Privacy Policy

Below we describe what personal data we collect on the ImplementAI website, why we collect it, and what you can do about it. We describe separately the conversational assistant, which records the content of the conversation and, in voice mode, an audio recording of it as well, and recruitment through the Careers page.

1. Who is the controller of your data

The controller of personal data is:

Fundacja Our Future Foundation
Al. Jerozolimskie 99/13, 02-001 Warsaw, Poland
NIP (tax identification number): 5862352018, REGON (statistical number): 385158300, KRS (National Court Register number): 0000819607
email address: office@implementai.pl
telephone: +48 502 896 052

ImplementAI is a brand and a project operated by Fundacja Our Future Foundation. It is not a separate legal entity. The controller of data collected on the ImplementAI website, in conversations with the assistant and through all contact channels indicated on the website is that same foundation.

For matters concerning personal data, including withdrawal of consent, write to: office@implementai.pl.

2. What this policy covers

This policy covers:

1. browsing the ImplementAI website, available at implementai.pl and at technical addresses, including implementai-site.vercel.app;
2. use of the conversational assistant available on the website, in text and voice mode;
3. contacting us by email, by telephone and via the messaging applications indicated on the website;
4. applying for a role at ImplementAI through the application form on the Careers page (implementai.pl/careers) or by sending us an application by email.

This policy does not cover third-party websites linked to from our website, including LinkedIn profiles and the off.org.pl website, which has its own privacy policy.

3. The conversational assistant: what exactly we collect

3.1. You are talking to an AI system

The assistant on the website is an artificial intelligence system, not a human being, even if it uses a name, a voice or a style of expression referring to a member of our team. We inform you of this before the conversation starts, in accordance with Article 50 of Regulation (EU) 2024/1689 (the AI Act).

3.2. What data is created during a conversation

A recording of your voice is personal data. We do not use recordings for biometric identification, speaker recognition, emotion assessment, or to create a copy of your voice.

3.3. The conversation is not anonymous and is read by humans

The transcript and, in voice mode, the recording as well, are read by authorised members of our team. We do this in order to understand the matter you have raised, prepare a response and assess whether and how we can help. We do not publish transcripts or recordings and do not share them with third parties for marketing purposes.

3.4. What not to tell the assistant

Please do not provide in a conversation:

1. data concerning health, origin, beliefs, trade union membership, sexual orientation or other special categories of data (Article 9 of the GDPR), or information about criminal convictions;
2. your PESEL (Polish national identification) number, identity document numbers, passwords, API keys, payment card or bank account details;
3. trade secrets, professionally privileged information or classified information, if you are not entitled to disclose it;
4. personal data of third parties, if you have no legal basis to do so. Providing the business contact details of a person on whose behalf you are acting, or whom you indicate as a contact person, is fine.

We do not ask for such data and do not need it. If it nevertheless appears in a conversation, we remove it from the record as soon as we notice it.

3.5. Legal bases and voluntariness

Use of the assistant is entirely voluntary. You can write to us or call us instead. In voice mode, consent to recording is a technical condition: without it the voice mode does not work, but the text mode and the other contact channels remain available. You can withdraw your consent at any time by writing to the address given in point 1. Withdrawal of consent does not affect the lawfulness of processing carried out beforehand.

3.6. Is the conversation used to train AI models

We do not use your recordings or transcripts to train or fine-tune artificial intelligence models. We also require this of our providers and use their services in a configuration that disables the use of transmitted content for model training. In the case of the voice service provider, we use the opt-out from the use of data for model training available in the account settings; that opt-out applies to data transmitted after it was enabled.

