Privacy Policy

1. The short version#

• We do not sell personal data, and we do not use it for targeted advertising.
• Our websites use no advertising or analytics cookies.
• We use a person's face or voice to create an avatar or a voice only with a recorded confirmation of consent, and we never use them to identify people.
• Video from your camera is analysed on your own device and is not sent to us, except when an organisation records a job interview with the candidate's agreement.
• Conversations with avatars in Zentiq accounts are kept as written transcripts. We do not keep audio or video recordings of them, except job interviews that the hiring organisation chooses to record.
• We do not use your content or conversations to train AI models for other customers.

2. Who we are and how to contact us#

Zentiq is the controller of the personal data described in this policy, except where we act for a customer as explained below. You can contact us about privacy at privacy@zentiqai.com. Our company details are on our Company information page.

Representative in the European Union

for matters relating to the European Union, contact us at privacy@zentiqai.com

Representative in the United Kingdom

for matters relating to the United Kingdom, contact us at privacy@zentiqai.com

Data protection contact

Our privacy team, at privacy@zentiqai.com

3. The personal data we collect#

You need to give us your email address to create an account, and billing details to buy a paid plan; without them we cannot provide those services. Everything else is optional, although some features need it to work. Please do not give us sensitive information, such as health, financial or government identity details, unless a feature asks for it. Conversations can reveal sensitive information if you choose to share it; we use it only to provide the conversation you asked for.

4. How we use personal data, and our legal bases#

If you are in the European Economic Area, the UK or Switzerland, the law requires a legal basis for each use of your personal data. This table sets out our purposes and the basis we rely on.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see Your rights). Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it and include an easy way to unsubscribe.

5. Faces, voices and biometric information#

Custom avatars and voices are made from photos, video or voice recordings of real people. Some laws, such as the Illinois Biometric Information Privacy Act, the Texas and Washington biometric privacy laws and US state privacy laws, treat face and voice data used in this way as biometric information, so we explain here exactly how we handle it.

• Consent first. Before a face or voice can be used, the person adding it must confirm consent in the product: that it is their own face or voice and they agree, or that the person shown has given consent. We record the exact wording and its version, who confirmed it, when and where, and a hashed IP address. Voice cloning is refused without this confirmation.
• Purpose. We use face and voice data only to create and run the avatar or voice it was added for, for the organisation or person that added it. We do not use it to identify or verify anyone, to recognise faces or voices, or to create templates for that purpose.
• No sale. We never sell, lease or trade face or voice data, or otherwise profit from it, and we disclose it only to the service providers that help us create and run avatars and voices, or where the law requires it.
• Withdrawing consent. When consent is withdrawn, the avatar or voice stops being used in new sessions straight away, and we delete the working copies of the face or voice held in our file storage and on our video-generation servers. The consent record is kept as evidence that consent was given.
• Deleting. A customer can delete an avatar's photo from the console at any time. You can also ask us to delete face or voice data at privacy@zentiqai.com, and we will do so within 30 days, unless the law requires us to keep it.
• Retention and destruction schedule. We permanently destroy face images, voice recordings and anything derived from them when the purpose for which they were collected has been fulfilled, which happens when the avatar or voice is deleted, or the customer's account is closed, or consent is withdrawn and the organisation or person no longer needs the material. In every case we destroy it no later than three years after the individual's last interaction with Zentiq, or sooner where a law requires it (for example, within one year after the purpose ends where Texas law applies). Copies in backups are deleted as those backups expire.
• Security. We protect face and voice data with at least the same care as our other confidential information (see our Security page).

6. Conversations and recordings#

• Live processing. When you talk to an avatar, your voice, and the words you type, are processed as you speak by our servers and our AI service providers, so that the avatar can understand and answer you. Live audio is not stored.
• Transcripts and reports. We keep a written transcript of avatar conversations, together with any summary, score, report or certificate the conversation produces, so that you, or the organisation that set up the avatar, can review them.
• Recordings of job interviews. Audio and video are recorded only in job interviews, and only when the hiring organisation turns recording on. The candidate is told before the interview starts and must agree. Recordings are stored in private storage and can be played only through short-lived links, and every viewing is logged.
• Safety. In conversations that organisations set up, the words of learners and visitors are checked for signs that someone may be at risk (for example of self-harm or abuse). A possible concern is checked by an AI model, and confirmed concerns are shown to the organisation's safeguarding contacts so that a person can follow up.

