Privacy Policy

SecureVoice Technologies FZ-LLC ("SecureVoice", "we") provides a real-time voice fraud-intervention platform for banks and insurers operating in the United Arab Emirates. This policy explains what personal data we process through this website and the platform, why, and the rights you have over it.

We act as the data controller for data submitted through this website (for example, a pilot request) and as a data processor acting on your bank's documented instructions for any data processed inside a bank deployment of the platform.

Through this website we collect only what you type into the pilot-request form: your name, work email, institution, and any optional scoping details (role, portfolio volume, message). We do not run advertising trackers, we do not buy or sell personal data, and we do not use cookies for cross-site profiling.

Inside bank deployments, the platform processes call audio, transcripts, and case metadata strictly to detect and interrupt fraud. Account identifiers reach the platform as tokens — never as full card numbers — and knowledge-check answers are verified without being stored.

For website data we rely on your consent, given when you submit a form, and on our legitimate interest in operating and securing the service. For fraud-intervention calls processed for a bank, the lawful basis is established by that bank — typically the vital-interest and legal-obligation bases recognised under Federal Decree-Law No. 45 of 2021 (the "PDPL") — and we operate strictly on the bank's documented instructions.

Because this deployment runs in the European Economic Area, we also comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679) for personal data processed in connection with it: we rely on your consent for website submissions and on legitimate interests for security logging, we have concluded a Data Processing Agreement with each processor, and transfers outside the EEA are covered by Standard Contractual Clauses or an adequacy decision.

This website and the reference deployment run in European infrastructure: the application server and its database are hosted in Germany (Frankfurt, eu-central-1) with TLS 1.3 in transit and AES-256 at rest.

Live voice inference — text to speech and speech to text — is performed by our processors (listed below) in the United States and the United Kingdom, so the words spoken during an intervention call cross the border to be synthesised. We do not send call audio to any model for reasoning or decision-making; intent classification and every protective action are deterministic server-side code.

In a bank deployment the position changes: case data, transcripts and audio are written to the bank's own tenancy, and our role is that of a processor acting on the bank's documented instructions. A bank requiring in-country (UAE) processing deploys the platform inside its own VPC — the container topology is unchanged — so speech, transcripts and case data never leave its perimeter.

We do not sell personal data, and we do not use it for advertising or profiling of any kind.

We use a small number of processors, each under contract and each limited to the purpose stated: identity and session management, which we host ourselves on our own infrastructure (the Clerk processor was retired at the Clerk -> Better Auth cutover, and no account data is sent to a third-party identity provider); telephony for outbound intervention calls and SMS (Twilio); speech synthesis and transcription (ElevenLabs, with Deepgram as fallback); optional reply drafting (Groq or Google Gemini); infrastructure and database hosting (the cloud provider and database provider named in our sub-processor register); and transactional email for support replies. Where a deployment enables Better Auth's optional hosted telemetry (BETTER_AUTH_API_KEY), Better Auth receives request metadata only — never case content, credentials, or personal data — and that processor must be added to the register below before such a deployment is offered.

Where a bank requires additional residency, silence, or a written commitment for any of these, we will either pin the processor to an in-region endpoint or remove it from that deployment. The current register, with processing locations and the standard contractual clauses where applicable, is available on request.

The intervention call is delivered by an AI voice agent. Every call opens with a spoken disclosure that it is an automated system calling on the bank's behalf and that the call is recorded, and the agent never asks for a PIN, password, one-time passcode or full card number.

You can ask to stop at any time and the opt-out is honoured immediately for all future contact about that account.

Pilot requests are retained for up to 24 months from last contact, then deleted or anonymised. In platform deployments, transcripts are pseudonymised after case closure and raw audio retention is configurable by the bank — down to zero once the tamper-evident audit hash has been written.

Access is role-based and least-privilege. Website data is visible only to the pilot team. Deployment data is visible only to the bank itself; SecureVoice staff have no standing access to customer call data, and any time-boxed support access is logged and announced.

Under the PDPL you may request access, correction, deletion, portability, or object to processing. Under the GDPR you may also request restriction and erasure, and you may complain to your national supervisory authority — in the EEA, the Irish Data Protection Commission is our lead authority. Email otemaach@gmail.com and we will verify and respond within 30 days.

If your data is processed inside your bank's deployment of SecureVoice, direct your request to the bank; we support the bank in fulfilling it. If you ask us to delete a case record, we destroy the encryption key that makes the transcript readable while retaining the hash chain, so the record of the action remains provable without the content.

TLS 1.3 in transit, AES-256 at rest, signed webhooks, least-privilege access, and an immutable audit trail are described in detail on our Security page. We do not ask for — and the platform structurally cannot request — PINs, passwords, OTPs or full card numbers.

Data protection questions: otemaach@gmail.com. Postal: SecureVoice Technologies FZ-LLC, Dubai, United Arab Emirates. We answer every privacy email personally — no ticket bots.