3.7. Where the recording and transcript go

The voice mode of the assistant is operated for us by ElevenLabs (Eleven Labs, Inc. together with its affiliates, including Eleven Labs Poland sp. z o.o., with its registered office in Warsaw), acting as a processor under a data processing agreement. The data path for a conversation is as follows:

1. Speech-to-text and text-to-speech conversion. Your statement goes to ElevenLabs’ infrastructure, where it is transcribed and the assistant’s reply is converted into audio.
2. Generating the reply. The content of the conversation is transmitted to the provider of the language model selected in the assistant’s configuration. Models designated as hosted by ElevenLabs run within ElevenLabs’ infrastructure, and in that case the model’s creator does not receive the content of the conversation; with Google, OpenAI or Anthropic models, the content of the conversation is also transmitted to that provider.
3. A photo you send. If you send a photo, for example of a business card, it is transmitted from your browser to ElevenLabs’ infrastructure and reaches the language model as part of the conversation, on the same terms as its content.
4. Storage on the ElevenLabs side. The recording and transcript are saved in the conversation history in our workspace at the provider, for the retention period set in the agent’s configuration; the periods are set out in point 7. By default, the provider retains conversation data for 2 years, and audio recording is enabled by default.
5. Location. The default storage location for ElevenLabs customer data is the United States; the provider maintains servers in the United States, the Netherlands and Singapore, and storage of data exclusively within the European Union is an option available on the Enterprise plan. We use the standard environment in the United States. Even with a location in the European Union selected, some processing may take place outside it, in particular for the purposes of technical support and content moderation.
6. Moderation. The provider reserves the right to moderate content transmitted to and received from the service, and to transmit it to third parties for that purpose.
7. Our systems. We download the transcript and, in voice mode, the recording as well, into our own systems: business email and cloud drive, our contact database, our internal team communication tool and our internal automations. The providers of those systems are listed in point 5, and the retention periods set out in point 7 apply there.

3.8. Automated decisions

We do not take decisions in relation to you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. The assistant prepares material for a conversation, and the decision on further contact and on cooperation is taken by a human being from our team.

4. Other situations in which we process data

4.1. Browsing the website

Our hosting provider records in technical logs the IP address, the date and time of the request, the address of the requested page, the browser and system type, and the referring address. The basis for this is our legitimate interest in ensuring the security and correct operation of the website (Article 6(1)(f) of the GDPR).

4.2. Contacting us

If you write to us at our email address, or contact us by telephone or via a messaging application indicated on the website, we process the data you provide on that occasion: identifying and contact data and the content of your message. The basis for this is handling your enquiry and taking steps prior to a possible contract (Article 6(1)(b) and (f) of the GDPR). Contact via WhatsApp and Signal takes place in third-party applications, on the terms of their own privacy policies.

4.3. Cookies and browser storage

The website uses cookies and browser storage (localStorage, sessionStorage) to the extent:

1. necessary for the operation of the website and the assistant, including maintaining the conversation session, remembering the selected language and protecting against abuse. Basis: Article 6(1)(f) of the GDPR and Article 399(3) of the Polish Electronic Communications Act of 12 July 2024. These files do not require consent;
2. analytical and statistical — we use Microsoft Clarity, which gives us heatmaps and session recordings showing how this website is read. We store these files solely on the basis of your consent, given in the consent banner, and you can withdraw it at any time in the consent settings or in your browser. Until you give consent, the tool does not load at all.

The website does not use advertising cookies or retargeting. You can change your cookie settings in any browser; blocking necessary cookies may make it impossible to use the assistant.

4.4. Recruitment

When you apply for a role through the form on the Careers page, we process: your first name and surname, email address, the role you are applying for, your CV together with everything it contains, your answer to the question about what you want to learn, the consents you give or do not give, and the date and time of the application together with its identifier. The same applies to an application sent to us by email. Your IP address is used only momentarily to protect the form against abuse and is not saved with the application.

Applying is voluntary. The fields marked as required in the form are needed for us to consider your application; without them we cannot do so. Both consents are optional: not giving them does not affect how we assess your application. If you do not give consent to the processing of additional data from your CV, we do not take that data into account. You can withdraw either consent at any time by writing to the address given in point 1; withdrawal does not affect the lawfulness of processing carried out beforehand. After you withdraw consent to future recruitment, we keep your application only for the recruitment you applied for, for the period set out in point 7.

Please do not include in your CV data concerning health, origin, beliefs, trade union membership, sexual orientation or other special categories of data (Article 9 of the GDPR), information about criminal convictions, your PESEL number or identity document numbers. We do not need them. If you give the contact details of a referee, do so only with that person’s knowledge.

