This Privacy Policy (“Policy”) explains which personal data are collected when you visit our website www.ilianaai.com (“Website”) and when you interact with our “Iliana” AI assistant, and how this data is processed by Iliana IT Services EOOD, a company registered in the Commercial Register of the Republic of Bulgaria under registration number 207042502, with seat and registered address: residential district Strelbishte № 18А, Sofia, Bulgaria, as data controller (“Company” or “we”).
This Policy is addressed to any visitor of our Website and to any person who interacts with our “Iliana” AI assistant (“data subject” or “you”).
We process your personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and applicable national data protection laws (in particular the Bulgarian Personal Data Protection Act – “PDPA”). Unless otherwise defined in this Policy, the terms used herein shall have the same meaning as defined in the GDPR.
This Policy covers two different situations, in which our role under data protection law is not the same:
When you use our Website, we may process those personal data which you voluntarily provide to us (e.g. by means of our contact form).
However, you can also visit our Website without actively providing us with information about yourself. In this case we collect certain data that your browser transmits to our website server (i.e. log files), as well as data that we collect via the use of cookies or similar technologies.
The following explanations shall serve to inform you about the different ways we may collect personal data about you on our Website, for what purposes we may use them and on which legal basis under Art 6(1) GDPR.
When you actively communicate with us via our Website, we process those personal data that you voluntarily provide to us, in particular:
We use this data to (i) respond to your enquiry during the conversation, (ii) prepare and follow up on a potential business relationship you have requested (e.g. preparing an offer or having a member of our team contact you), (iii) where you provide your email address, send you a recap of your conversation, and (iv) to secure, audit and maintain the quality, integrity and performance of the AI agent — for example, by reviewing transcripts for quality-assurance purposes and analysing aggregated, non-identifying usage metrics.
Legal basis: for purposes (i)–(iii), the processing is necessary in order to take steps at your request prior to entering into a contract (Art 6(1)(b) GDPR); for purpose (iv), our legitimate interest in the security, integrity and improvement of our service (Art 6(1)(f) GDPR). We do not use the content of your conversations to train foundation AI models or for model fine-tuning any quality review is carried out on a limited basis and does not involve training or fine-tuning our models on your conversation content..
Special categories: Please do not share sensitive information (special categories of personal data within the meaning of Art 9 GDPR, such as data concerning health, or data revealing racial or ethnic origin, political opinions or religious beliefs) during the conversation. We do not request such data, the assistant is not intended to collect it, and we do not use it for any purpose. If you nevertheless choose to volunteer such data, it may technically form part of the transcript; we will delete or anonymise it without undue delay once identified, and in any event upon your request. We do not use any such data to take decisions about you by automated means. Our team and the assistant are instructed not to request or elicit special categories of personal data.
Retention and deletion: We keep conversation transcripts for as long as necessary to handle your enquiry and any resulting relationship, and thereafter only as required by statutory retention obligations or to establish, exercise or defend legal claims. If you have provided your email address, the recap we send you includes a way to request deletion of your data — simply reply to that email, which is monitored. You may also exercise your right to erasure at any time as described in Section 6.
Some of the data we request in relation to the above services may be considered mandatory – while you are not required to provide these data, without this information we may not be able to process your request or provide our services.
When you visit our Website, our web server automatically records certain technical data transmitted by your browser, in particular: the IP address of your device, date and time of access, the pages and files accessed, the website from which you were referred, your browser type and version, and your operating system. This data is processed to deliver the Website to your device, to ensure the stability, security and integrity of our systems, and to detect, prevent and investigate attacks and misuse. Legal basis: our legitimate interest in the secure and functional provision of our Website (Art 6(1)(f) GDPR). Log files are retained for a limited period and then deleted or anonymised, unless a security incident requires longer retention.
Our Website and the “Iliana” assistant on it are not directed to children. Where we rely on consent, we do not knowingly process the personal data of children below the applicable age of digital consent for information society services.
We license and deploy our “Iliana” AI assistant — a conversational agent with an on-screen avatar that conducts voice and text conversations — on the websites and digital platforms of our business clients.
Where the assistant is deployed on a client’s website, the notice that you are interacting with an AI system is provided within that interface; responsibility for transparency towards you under applicable law (including the EU AI Act) is allocated between our client and us in our data processing and service agreements.
When you interact with the “Iliana” assistant on a website that belongs to one of our clients (i.e. not on www.ilianaai.com), the data protection roles are different from those described in the rest of this Policy:
For the information the controller is required to provide — in particular the purposes and the lawful basis of the processing, the retention periods, and the recipients of your data — please consult the privacy notice of the relevant client (the operator of the website on which you are using the assistant). The present Section 2 describes only our own role and practices as processor and does not replace that notice.
In the course of providing the service we process, strictly on our client’s instructions:
The live audio stream of a voice conversation is processed in real time only to generate the text transcript and is not stored; we retain the written transcript only.
When acting as a processor we do not use the personal data from your conversations for our own purposes. In particular, we do not use them for our own marketing, and we do not use them to train or improve our own AI models, unless the client has specifically instructed or authorised us to do so in the data processing agreement. We process the data solely in order to provide, secure and technically support the service for the client.
