Privacy policy

[Controller name to be completed] is the data controller. Address: [Address to be completed]. For privacy and support requests: [Contact email to be completed].

This notice concerns Vokamio. Base44 provides the technical platform. Its own privacy notice also applies to processing for which it acts as an independent controller, such as its own websites and platform accounts.

Lesson data: lesson identifier and version, language, selected observation, written response, simulated reaction, feedback, link to a rewritten attempt and completion date. A technical request fingerprint prevents duplicates; it is not a readable copy of the response.

Account data: identifier, email, display name, role, registration date and preferences. Base44 services manage authentication and credentials; the simulation engine does not receive your password.

Practice data: briefings, goals, messages, outcomes, debriefs, reflections and dates, including each run's language. For Testers, we record the assigned email address, access status and optional feedback and usefulness rating.

Service operation: run identifiers, usage limits, records of the terms version accepted and acknowledgement of the privacy notice. Minimal operational records contain account identifier and role, action, response status, duration, AI call and failure counts, and date. They contain no conversation text, audio, prompts, payment keys or request payloads. Hosting may process IP addresses and technical data to deliver and protect the service.

Optional statistics: only if you enable them, we measure verified email registration, practice starts and completions, catalog scenario, language and elapsed time in attempts observed during the same app opening. We do not add conversation text, briefs or reflections to these events. Base44 analytics also records the visited page, dates, a session identifier and an account identifier when available; these statistics are not anonymous.

Test payment records, accessible only to administrators, contain order and Checkout identifiers, amount, currency and verification status. Vokamio does not receive card numbers. These are simulated payments, not participant purchases.

Use fictional or anonymised situations. Avoid contact details, health data, children's data, confidential information or anything that identifies clients or other people. The system does not guarantee automatic detection or anonymisation of what you write.

Creating and managing your account, granting access, running simulations, saving results and responding to support requests: performance of the requested service and pre-contractual steps, under GDPR Article 6(1)(b). Data required for these functions is necessary to provide them.

Preventing misuse, checking access limits, maintaining security, diagnosing errors and documenting service conditions: the legitimate interest in operating the platform properly, under Article 6(1)(f), taking users' rights into account.

Tester feedback is optional. We use it to improve scenarios and fix issues based on our legitimate interest in improving the beta. You may ask for its deletion or object to this processing.

Email summaries are initially off. If requested in Profile, we process the data needed to provide this feature; you can switch it off at any time. The beta does not include newsletters or promotional messages.

Optional statistics rely on your consent under GDPR Article 6(1)(a). Refusing does not limit app features. You can withdraw consent in Manage cookies; this stops subsequent collection without undoing processing already carried out.

Where a legal obligation requires data retention or disclosure, the legal basis is Article 6(1)(c).

AI services integrated with Base44 process briefings and messages to interpret replies, generate some character responses and suggest a final comment. We do not intentionally send your account name or email to these models, but those details may be included if you put them in your text.

Automated safety checks examine briefs, messages and generated replies using local rules and AI services. If a run is stopped, we store its paused state and the check version, without a diagnosis or health category. The triggering text is not added to the transcript; AI providers may have processed it for the check. Detection of every risk is not guaranteed. A pause does not automatically contact anyone or emergency services.

Your private reflection after the debrief is not sent by the app to AI or included in emails. Scores and progress concern the simulation; they are not diagnoses, certifications or hiring decisions and do not produce legal effects on individuals.

AI responses may be inaccurate. Vokamio does not train its own model on conversations. Provider processing is subject to the agreements and contractual limits of the service actually used.

Dictation is optional. Before the first use in a conversation, the app shows a notice; enabling it then requires the browser's microphone permission. Browser speech recognition may send audio to the browser's service provider under that provider's terms and settings. Vokamio does not upload or store audio files. Recognised text stays in the input until you choose to send it and is then processed like other conversation messages. You can stop dictation at any time or use text instead.

Reading the client aloud uses an installed local device voice when available. Vokamio does not use an external text-to-speech fallback. Voice features vary by browser and device.

Your practice sessions are not public and other participants cannot access them. The controller and authorised people may access data when needed for administration, support, security or rights requests. The app's admin dashboard displays usage, errors, test orders and voluntary feedback; it does not display conversation transcripts or private reflections.

Base44 and its subprocessors provide hosting, storage, authentication, AI integrations and optional summary emails. Base44's Data Processing Addendum governs its processing of app-user data.

Services may process data outside the European Economic Area. Depending on the applicable circumstances, Base44's DPA provides for adequacy decisions, the Data Privacy Framework or standard contractual clauses. You can request information about the applicable mechanism and a copy of safeguards from the controller.

If you choose Google or another available login provider, that provider processes data under its own privacy notice. The same applies to an optional browser speech-recognition provider. Stripe handles administrator-only sandbox checkout under its own terms. We do not sell user data or publish it for promotional purposes.

Lesson attempts follow practice-data retention. From each lesson you can delete writing, reaction, feedback and observation. Identifiers, version, language, completion date and a technical request fingerprint remain to preserve progress and prevent duplicates. Account closure includes these records in the deletion process below.

Accounts, sessions and reflections are retained while the beta is in use so you can resume and review them. You can delete individual attempts from history. Credit records remain separate so deletion does not generate more free runs. A separate progress record stores account and session identifiers, scenario type and version, language, completion date and whether a reflection bonus was earned; it contains no transcripts, debriefs, reflections or scores. Progress is deleted with operational account data on account closure.

After an account-closure request or the end of the beta, the controller deletes operational content within 30 days, except where a specific legal requirement or dispute justifies retention. Minimal usage and access records are removed within 90 days of closure unless a documented abuse case or dispute requires them.

Operational error and AI-call records are removed within 90 days of collection through the beta's manual administrative process. They are separate from the credit ledger. There is no automatic scheduled cleanup in this prototype.

The browser statistics preference lasts 180 days. Events already sent are managed in Base44 systems: the controller must confirm retention periods and deletion procedures in platform settings and agreements before opening the beta. This remains part of reviewing this draft.

Evidence of accepted terms is kept for the period necessary to document the relationship and handle potential disputes, limiting data to what is necessary. Feedback is deleted at the end of the beta or earlier on request.

History displays the latest 50 attempts; that display limit does not automatically delete earlier ones. Base44 backups and platform logs follow provider retention periods and applicable agreements. Deleting something in the interface does not imply immediate removal from every backup.

You may request access, correction, deletion, restriction and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Contact [Contact email to be completed]. The controller normally responds within one month. Any lawful extension will be explained. Only information necessary to verify identity may be requested.

You may complain to the Italian Data Protection Authority or the competent authority where you live or work. Profile lets you update your name and preferences; history lets you delete attempts; each debrief offers a report download. Whole-account export and closure are handled manually in the beta.

The beta is for people aged 18 or over and is not designed to collect children's data. See the Cookie policy for session storage, language preferences and the public offline screen used by the installable web app.

The document version and confirmation date are recorded in your account. Material changes will be available before a new confirmation is requested. Notices are available in Italian and English.