Privacy Policy

Last updated: 6 July 2026

This Privacy Policy explains how SpiraLink BV ("SpiraLink", "we", "us") collects, uses, shares, and protects personal data when you visit spiralink.ai, submit a form, try the live voice demo, or otherwise interact with us through this website. We wrote it to be complete and readable. If anything is unclear, write to us at info@spiralink.ai.

1. Who is responsible for your data

SpiraLink BV is the data controller for the processing described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR).

2. Scope

This policy covers the website at spiralink.ai and its subdomains used to operate it, including the form service and the live voice demo. It does not cover the separate agreements we conclude with business clients for the voice AI services we build and operate for them; those are governed by their own data processing agreements.

3. What data we collect, and why

3.1 Demo request form

When you request a free tailored demo, we collect the details you enter: name, work email, phone number (optional), company, region, monthly call volume (optional), call type, where you found us, and your preferred go-live timing. We use this to assess your request, prepare and deliver the demo, and contact you about it.

Legal basis: Article 6(1)(b) GDPR, steps prior to entering into a contract taken at your request, and Article 6(1)(f), our legitimate interest in responding to business enquiries.

3.2 Contact form

When you use the contact form, we collect your name, email address, company (optional), the question type you select, and your message. We use this to answer you.

Legal basis: Article 6(1)(b) and 6(1)(f) GDPR, as above.

3.3 Live voice demo

The website includes a live demo where you can speak with a voice agent we built. Before a call starts, you are shown a notice and asked to agree. During a call we process:

• your microphone audio for the duration of the call;
• a live transcript of the conversation;
• the region and language you selected;
• technical data needed to establish the call.

Calls may be recorded for quality purposes, as stated in the notice before you start. Calls are limited to three minutes. You can end a call at any time.

Legal basis: Article 6(1)(a) GDPR, your consent, given when you press "I agree" before the call. You can withdraw consent for future processing at any time by ending the call and not starting a new one, or by contacting us.

Transparency: the demo connects you with an AI voice assistant, not a human. This is disclosed before every call.

3.4 Abuse prevention on our form service

When you submit a form, our form service processes your IP address and browser user agent to prevent spam and abuse (for example rate limiting and duplicate detection). These details are included in the internal notification email so that we can investigate misuse.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in keeping the service secure and usable.

3.5 What we deliberately do not do

• We do not set tracking cookies on this website.
• We do not run advertising trackers or third-party analytics scripts.
• We do not sell personal data. Ever.

4. Where your data is processed

The website and our form service are hosted on infrastructure in the European Union (Hetzner, Germany). Emails triggered by the forms are delivered through Resend, our email delivery provider. The live voice demo runs on real-time call infrastructure in the region you select before the call: if you select EU, call media is processed in the European Union; if you select a US region, call media is processed in the United States.

5. Who we share data with

We share personal data only with service providers that help us operate this website, and only to the extent necessary:

• Hosting: Hetzner Online GmbH (Germany), for the website and form service.
• Email delivery: Resend, to send form notifications and confirmations.
• Real-time call infrastructure: providers that carry the audio of the live demo in the region you select.
• Scheduling: if you book a call through our booking link, the booking provider (Cal) processes the details you enter there under its own privacy policy.
• Video: if a product video is present on the page, it is embedded through YouTube's privacy-enhanced mode and loads only after you click play. At that point YouTube (Google) may process data under its own policy.

Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

6. How long we keep data

• Form submissions: kept as email in our business mailbox for as long as needed to handle your enquiry and any resulting business relationship, and then deleted in our periodic clean-ups.
• Demo call audio and transcripts: kept briefly for quality review and then deleted.
• Abuse-prevention data: rate-limit and duplicate-detection entries are held in memory for at most one hour and are not written to a database.

You can request earlier deletion at any time (see section 7).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing before withdrawal.

To exercise any of these rights, email info@spiralink.ai. We respond within one month. You also have the right to lodge a complaint with a supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit), gegevensbeschermingsautoriteit.be.

8. Security

All traffic to and from this website and our form service is encrypted in transit (TLS). Access to submitted data is limited to the people at SpiraLink who need it to handle your request. Our services apply rate limiting and abuse detection to protect against automated misuse.

9. Children

This website is aimed at businesses and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the website or our services change. The date at the top tells you when it was last revised. Meaningful changes will be visible on this page.

Questions about this policy or about your data: info@spiralink.ai.