The application goes from the form, through our hosting provider’s server function, directly to our recruitment board in Notion (Notion Labs Inc., USA), where the CV is stored as an attachment. The website itself does not keep a copy of the application. Only authorised members of our team who conduct the recruitment have access to applications. We may discuss applications in our business email and internal team communication tool. Transfers outside the European Economic Area are covered by point 6.

Applications are read and assessed by people from our team. We do not take recruitment decisions based solely on automated processing, including profiling, and we do not use artificial intelligence systems to assess, score or rank candidates. We do not pass applications to language model providers.

5. Who we share data with

We entrust data to entities that process it on our instructions, on the basis of data processing agreements compliant with Article 28 of the GDPR, to the extent necessary to provide the services:

In addition, data may be disclosed to legal and accounting advisers, and to public authorities where such an obligation arises from provisions of law.

We make the current list of providers available on request, to the address indicated in point 1.

6. Transfers of data outside the European Economic Area

Some of our providers are established in third countries, primarily in the United States, or use infrastructure in such countries. In such cases, the transfer of data takes place on the basis of:

1. a European Commission decision finding an adequate level of protection, in particular under the Data Privacy Framework, where the provider has joined it, or
2. standard contractual clauses approved by the European Commission (Article 46(2)(c) of the GDPR), together with additional technical safeguards, including encryption of transmissions.

As regards the voice assistant service: the provider declares certification under the EU–US Data Privacy Framework, but that certification covers only its US entity and not its other affiliates. For individuals in the European Economic Area, the controller of voice data on the provider’s side is its Polish company, Eleven Labs Poland sp. z o.o., with its registered office in Warsaw. Notwithstanding this, conversation data is, in the standard configuration of the service, stored in the United States.

You can obtain a copy of the safeguards applied by writing to the address given in point 1.

7. How long we keep data

After these periods expire, we erase or anonymise the data.

8. Your rights

You have the right to:

1. access your data and obtain a copy of it (Article 15 of the GDPR), including a copy of the recording and transcript of a conversation and a copy of your application;
2. rectification of your data (Article 16 of the GDPR);
3. erasure of your data (Article 17 of the GDPR);
4. restriction of processing (Article 18 of the GDPR);
5. portability of data processed on the basis of consent or a contract (Article 20 of the GDPR);
6. object to processing based on our legitimate interest (Article 21 of the GDPR), including to your details being recorded in our contact database;
7. withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
8. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, if you believe that we are processing your data unlawfully.

You can submit a request to the address indicated in point 1. We respond without undue delay and no later than one month from receiving the request. To handle a request concerning a specific conversation, it will help if you indicate the approximate date and time of the conversation and the first name, surname or email address given during it. If we are unable to link a conversation to you, we will inform you of this.

9. Where we get your data from

We obtain data directly from you: from your conversation with the assistant, from correspondence, from a telephone conversation, or from a business card you have sent. We may supplement data about the organisation you represent from generally available public sources, in particular from that organisation’s website and from public registers, on the basis of our legitimate interest (Article 6(1)(f) of the GDPR).

In recruitment, we rely on the data you send us in your application. If you point us to a public professional profile or portfolio, we may view it.

10. How we protect data

We apply technical and organisational measures appropriate to the risk, in particular: encryption of transmissions (HTTPS), restriction of access to recordings and transcripts to authorised members of the team, multi-factor authentication in business systems, data processing agreements with providers, confidentiality undertakings and the principle of data minimisation. We maintain a record of processing activities and a register of authorisations.

11. Age of users

The website, the assistant and recruitment are intended for adults contacting us on professional or business matters. We do not direct the website at children and do not knowingly collect data of persons under 18 years of age. If we learn that such a conversation has taken place or that we have received such an application, we delete the record of it.

12. Changes to this policy

We may change this policy, in particular in the event of changes in legislation, in the scope of the website’s features, or in the list of providers. The current version is always available on the website, together with its effective date. We announce material changes on the website.