Privacy Policy

1. Data controller

This IGOOR instance is operated by the IGOOR Association, registered office: 251 route des 5 cantons, 40390 Saint-André-de-Seignanx (France), RNA no. W401011263. Contact for any question about personal data: dpo@igoor.org. IGOOR is CAA software for people with neurodegenerative diseases: it listens to the conversation, suggests answers for the user, and remembers the context of previous conversations.

2. Data processed

• Account: identifier, name, e-mail address and photo of the Google account used to sign in (provided by Google at sign-in).
• Conversations: automatic transcription of what the microphone hears (content, time), with the name of the recognised person when an enrolled voice speaks. They are kept per day in the account storage. No audio recording is ever kept: sound is processed in memory for transcription and only the text is stored.
• Voiceprints: enrolling a voice (10 s) creates a voiceprint computed on the device (IndexedDB). A backup copy encrypted in the browser (AES-GCM, key present only on the device and never sent to the server) is synced to the account storage to allow transfer to another device: the server only receives unreadable encrypted text - apart from the number of enrolled profiles, for statistical purposes - no voiceprint in the clear, no audio recording, no key. Only the recognised name is sent during conversations.
• Voice samples (voice cloning): the recordings or audio files provided to create a personal synthesis voice are kept only on the device (browser IndexedDB) so they can be re-sent, and can be deleted at any time from the cloning screen.
• Preferences: accompanied person's name, language, microphone, synthesis voice. The optional ElevenLabs API key is stored encrypted.
• Usage statistics: counters kept in the account storage - number of conversations, number of uses of each fixed communication button (the counter therefore reflects the type of need expressed, e.g. "toilet") and number of enrolled interlocutors (a single figure, never names or voiceprints). No conversation content, no free text.
• Technical data: server logs (account identifier, timestamps, sign-in events) - they contain no IP address - automatically purged by rotation (a few days of history at most). A single, strictly necessary cookie: the signed session (see §8).

3. Purposes and legal basis

This data serves the purpose of the product: offering relevant, personalised answers, and the management of the service by the Association (usage statistics, as per-account counters). The legal basis is consent: consent to the account at first sign-in, and the person's consent when their voice is enrolled. The content of conversations and the context of use of the software may reveal health-related information (Art. 9 GDPR): this processing relies on your explicit consent. The accompanied person's consent may be given, and their rights exercised, by their legal representative.

4. Recipients and transfers

• Data storage: Scaleway Object Storage, Paris region (France) - privacy policy.
• Answer generation (AI) and transcription: Groq (United States), as a processor - processing governed by its privacy policy and its Data Processing Agreement (DPA), accepted at account creation and including the Standard Contractual Clauses (SCCs) for transfers outside the EU. Groq does not use the transmitted content to train models or for research; neither does the Association.
• Speech and voice recognition: transcription by Groq (as above); voice recognition entirely on the device.
• Speech synthesis: by default the device's system voice (nothing sent); if the ElevenLabs engine is chosen and a key is registered in the account, the text of the answers is sent to ElevenLabs. With a personal key provided by the user, processing happens under the user's own ElevenLabs account. With a sponsored key, granted by the Association following a request, the key belongs to the Association's ElevenLabs account: the text of the answers is then processed under that account, whose usage (volumes, request logs) can be viewed by the Association. Without a registered key, the system voice is used and nothing is sent. Key requests are kept in the account - privacy policy and data processing addendum (DPA).
• Voice cloning: at the user's request (mandatory consent checkbox), the audio samples pass through the Association's servers, which forward them to ElevenLabs without keeping a copy (transient forwarding; only the file count and size appear in the logs). The created voice belongs to the user's ElevenLabs account (personal key) or to the Association's account (sponsored key), as with synthesis above - privacy policy and data processing addendum (DPA).
• Key-request notifications: when a user requests a sponsored key, the request (account name or e-mail, account identifier, note left by the user) is sent to the operator via Telegram, a third-party service whose servers are outside the EU - privacy policy. Without a request, nothing is sent.
• Internal access and legal obligations: only authorised members of the IGOOR Association may access accounts, solely to operate the service. Disclosure to authorities can only happen under legal requisition.
• E-mail: exchanges with dpo@igoor.org (exercising your rights) transit through Google Workspace, a processor governed by the service terms and its Data Processing Addendum (Standard Contractual Clauses included).

5. Retention periods

The memory of conversations is part of the purpose of the product: they are kept as long as the account is active, until deleted in the interface or together with the whole account (no automatic purge is configured on this instance yet). Usage statistics are kept until the account is deleted. Voiceprints are kept on the device until the profile is deleted in Settings; the encrypted backup is deleted together with the profile (or the whole account) and can be withdrawn at any time via "Disable backup" in Settings. Technical logs are automatically purged by rotation (§2). Withdrawal of consent or an erasure request leads to the deletion of the account's data and of the profiles concerned.

6. Your rights

You have the following rights over your data:

• access (obtain a copy) and rectification;
• erasure and restriction of processing;
• objection and portability (receive your data in a machine-readable format);
• withdrawal of consent at any time;
• post-mortem directives: define how your data is handled after your death and designate a person to enforce your wishes (Art. 85 of the French Data Protection Act);
• you have the right not to be subject to decisions based solely on automated processing: IGOOR makes none - suggestions are always validated by a human gesture.

To exercise these rights, contact dpo@igoor.org (see §1) or use the voice-profile deletion in Settings; you will receive an answer within one month (extendable for complex requests) after possible verification of your identity. You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

People whose voice is enrolled: the account holder undertakes to inform the interlocutors they enrol. Those persons are data subjects in their own right: they may exercise the same rights by writing to dpo@igoor.org, and their voice profile can be deleted at any time from Settings or upon simple request.

7. Security

Exchanges are protected by HTTPS; the session is bound to a signed cookie. Accessing the account data requires Google sign-in. Technical logs (account identifier, timestamps, sign-in events) are kept on the server. In the event of a data breach likely to result in a risk to your rights, the Association will notify the CNIL and, where applicable, the persons concerned, under Articles 33 and 34 of the GDPR.

8. Cookies

A single, strictly necessary cookie (signed session). No advertising, audience measurement or tracking cookies.

9. Minors

The service is not intended for minors and the Association does not knowingly collect their data; any discovered minor's data would be deleted as soon as reasonably possible.

10. Changes

This policy may change; each version is dated at the top of the page and replaces the previous one.