Privacy, security & terms

The controller for this website and the VoltAIre application is BaseGSA, operating under the brand VoltAIre.

Privacy and data-protection requests: privacy@voltaire.events. General contact: info@voltaire.events.

Roles for event content. For your account and our operation of the platform, BaseGSA is the controller. For personal data inside event content that you upload or capture (audio, transcripts, speaker names, slides, poll answers from your audience), you typically act as controller (or joint controller with your organisation), and we process that content on your instructions as processor — except where we must process it for security, abuse prevention, or legal obligations.

Depending on how you use VoltAIre, we may process:

• Account and contact data: name, email address, profile picture (e.g. via Google sign-in), and authentication identifiers.
• Event / congress content: audio or media you capture or upload, text you paste, transcripts, speaker labels, project settings, slide summaries and analyses, and related workspace data. This may include personal data about speakers or participants.
• Audience interaction data: poll responses, open text, and Q&A submissions from participants who use vote / interaction links during a Live session.
• Technical and security data: IP address, browser and device characteristics, session and error logs needed to run and secure the service.
• Support communications: messages you send to us about the service.

We do not currently process payment-card details in the product. If paid plans or invoicing are introduced, we will update this policy and only collect what is needed for billing (and statutory tax records).

We process personal data only for these purposes, under the GDPR legal bases indicated:

• Delivering the core service — listening, transcription, AI slide summaries/analyses, polls, presentation, and project storage (Art. 6(1)(b) contract; for audience submissions also Art. 6(1)(f) legitimate interests of the organiser, or consent where the organiser relies on it).
• Creating and securing accounts, sign-in (including Google), and sessions (Art. 6(1)(b) and (f)).
• Customer support and service communications (Art. 6(1)(b) and (f)).
• Security, abuse prevention, troubleshooting, and service improvement using aggregated or technical signals where possible (Art. 6(1)(f)).
• Legal obligations, for example responding to lawful requests or (when applicable) tax retention for invoices (Art. 6(1)(c)).

Where processing relies on consent (for example certain cookies or optional features), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Organisers are responsible for informing speakers and audience members where required (e.g. that a session is recorded or transcribed, and that polls may collect answers) and for having a lawful basis to share that content with us.

We do not keep personal data longer than needed for the purposes above:

• Account data: for as long as your account remains active, and for a limited period afterwards if needed for security, dispute handling, or legal claims.
• Projects and event content (input and generated output): retained while they remain in your account. You can delete projects in the product. We do not currently run an automatic 30-day wipe of all event content after delivery — if you need earlier erasure, delete the project or email us.
• Audience poll / Q&A responses: retained with the related project/session for as long as that project is kept, unless deleted earlier.
• Security and operational logs: typically for a limited period (for example up to 90 days for certain AI usage logs), unless a longer period is needed to investigate an incident.
• Billing / invoice data (when introduced): up to 7 years after the end of the relevant financial year where Dutch tax law requires it.

To request erasure of your account and associated personal data, contact privacy@voltaire.events. We will respond within the GDPR time limits (usually one month).

We do not sell your personal data. We share data only with processors and providers needed to run VoltAIre, or where the law requires it. We put appropriate contracts in place (including GDPR Art. 28 processor terms) with parties that process personal data on our behalf.

Categories of recipients include:

• Application hosting (EU) — e.g. Sliplane / Hetzner infrastructure in the EEA.
• Database, authentication, and storage — Nhost (Nhost AB, Sweden), with project data hosted in an EU region (currently AWS eu-central-1). Nhost is an EU company; the underlying cloud may involve a non-EU sub-processor.
• Edge / delivery (if used) — Cloudflare or similar for website delivery; this may involve processing outside the EEA at the network edge.
• AI providers — e.g. Google Gemini or other models you or we configure, to generate transcripts, summaries, and slide content. Prompts and relevant content are sent to the provider to fulfil your request.
• Identity providers — e.g. Google, if you choose Google sign-in.

See also the Security tab for encryption, access control, and AI handling.

Primary application hosting and database residency are configured in the EEA / EU. Some providers (AI APIs, sign-in, or edge networks) may process data in or from outside the EEA. Where that happens, we rely on appropriate safeguards under GDPR Chapter V — typically the provider’s Data Processing Agreement and EU Standard Contractual Clauses (SCCs), and additional measures where required.

Under the GDPR you may request:

• Access to your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”) where applicable (Art. 17)
• Restriction of processing (Art. 18)
• Data portability where applicable (Art. 20) — authenticated users can also obtain a project-metadata export via the product API
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent where processing is consent-based

Send requests to privacy@voltaire.events. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with another supervisory authority in your EU Member State.

We use essential cookies and browser storage to keep you signed in, complete authentication (including a short-lived technical code for Google login), and keep the workspace functioning. We do not use non-essential advertising cookies on the marketing site by default. If we introduce analytics or marketing cookies, we will ask for consent where required.

VoltAIre is aimed at professional event and congress use. It is not directed at children under 16. If you believe we have collected a child’s data, contact privacy@voltaire.events.

We may update this policy when the product, our subprocessors, or the law changes. The current version is always at https://voltaire.events/legal?tab=privacy.