VoiceLine

GDPR overview

VoiceLine states that it complies with all GDPR requirements in partnership with DataGuard. The privacy policy names VoiceLine GmbH in Munich as controller with postal address, phone and email, details the legal bases under Article 6(1)(a) to (f), lists the full set of data subject rights, and declares that no automated decision-making or profiling is used. No analytics, marketing or third-party cookies are set, so no consent banner is deemed necessary. The terms make an Article 28 DPA an integral part of the licence and split roles: customer as controller, VoiceLine as processor, with clause 15.2 placing consent for recording third parties on the customer. Two gaps remain: the policy carries no effective date and covers the marketing website rather than the product, and no data protection officer is named. Being EU-established, the company needs no Article 27 representative.

Who owns the data?

Clause 13.4 of the terms states that the customer retains all rights in its own data, input and submitted content, and that VoiceLine GmbH acquires no ownership in them; any use by the vendor is governed by the Article 28 data processing agreement, under which the customer is controller and VoiceLine processor. The software itself remains the vendor's property (13.1). The nuance sits in clause 16.2: models, algorithms, statistics and aggregated datasets derived from training belong exclusively to VoiceLine GmbH, even where they were built from customer data, and the customer acquires no rights in them. Clause 16.3 forbids selling, licensing or otherwise making those derivatives available to third parties in any form that would identify the customer, its users or its confidential business information.

Reuse rights

Clause 17 organises exit rather than lock-in. The customer may export its data in a structured, commonly used, machine-readable format and request migration support towards another provider or its own systems, without having to ask permission. The export covers submitted input, output generated through use and related usage metadata; it excludes internal logs, system diagnostics, security information, proprietary models, IP-protected content, trade secrets and anything whose export would compromise the security of the service. A switch must be notified in writing and triggers a two-month switch period followed by a 30-day transition, extendable once by up to seven months, with fees due throughout; exportable data remains retrievable for 30 days after the contract ends. Leaving early costs a lump sum of 80% of the remaining fees, except for termination with good cause. Reuse of the software itself is restricted: clause 13.2 prohibits copying, modifying, decompiling, reverse-engineering, reselling, sublicensing and scraping outside the authorised API, and clause 6.2 makes the customer solely responsible for verifying and validating AI output before relying on it.

Data retention & training

Hosting summary

VoiceLine states that the product's servers are located in Frankfurt, Germany, that they are ISO 27001 certified and penetration tested, and describes itself as Munich-based, GDPR compliant, with data hosted in Germany. The legal frame matches: German law applies, with Munich as place of performance and exclusive jurisdiction. One distinction matters. The marketing website is hosted separately by Framer B.V. in the Netherlands, an Article 28 processor under a data processing contract, handling IP address, date and time of access, browser information and logs; that is site hosting, not product hosting. No transfer outside the EU is mentioned and no standard contractual clauses are referenced. The site names a hosting country but never a broad hosting region as such. Detailed documentation sits in a Vanta Trust Center available on request only, so the certificates cannot be inspected publicly. Finally, the domain resolves through Cloudflare anycast, so the IP geolocation of the website says nothing about where customer data actually resides.