Your data, how it is used, and your rights.

NOZZL SAS, 32 rue de Paris, 92100 Boulogne-Billancourt, is responsible for the processing necessary for its business relationship and the management of its own obligations. The customer organization determines the purposes of its team's practice sessions; the publisher then acts as a processor under the DPA.

The organization must inform its users about the program, establish an appropriate legal basis, and assess its employment and data protection obligations. Simply accepting a screen does not remove the need for this assessment.

Account data includes identity, business email address, organization membership, roles, and authentication information. It is used to provide access and protect the service.

Practice data includes scenarios, provided documents, transcripts, scores, excerpts, and tips. It enables simulations and training feedback. Usage data is used in particular to track minutes and perform technical checks.

Contact forms collect the company name, name, business email, optional phone number, number of sales reps, and message. This information is used to respond to the request, not to publish a testimonial or automatically add someone to a prospecting list without assessing its legal basis.

The voice stream is processed to enable the conversation. The application does not retain any call audio files. In the case of voicemail, audio is temporarily processed in memory for transcription and then deleted.

AI providers process the data needed for voice features, transcription, generation, and scoring. The fact that the application does not store audio does not make any claim about providers' technical retention periods; their settings and commitments must be documented in the subprocessors register.

Handling a pre-contractual request and providing the service may be based on pre-contractual measures or the contract, depending on the data subject. Accounting obligations are based on applicable laws. Security and the management of certain professional contacts may be based on a documented legitimate interest. Processing that requires separate consent must obtain it separately.

Data is accessible to authorized personnel within the organization, authorized personnel at the publisher, and service providers whose work requires access. Permissions and the private feedback setting limit access to call reports.

The application hosting infrastructure and database are located in the European Union. Some providers may involve processing or transfers outside the EU. The countries, legal mechanisms, and actual settings must be verified and documented before final production launch.

Retention periods must be defined by purpose: business relationship, active account, training data, security, and legal obligations. By default, transcripts are deleted after 180 days and call reports after 365 days (at which point they become anonymous statistics); Business plans and above can set these periods between 30 days and 3 years. The deletion schedule for backups and the handling of data after termination remain to be confirmed.

Depending on the processing and its legal basis, you may request access to, correction, deletion, restriction of processing, or portability of your data, or object to its processing. For training data managed by your employer, contact your employer’s designated contact first; the publisher assists them under the DPA.

For processing carried out by the publisher for its own purposes, use the contact form or write to NOZZL SAS, 32 rue de Paris, 92100 Boulogne-Billancourt, specifying “personal data” as the subject. A proportionate identity check may be required. You may also file a complaint with the CNIL.

Contact details for any data protection officer and detailed procedures will be added after validation. This document does not imply that a DPO has been appointed.