Revoiced.AI

Privacy Policy

Last updated: 16 August 2026

This is an English translation of our German Datenschutzerklärung, provided for convenience. In case of any discrepancy, the German version prevails.

1. Controller

Yannick Kupferschmidt
Gräfstraße 45
60486 Frankfurt am Main, Germany
Email: [email protected]

We have not appointed a data protection officer, and we are not required to do so by law.

2. Hosting and server log files

The application is hosted with Laravel Cloud (Laravel Holdings Inc., USA) on Amazon Web Services infrastructure. When you open the website, technical access data is processed automatically (IP address, date and time, page requested, browser and operating system information), to the extent required to deliver and secure the application.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). We have a data processing agreement (Art. 28 GDPR) with our hosting provider; where data is transferred to the USA, this is based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

3. Cookies and local storage

We only use strictly necessary cookies and storage techniques:

If you open the application through a tagged link or QR code, for example from a card laid out in a museum, we additionally store the origin passed in the address (the src parameter, for example the name of the museum) against that device identifier. It is set on your first visit and never changed afterwards. Its only purpose is to evaluate whether such an initiative reached any visitors.

The legal basis is § 25(2)(2) TDDDG and Art. 6(1)(b) GDPR (performance of a contract), and for the origin Art. 6(1)(f) GDPR (legitimate interest in evaluating our own initiatives); you may object to the latter at any time under Art. 21 GDPR at [email protected]. We use no third-party analytics or advertising technologies: no third-party script and no tracking pixel is loaded in your browser.

4. Photo capture and AI-assisted artwork recognition (Google, Anthropic)

The core function of the application is recognising artworks from a photo you take. The photo is first sent to Google Cloud Vision (Google Ireland Limited, Ireland, and Google LLC, USA) in order to match it against artwork images publicly findable on the web and, if your photo shows the wall label, to read its text. The photo and these results are then sent to Anthropic (Anthropic PBC, USA / Anthropic Ireland Ltd.) to identify the artwork and generate the narration text. We also store an irreversible checksum (hash) of the image so that already recognised works can be reused.

We store your photos. Every photo you take is kept on our servers together with the outcome of the recognition (recognised / not recognised / wall label). The sole purpose is improving artwork recognition: only real photos show which images are recognised wrongly or not at all. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in recognition that works and keeps getting better). Photos are deleted after 24 months. Your photos are never shown to other visitors and are not published; the image you see on the result screen after taking it comes from your own browser, not from our server. You may object to this storage at any time under Art. 21 GDPR at [email protected].

Please therefore photograph only artworks and their wall labels, and make sure no other people are identifiable in the frame. The legal basis for the recognition itself is Art. 6(1)(b) GDPR (providing the function you requested). Under the commercial terms in place with Anthropic and Google, submitted content is not used to train AI models. Transfers to the USA are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Speech synthesis (ElevenLabs)

The generated narration texts are sent to ElevenLabs (ElevenLabs Inc., USA) to be converted into audio. No personal data about you is transmitted in the process — only the generated text about the artwork.

5a. Technical routing of AI requests (Cloudflare)

We route the requests to Anthropic (section 4 and section 5b) and ElevenLabs (section 5) through Cloudflare AI Gateway (Cloudflare, Inc., USA, and Cloudflare Germany GmbH). In doing so, Cloudflare records technical metrics per request, such as timestamp, duration, model used and cost incurred. Storage of request and response bodies is switched off, so neither your photo nor the narration text nor your questions to the artist is stored at Cloudflare; all of it merely passes through the service in transit.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in cost control, operational stability and abuse prevention). A data processing agreement under Art. 28 GDPR is in place; transfers to the USA are based on the EU Standard Contractual Clauses.

5b. Conversation with the artist (Anthropic)

For a work you have unlocked, you can put questions to the artist and receive an answer in their persona. To do so, your question is sent to Anthropic (section 4) together with the conversation so far. We store your questions and the answers against your device identifier (section 3), along with a technical flag if an answer was objected to by our automated check.

The legal basis for conducting the conversation, and for storing the history without which a conversation cannot be continued, is Art. 6(1)(b) GDPR (providing the function you requested). Keeping it beyond that serves the review of objected answers and the improvement of the application; the legal basis for that is Art. 6(1)(f) GDPR (legitimate interest in an application that is safe and keeps getting better). You may object to this storage at any time under Art. 21 GDPR at [email protected]. Conversations are deleted 24 months after the last message.

Please do not enter personal data in your questions — neither your own nor anyone else's. The text you type is stored and transmitted exactly as you write it. Conversation content is never shown to other visitors. Under the commercial terms in place with Anthropic, conversation content is likewise not used to train AI models; transfers to the USA are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. Payment processing (Stripe)

Day pass purchases are processed via Stripe (Stripe Payments Europe, Ltd., Ireland; parent company Stripe Inc., USA). You enter your payment details (for example card data) directly with Stripe; we do not receive full payment data, only the email address you provide, the payment status and a transaction reference.

We use your email address to assign your day pass and, on request, to send you sign-in links for additional devices. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (commercial and tax retention obligations). For the payment processing itself Stripe acts in part as an independent controller; Stripe's own privacy notices apply in addition.

7. Sending and receiving email

7.1 Email sent to you (Cloudflare)

We use the email delivery service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) to send purchase confirmations and sign-in links. Your email address and the message content are processed. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses (Art. 46 GDPR) apply in addition. The legal basis is Art. 6(1)(b) GDPR.

7.2 Email you send to us (Purelymail)

The mailbox [email protected] is operated by Add Rabbit, LLC (service: Purelymail), 502 W 7th St, Suite 100, Erie, PA 16502, USA. If you write to us, this provider processes your email address, the subject, the message content, any attachments and technical transmission data. Messages are stored there encrypted with your password. The legal basis is Art. 6(1)(b) GDPR where your message concerns the performance of the contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

There is no EU Commission adequacy decision for this provider, and no EU Standard Contractual Clauses are currently in place. The transfer to the USA is therefore based on Art. 49(1)(b) GDPR: you initiate the communication yourself, and the transfer is necessary in order to receive and answer your message. Please note that US authorities may be able to access this data and that you may not have legal remedies comparable to those under the GDPR. If you wish to avoid this, you can reach us by post at the address given in section 1.

8. Waitlist and launch notification

If you signed up for the waitlist before launch, we store your email address as well as technical details about the origin of the sign-up (for example the landing page variant visited, advertising click identifier), in order to inform you about the launch and to evaluate the effectiveness of our advertising. The legal basis is Art. 6(1)(a) GDPR (consent); you can unsubscribe at any time by emailing [email protected].

9. Retention periods

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

11. Changes

We update this privacy policy when the application or the legal situation changes. The version published here at the time applies.