7. Your camera#

Some features use your camera, only after you switch the camera on. The video is analysed by software running in your browser and is not sent to us. The software itself is downloaded from third-party content delivery networks, which receive your IP address.

• Testing an avatar in the console. When you test an avatar with your camera on, the software notices whether you are in view, whether you are looking at the screen, and gestures such as nodding. It reads facial expressions only if you switch on expression reading, which is off by default. A short text description (for example, that you are in view and smiling) is sent to the avatar's AI so that it can respond naturally, and may be kept in the conversation transcript. You must be 18 or older, or a parent or guardian agreeing for a child, to switch the camera on.
• Camera tips in workplace training. If a learner chooses to switch them on, camera tips measure things like eye contact with the camera, staying in frame and movement. Only the resulting numbers are saved in the session report. Camera tips are never offered to children, in schools, tutoring or family accounts, or in job interviews or assessments.
• Job interviews. During an interview, software on the candidate's device counts the faces in view to help keep the interview fair. If the hiring organisation records the interview, the video recording is kept as described in Conversations and recordings.

8. AI and automated decisions#

Our avatars use AI to hold conversations. We do not use AI to make decisions about you that have legal or similarly significant effects. We give early-access requests a score to help us decide in what order to reply, and a person reviews every request.

Organisations that use Zentiq may use AI scores, for example to rate interview answers or assessments. In job interviews, our product lets only a person on the hiring team record a decision, and a candidate's interview must be opened or reviewed before a decline can be recorded. The organisation is responsible for its decisions and for the human review the law requires.

9. Who we share personal data with#

• Service providers. Companies that host, store, process and deliver data for us, including cloud hosting and storage, video-generation servers, AI service providers for speech, language and voice, email delivery, error monitoring and payments. They may use the data only to provide their services to us. Our Sub-processors page lists their categories and locations.
• Your organisation. If your account belongs to an organisation, its owners and administrators can see your account details and activity, and the data held in its account.
• Payment and sign-in providers you choose. If you pay us, or sign in with a third-party account, those providers process your data under their own privacy notices.
• Professional advisers and insurers, under duties of confidentiality.
• Authorities and others where the law requires it, or where it is necessary to protect the rights, property or safety of anyone.
• A buyer or successor, if our business or its assets are sold or reorganised, subject to this policy.
• Anyone else, with your consent.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

10. When we act for our customers#

When a business, school or other organisation uses Zentiq to talk with its learners, staff, website visitors, job candidates or students, that organisation is the controller of their personal data (a "business" under US state laws), and we are its processor ("service provider"). We process that data only on the organisation's instructions and under our Data Processing Addendum. The organisation decides, for example, whether conversations are recorded, how long they are kept, and who in the organisation can see them.

If you are an individual or family using your own Zentiq account for personal purposes, we are the controller of the personal data in your account, including your conversations and anything you upload.

11. International transfers#

We and our service providers process personal data in the United States, Singapore and Canada. To keep delays short, live audio and video may also pass through servers in other countries, including in the European Union. These countries may not have the same data protection laws as yours.

When we transfer personal data out of the European Economic Area, the UK or Switzerland, we protect it with an adequacy decision where one exists (such as for Canada), or with the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with further safeguards where needed. You can ask us for a copy of the relevant safeguards at privacy@zentiqai.com.

12. How long we keep personal data#

We keep personal data only for as long as we need it for the purposes described in this policy, or as the law requires. We delete data on request where the law gives you that right, and we tell you if we must keep something.

