, its wording version and any withdrawal are recorded. Without consent no voiceprint of that person is created and nothing about their voice is kept; a voice message is compared only with the voiceprints of members who agreed. Voiceprints are computed by a model PolyphonOS runs itself inside the organization's tenant runtime in the EU (DigitalOcean, Frankfurt), are stored there encrypted, and are not sent to any AI or other external provider; the comparison keeps its result and similarity scores, not the recording. Recognition never grants rights, never replaces a confirmation and never blocks work. A person can withdraw consent or delete their voiceprint at any time in the tenant settings; withdrawal deletes the voiceprint at once, and it is also deleted with the person's account or the tenant. The organization is the controller for this processing; PolyphonOS processes it as processor under the Data Processing Agreement.

PolyphonOS Echo Agent browser extension

If you install the PolyphonOS Echo Agent extension and approve a browser control session in the desktop app, the extension can open separate tabs in your normal Chrome profile and use that profile's existing signed-in website sessions. For the work you authorize, it can process page URLs and titles, page content, form values and browser screenshots from those tabs. This content may include personal or confidential information contained in the pages you ask an employee to use.

Requested results pass through the local Echo Agent into the paired PolyphonOS organization and its Play. The organization determines the purpose of that work. The results are processed under its instructions and the applicable service agreement, including enabled AI processing used to carry out the task. Retention and deletion follow that organization's instructions and agreement rather than one universal period for every organization.

The extension does not receive the Agent's workspace credential and does not extract saved website credentials through a cookies API. The browser profile supplies the existing website sessions. The extension adds no advertising, analytics or separate telemetry endpoint, and PolyphonOS does not use these browser results for its own marketing.

You can stop browser control from Echo Agent, the extension or Chrome's debugger indicator. Uninstalling the extension stops future extension connections; it does not erase results already saved in the organization's Play. For access or deletion of those results, contact that organization. You can also contact PolyphonOS at the contact address stated in this policy so that we can identify the appropriate controller and handle requests concerning PolyphonOS-controlled service data.

Google user data

An organization can connect its Google account in its tenant so that its digital employees can work with Google Analytics, Google Search Console and Google Ads for it. The person who connects signs in with Google and grants the access PolyphonOS requests: viewing Google Analytics data, viewing and managing Search Console data for verified sites, and viewing and managing Google Ads accounts. PolyphonOS keeps the resulting access credentials in the tenant's encrypted credential store and uses them only when an employee of that organization works on a task that needs Google, for example to read a site's traffic or search performance, to report on an Ads campaign, or to change a campaign when a user of that organization asks for it. Data read from Google is used to carry out that task and to show its result to the organization's users. As part of the task it can be processed by the AI services described in this section.

PolyphonOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, we do not use it for advertising, and we do not use it to develop, improve or train generalized AI or machine learning models. We transfer it only as needed to provide the features the organization uses, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users. Our staff read Google user data only with the organization's permission for a support case, when it is necessary for security or to comply with applicable law, or when the data is aggregated and anonymized for internal operations. The organization can disconnect Google in its tenant at any time, and the person who granted access can also revoke it in their Google account at myaccount.google.com/permissions.

7. Recipients, locations, and transfers

We use Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, for both this website and customers' tenant domains. Cloudflare provides content delivery (CDN), DDoS protection, a web application firewall (WAF), TLS termination, and the protected tunnel to tenant servers. It processes connection data including IP addresses, request metadata, TLS handshake data, and security events. Cloudflare acts as our processor for website connection data and as a subprocessor where we process tenant connection data on a customer's behalf. Processing may take place outside the EEA, including in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF); transfers covered by that certification rely on the DPF. For restricted transfers, its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses (Module 2 for controller-to-processor transfers and Module 3 for processor-to-processor transfers), including as a fallback if its DPF certification ceases to be valid. Further information is available in Cloudflare's Privacy Policy.

Our website and tenant applications use hosting and infrastructure providers. The current tenant application servers are placed in DigitalOcean's Frankfurt region. DigitalOcean acts under its Data Processing Agreement for hosted customer data; its separate Privacy Policy describes account and business-operation data, and its subprocessor list identifies supporting providers, some outside the EU. Enabled AI and communication functions use the providers described above and in the customer's current processing schedule. Website form receipts and internal copies are sent through our configured business email service using Microsoft Graph; email delivery and associated account records are governed by that service arrangement, separately from tenant AI routing. OpenRouter's Terms, Privacy Policy, and Data Processing Agreement describe its gateway processing and separate account operations. Twilio's Data Protection Addendum, Privacy Notice, and subprocessor list describe its service, account, usage-data, and onward processing for an enabled SMS or voice route. These supplier documents do not replace our obligations to the Customer. Access is limited to authorized staff, advisers, and suppliers who need it for the relevant purpose and are subject to appropriate duties. We may disclose information to authorities where law requires it. Frankfurt tenant hosting does not by itself establish EU-only processing across all suppliers, support operations, account records, and integrations.

Before activating a customer-data route that requires a transfer outside the EEA to a destination without an adequacy decision, we must document a valid Chapter V GDPR transfer mechanism, such as the European Commission's Standard Contractual Clauses, and any required assessment and supplementary measures in the customer's processing schedule. If those prerequisites are not met, that route is not authorized for Customer Personal Data. A contractual statement or server location alone is not a substitute for that mechanism. You can request information about the applicable transfer safeguards from us.

8. Retention and deletion

Website container logs follow the size-based rotation described in section 2. Origin access and error records follow the retention criterion described there; a verified calendar maximum is not yet available. We keep an inquiry while it is open, then delete it when the follow-up or any resulting contract, complaint, or legal claim no longer requires it. If it becomes part of an order, we keep the relevant correspondence with that order. Accounting source documents and business records needed to reconstruct a transaction are kept for seven years after the end of the relevant financial year under the Estonian Accounting Act §12. Documents relevant for tax are generally kept for at least seven years from 1 January of the year after they were prepared or received under the Taxation Act §58. Records of long-term obligations may require seven years after the obligation expires. We then delete them unless a longer legal duty, open claim, or preservation order applies. Tenant-user access is removed when the customer revokes it or the service ends. General tenant audit and security records have no repository-configured time-based purge; they are kept while the relevant tenant or project remains active to document actions and protect the service. On project or tenant deletion, and after service termination, their return or deletion follows the accepted processing schedule and the Data Processing Agreement. Records needed for an open incident, legal duty, preservation order, or claim may be retained until that reason ends. There is no verified universal maximum for these records. We review retained material against these purposes and delete it when the applicable purpose or legal duty ends.

Customer Personal Data is retained and deleted according to the customer's instructions, the agreed service configuration, the Data Processing Agreement, and any legal preservation duty. Some temporary uploads have shorter technical expiry; owner-managed records and audit evidence can have different retention settings. On termination, export, deletion, and any legally required residual records follow the agreement and the relevant provider's documented procedures. Backup copies, if enabled for the ordered service, follow the verified backup and deletion schedule in that order. There is no single retention period for every tenant or provider.

9. Your rights

Under the GDPR, where the conditions apply, you can request access, rectification, erasure, restriction, portability, and information about transfers. You may object to processing based on legitimate interests, and you may withdraw consent for processing based on consent without affecting earlier lawful processing. You may complain to a supervisory authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your habitual residence or workplace. Contact [email protected] for PolyphonOS-controlled data. For data held in an organization's tenant, contact that organization; we will forward or assist with your request where appropriate.

10. Updates

We will update this notice when processing changes materially and give additional notice where law requires. A change to this notice does not by itself change an accepted customer agreement or authorize a new processing purpose.