The conversation data are stored primarily within the systems of our client. In addition, a copy is stored on our own infrastructure, hosted in Frankfurt, Germany (EU/EEA), for the purposes of providing, securing and technically supporting the service.
To deliver the service we engage sub-processors — in particular hosting providers and providers of the underlying language-model and speech-to-text technology. We engage sub-processors only in accordance with Art 28(2) and (4) GDPR, bind them by contract to data protection obligations equivalent to those we owe our client, and inform our client of any intended addition or replacement of a sub-processor so that the client may object. Where a sub-processor is located outside the EU/EEA, any transfer is made on the basis of an adequacy decision or appropriate safeguards (e.g. the EU Commission’s standard contractual clauses) in accordance with Art 44–46 GDPR.
Because our client is the controller, you should address any request to exercise your data protection rights (access, rectification, erasure, restriction, objection, portability) to that client. If you contact us directly with such a request, we will, in line with Art 28(3)(e) GDPR, forward it to the relevant client and/or assist the client in responding; we are not permitted to act on it ourselves without the client’s instruction.
Retention periods for the conversation data are determined by our client as controller. As a processor, we retain the copy on our infrastructure only for as long as instructed by the client and, upon termination of the service, we delete or return the personal data in accordance with Art 28(3)(g) GDPR, unless Union or Bulgarian law requires further storage.
The “Iliana” assistant may be deployed by our clients on websites and platforms across the EU/EEA. The applicable age of digital consent for information society services is set by Art 8 GDPR (16 years by default) and may be lowered by each Member State to not below 13 years; in practice it ranges between 13 and 16 years depending on the Member State whose law applies to the client as controller (for example, 14 years in Bulgaria under Art 25c of the Personal Data Protection Act). As controller, the client is responsible for determining the applicable age, for any age-verification measures, and for obtaining the consent of the holder of parental responsibility where required. As processor, we act only on the client’s instructions in this respect.
Our Website does not use first-party cookies. Any tracking or analytics technologies used in connection with the Website are provided solely through third-party tools, as described in our Cookie Policy, which explains in detail what technologies are used, for what purposes, on what legal basis (where required, your consent pursuant to Art 6(1)(a) GDPR and the applicable ePrivacy rules), and how you can manage your preferences. For full information on cookies and similar technologies, please refer to our Cookie Policy available at: https://ilianaai.com/cookie-policy/.
We may share your personal data with the following categories of recipients:
Where disclosure is required (i) by law or regulation or (ii) to establish, exercise or defend legal claims, we may also disclose personal data to a competent authority, such as supervisory, regulatory or criminal authorities, courts of law or other third parties who advise us in this context (e.g. lawyers or forensic experts).
Some of these recipients may be located in countries outside the EU/EEA for which an adequate level of data protection has not yet been established by the EU Commission. The level of data protection in such countries may not be the same as within the EU/EEA, and data may be accessible to local authorities or courts subject to local laws.
However, in the event that personal data is transferred to such third countries, we implement appropriate safeguards to ensure that your rights are protected in accordance with the GDPR. This includes the conclusion of the EU Commission’s standard contractual clauses for the transfer of personal data (Art 46(2)(c) GDPR).
Where we act as a processor for one of our clients (Section 2), disclosures of and transfers relating to the conversation data are governed by the data processing agreement with that client and by Section 2.4 above.
We generally retain your personal data for as long as this is necessary for the fulfilment of the purpose for which they were obtained. Thus, in any case we process your personal data for the duration of our (pre)contractual or service relationship with you. Beyond this time period we keep your personal data to comply with statutory retention obligations. Where necessary we may also keep your data for as long as potential legal claims against us are not yet time-barred.
For the retention of AI sales agent conversation transcripts on our own Website, please also refer to the “AI Sales Agent (Iliana) interactions” section above. Where we act as a processor for one of our clients, retention is determined by that client as controller, as described in Section 2.6. For the storage duration of cookies, please refer to our Cookie Policy, available at: https://ilianaai.com/cookie-policy/.
As a data subject you have inter alia the following rights under the statutory conditions:
We do not process your personal data for the purpose of taking decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art 22 GDPR).
Where we act as a processor (Section 2), please address your requests to the relevant client as controller; if you contact us, we will forward your request to that client and assist as described in Section 2.5.
To exercise any of the above rights, kindly send an email to sales@ilianaai.com. In addition, you have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. For Bulgaria the competent authority is:
Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
E-mail: kzld@cpdp.bg • Website: www.cpdp.bg
We recognize our responsibility to protect the information you provide to us and have implemented appropriate technical and organizational measures to safeguard your personal data — including encryption of data in transit using HTTPS, role-based access controls, system monitoring and logging, and procedures for incident detection.
We may update this Policy to reflect legal, technical or business changes. When we update this Policy, we will take reasonable steps to inform you about the changes made. You will find the date of the “last update” at the beginning of this Policy.
The Website contains links to third-party websites. We have no control over the content or privacy practices of these other websites. Please read the respective data protection provisions of other websites that you visit.
Should you have any requests or questions in relation to the processing of your personal data by us, kindly address them to Iliana IT Services EOOD at sales@ilianaai.com.
Our office address is: residential district Strelbishte № 18А, Sofia, Bulgaria.