13. How we protect personal data#

We use technical and organisational measures appropriate to the risk, including encryption in transit, role-based access, single-use sign-in codes, private storage with short-lived links for recordings, and hashing of IP addresses in consent and usage records. Our Security page describes them. No system is completely secure, so please tell us at privacy@zentiqai.com if you think your data has been put at risk.

14. Your rights#

In the European Economic Area, the UK and Switzerland#

You have the right to access your personal data, to have it corrected, to have it erased, to restrict how it is used, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, subject to the exceptions in the law.

In the United States#

Depending on the state where you live (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you may have the right to know what personal data we hold about you and how we use it, to access it, to have it corrected or deleted, to receive a portable copy, and to opt out of the sale or sharing of personal data, targeted advertising and certain profiling. We do not sell or share personal data, or use it for targeted advertising or for profiling that produces legal or similarly significant effects, and we use sensitive personal information only for purposes the law allows, so there is nothing to opt out of or limit. We will not discriminate against you for using your rights.

How to use your rights#

• Email privacy@zentiqai.com. We may ask for information to confirm your identity, such as a code sent to your account's email address.
• You can ask someone to act for you (an authorised agent). We may ask for proof that they have your permission, and ask you to confirm your identity directly.
• We reply within one month in Europe and the UK, and within 45 days in the US. We may extend these periods where the law allows, and will tell you if we do.
• Appeals (US). If we decline your request, you can appeal by replying to our decision or emailing privacy@zentiqai.com with the subject line "Appeal". We will answer within the time your state's law allows. If you are not satisfied, you can contact your state's Attorney General.
• If your request is about data we hold for an organisation, we will pass it to that organisation and help it respond.

15. Children#

Zentiq accounts are for adults. Children use Zentiq only as learners in schools, tutoring services and family accounts that use our features for young learners. In those accounts:

• a child cannot start their first session until consent is on file: from a parent or guardian for children under 13 in the United States and the UK and under 16 in the European Union and elsewhere, or, where the law allows, from the school, which authorises the use for its educational purposes only;
• conversations are kept as transcripts only by default, camera tips are never offered, generated avatars cannot be made to look under 18, and our staff must confirm again before opening a transcript from a school or family account;
• we use children's personal data only to provide the learning service, never for advertising, and we never sell it;
• the school or family decides how long children's conversations are kept (by default one year). Until automatic deletion is switched on, children's data is kept until the school or family deletes it, or asks us to, and we delete it within 30 days of a request from the school, the family or a parent or guardian;
• parents and guardians can review or delete their child's information, or stop further collection, through the school or the family account, or by contacting privacy@zentiqai.com.

If you believe a child has given us personal data without the consent the law requires, contact us and we will delete it.

16. Notice for California and other US states#

In the last 12 months we collected the following categories of personal information, from the sources and for the purposes described above, and disclosed each of them for business purposes to our service providers, and to the organisation that manages the relevant account:

• identifiers (such as name, email address and IP address);
• customer records (such as billing details);
• commercial information (such as plans and purchases);
• internet or other electronic network activity (such as usage and connection data);
• audio, electronic and visual information (such as voice recordings, photos, transcripts and, for job interviews, recordings);
• biometric information (face images and voice recordings used to create avatars and voices);
• professional or employment-related information (such as your role, and job interview data we process for employers);
• education information (which we process for schools as their service provider);
• inferences (such as the score we give early-access requests); and
• sensitive personal information (account sign-in details, and face and voice data used to create avatars and voices).

We have not sold or shared personal information, including that of consumers under 16, in the last 12 months. We keep each category for the periods in How long we keep personal data. We do not share personal information with third parties for their own direct marketing. If you live in Washington, Nevada or Connecticut, our Consumer Health Data Notice also applies to you.

17. Complaints#

Please contact us first at privacy@zentiqai.com, so that we can try to put things right. We acknowledge complaints within 30 days and tell you the outcome. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the law was broken. In the UK this is the Information Commissioner's Office.

18. Changes to this policy#

We update this policy when our practices or the law change. We publish each new version here with a new date, and we tell account holders about significant changes by email or in the product before they take effect.