Legal review required. These documents describe the current implementation and require review by a qualified lawyer. Deployment-specific provider terms and the signed customer agreement must also be checked; this page is not legal advice.
Who we are
Culvion AI. Registered address: 4005, 1st floor, Sector 67A, Gurgaon. For any privacy question, or to exercise a right described below, contact privacy@culvion.ai. Security issues go to security@culvion.ai.
What we collect, and why
We collect only what a specific interaction needs.
| What | When | Why | Legal basis (UK/EU GDPR) |
|---|---|---|---|
| Name, work email, company | You submit a form or ask Nate to arrange a follow-up | To reply to your enquiry | Legitimate interest / steps prior to a contract |
| Phone number and your explicit consent | You tick the callback box or clearly agree during a Nate voice call | To call you back about your enquiry | Consent |
| Your free-text message | You type one | To understand what you need | Legitimate interest |
| The page you submitted from | Automatically with a form submission | To route the enquiry | Legitimate interest |
| IP address and request metadata | Every request | Rate limiting, abuse prevention, security | Legitimate interest |
| Chat messages to Nate | You use the Ask Nate widget | To answer your question | Legitimate interest |
| Microphone audio, transcripts and call metadata | You start a live voice demo and allow microphone access | Speech recognition, replies and conversation review | Legitimate interest; microphone permission is also required |
| Analytics events | Only after you press Accept | To understand which pages help | Consent |
We do not buy personal data, sell it, share it with advertisers, or use it for automated decisions that produce legal effects. We do not run advertising or cross-site tracking cookies.
Consent for phone calls
The callback form asks for explicit consent before we may call you, including by an automated agent. During a Nate voice call, Nate spells the email and phone back and asks both whether they are correct and whether Culvion may contact you to arrange a call. The consent and its source are stored with the enquiry. You can withdraw it at any time by emailing privacy@culvion.ai.
How your data is protected
Sensitive fields, including enquiry messages, contact email and phone, and stored call transcripts, use application-level encryption with a configured, versioned key. The current implementation does not use a separate managed encryption key for every record. Tenant-scoped database access uses row-level security. Email lookup uses a keyed blind index. This does not mean every database field is encrypted: names, company details and operational metadata may remain readable to authorised systems and staff.
How long we keep it
Free-text personal data attached to demo requests and leads is scrubbed after 365 days. Short-lived operational data — rate-limit counters and chat history — expires within minutes to hours. Backups roll off on their own schedule; a record erased from the live system may persist in a backup until that backup expires.
Who else processes your data
The Sub-processors page lists configured and optional providers, what they may see and deployment-specific checks. When Meta Muse speech recognition is selected, microphone audio is sent to Meta; Soniox is the configured fallback. Other configurations use Soniox directly. Conversation text goes to the selected language-model route and reply text to the speech-synthesis provider. Anything you say or type, including personal details, can become part of that conversation context. Please use fictional details in public industry demos. Provider contracts, regions and retention terms must be confirmed for the particular deployment; we do not claim universal zero retention.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate;
- delete it — after verification and any applicable retention or legal-hold checks, we clear the covered personal-data fields from live records. This does not destroy a unique per-record key or erase every backup. Our provider-deletion tooling currently logs intent; it does not automatically complete deletion at external providers. Any necessary provider request requires separate follow-up;
- restrict or object to processing based on legitimate interest;
- withdraw consent you previously gave, including calling consent and analytics.
Email privacy@culvion.ai. We respond within 30 days. We do not charge for this. If you are unhappy with our response you can complain to your local supervisory authority.
Cookies and local storage
We use no advertising or cross-site tracking cookies. The site stores two values in your browser's local storage:
culvion-consent— whether you accepted or declined analytics. Set only when you choose.culvion-aid— a random identifier used to group analytics events. Created only after you accept.
Analytics are off by default and never run unless you press Accept. Declining leaves the site fully functional. Our CAPTCHA provider may set its own storage when it needs to verify that a form submission is not automated.
International transfers
Provider processing locations depend on the configured service and upstream model route and may be outside your country. Applicable transfer arrangements and provider agreements require confirmation for the deployment; selecting a region for one provider does not establish residency for the whole pipeline.
Changes
We will update the date at the top of this page when it changes materially, and describe what changed.
Last updated: 5 October 2026.
