Lioma e.U. ("we", "us", "our") operates the NoRoboTalk mobile application ("App"). This policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Datenschutzgesetz (DSG).
The controller within the meaning of Art. 4(7) GDPR is:
Lioma e.U. / Manuel Laurentius Thurner
Radetzkystrasse 10, 9020 Klagenfurt am Woerthersee, Austria
Email: privacy@lioma.eu
VAT ID: ATU82975513
We are not required to appoint a Data Protection Officer under Art. 37 GDPR.
Audio Data: When you press Record, the App captures audio from your device microphone. Audio is processed entirely on-device using Apple's Speech Framework for speech recognition. No audio data leaves your device or is transmitted to us or any third party.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Transcribed Text: The on-device speech-to-text transcription is sent to our proxy server (norobotalk.lioma.app, hosted on Cloudflare Workers), which forwards it to OpenAI to generate a response. Transcriptions are forwarded in real-time and are not stored on our proxy server.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Generated Speech: Text responses from OpenAI are sent to Inworld AI for text-to-speech synthesis. The resulting audio is streamed to your device and is not stored by us.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Purchase Data: In-app purchases are processed exclusively by Apple through the App Store. We do not receive, collect, or store any payment information. Apple acts as an independent controller for this data.
Usage Data (locally stored): The number of remaining call credits is stored locally on your device in the iOS Keychain. This data never leaves your device. Keychain data may persist across app reinstalls; you can clear it by resetting your device.
Device Identifier: On first launch, the App generates a random identifier (UUID) stored in the iOS Keychain. This identifier is sent to our proxy server with each API request solely for rate limiting (abuse prevention). It is not linked to your identity, your Apple ID, or any other personal data. The proxy server stores this identifier temporarily (up to 1 hour) in Cloudflare KV to count requests. No other data is associated with it.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and ensuring service availability).
We use the following processors (Art. 28 GDPR):
Cloudflare, Inc. (USA): Operates the proxy server that forwards requests and stores temporary rate-limiting data (device identifier and request count, 1-hour TTL) in Cloudflare KV. Cloudflare processes data under standard contractual clauses (SCCs) and is certified under the EU-US Data Privacy Framework (DPF). No request bodies are logged.
OpenAI, L.L.C. (USA): Processes conversation text to generate responses. OpenAI acts as a data processor. Data is transmitted on the basis of SCCs and OpenAI's DPF certification. OpenAI's API data usage policy states that API inputs are not used for model training.
Inworld AI, Inc. (USA): Converts text responses to speech audio. Inworld acts as a data processor under SCCs.
Apple Inc. (USA): Provides on-device speech recognition and processes in-app purchases. Apple acts as an independent controller for purchase data.
Transcription data is processed by US-based services. These transfers are safeguarded by: (a) Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, adopted by European Commission Implementing Decision (EU) 2021/914; and (b) the EU-US Data Privacy Framework adequacy decision of 10 July 2023, where applicable.
You may request a copy of the applicable SCCs by contacting privacy@lioma.eu.
We do not store your conversations, audio, transcriptions, or any personal data on our servers. The proxy server processes requests in real-time without logging request or response bodies.
Rate-limiting records (device identifier and request count) are stored in Cloudflare KV with an automatic expiry of 1 hour, after which they are permanently deleted.
OpenAI retains API inputs for up to 30 days for abuse monitoring, after which they are deleted.
The App uses AI to generate responses to automated phone systems. This constitutes automated processing but does not involve automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR.
You have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)).
Since we do not store personal data on our servers, most rights are automatically fulfilled. Contact privacy@lioma.eu for requests. We will respond within one month (Art. 12(3) GDPR).
You have the right to lodge a complaint with a supervisory authority. The competent authority for Austria is:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
NoRoboTalk is not intended for children under 14 years of age (in accordance with § 4(4) DSG in conjunction with Art. 8(1) GDPR). We do not knowingly collect personal data from children under 14.
The App does not use cookies, tracking technologies, or analytics tools. No usage profiles are created.
We may update this policy to reflect changes in our data processing or legal requirements. Material changes will be communicated through an update to the App.
Lioma e.U. / Manuel Laurentius Thurner
Radetzkystrasse 10, 9020 Klagenfurt am Woerthersee, Austria
Email: privacy@lioma.eu