millevoix — Privacy policy

Version of September 24, 2026. If the languages diverge, the French text prevails.

The controller

millevoix, a sole proprietorship registered in Switzerland (see the legal notice). Contact: contact@millevoix.ai.

What we store

• Your conversation with your representative. It is kept for you alone: no other member sees it, and you can erase it at any time.
• The group’s ledger: the ideas, the arguments and the voices, in their rephrased form, never attributed to a member. Voices are attached to your seat so that each person counts once, but no function of the interface exposes them to anyone.
• The seat: its access keys and, where applicable, the private note your representative keeps to follow you better, readable and erasable by you.
• Your proofs, only if you give them, and never in clear: of each verified email address we keep only an irreversible fingerprint and its domain (the address itself merely passes through, typed by you, to receive its code); of a confirmed mobile phone number, an irreversible fingerprint and its country, never the number. These fingerprints link your groups, serve to find them again and, for spontaneous groups, to prove that you belong to an organization; they can be withdrawn at any time. Our data ties your voices and words to organizations, never to a name, and we cannot contact you outside the service.
• Your public place, if you take one: the country of your phone number and the territory you declare (a canton, a commune), kept as such, since it is what opens the places you belong to. It is the only location we keep: never an address. It disappears with your phone number.
• Your conversations with a group’s spokesperson, if you talk to it: kept for you and read by the group’s members, whose voice it is, never tied to your name (to your seat if you are a member, to your device otherwise). Every message first passes an automatic check: one that exposes a private person, crosses the law’s floor, insults or advertises is blocked, never passed to the spokesperson, and kept for the millevoix team with its ground. A conversation an automatic review holds back is no longer shown to the group until the millevoix team has looked at it. If you share a conversation, a frozen copy is readable by anyone holding its link, until you take it back.
• Your reports, if you make any: the text concerned, the ground you choose and the detail you write, with a fingerprint of your device used to bound abuse (one report per device and text). They are read by the millevoix team alone and never shown to a member.
• The group’s presence volumes: how many joined, contributed, are connected.
• The technical necessities: a session cookie (essential to the service, no tracking), brief technical logs, and the group’s economy data (balance, consumption).

Payments are handled by Stripe: we neither see nor store card data. Stripe knows the payer’s identity, as with any online purchase.

The phone number

On the public place, a mobile phone number is asked before you first speak, once. It serves two things: to recognize one person from one device to the next, so that they count once in a place, and to know their country, the one of the dialling code, which opens their places.

The number only passes through: Twilio checks that it is a mobile line and sends the code, then millevoix keeps only an irreversible fingerprint of it and the country. Nobody, neither a member nor an organizer, ever sees it, and no text message follows the code’s.

It will never be sold, used for advertising, or used to contact you. You withdraw it at any time from the account page: your public places close with it, and what you wrote there stays, anonymous as it was.

What we do with it

• Provide the service: formulate positions from your speech, restitute the state of the group, keep the conversation alive.
• Improve it: we may use exchanges to evaluate, develop and train the artificial-intelligence systems and models millevoix uses, and a restricted team may examine some for that purpose. None of this internal work is visible to the group or the organizer, and anonymity between members is unaffected.
• Protect it: prevent abuse and keep the service secure.

On what grounds

Providing the service rests on the contract between us. Improvement, security and abuse prevention rest on our legitimate interests. The account rests on your consent, revocable by deleting it.

What we will never do

Sell data. Show advertising. Build profiles for advertising or commercial purposes. Reveal to a member or an organizer what another member thinks or does.

Sensitive data

millevoix requests no sensitive data and builds no profiles for advertising or commercial purposes. Everyone freely chooses what they confide to the conversation; avoid needlessly sharing sensitive or confidential information there, or details that identify third parties.

Voice mode

In voice mode, the audio goes directly from your device to OpenAI, without passing through millevoix’s servers: millevoix keeps none of it, only the transcription remains, like a written message.

Our processors

• OpenAI: the representative, the clerk, the spokesperson, the translation and the check of the messages said to the spokesperson run on its API, which processes the exchanges and the voice. Through the API, OpenAI does not use this data to train its general models.
• Stripe: payments.
• Twilio: the confirmation of phone numbers by SMS, for the groups that ask for it and for the public place. It receives the number for as long as it takes to check that it is a mobile line and to send the code; millevoix then keeps only a fingerprint of it.
• Cloudflare Turnstile: protection against bots and abuse. It processes technical signals (IP address, TLS fingerprint, browser information), never the content of conversations.
• Infomaniak: hosting, in Switzerland.

Some of this data may be processed notably in Ireland and the United States. These transfers rest on the mechanisms recognized by applicable law: adequacy decisions, recognized data protection frameworks or standard contractual clauses.

Retention

Your conversation stays until you erase it or the group ceases to exist. Deleting a group is final: ledger and conversations disappear from the active service, and copies may remain temporarily in backups, until their automatic renewal. A text removed by moderation is kept thirty days, accessible to millevoix alone, then erased; the trace of the removal (its date, its ground) stays. A message blocked before reaching a spokesperson is kept ninety days, accessible to millevoix alone, then erased.

Your rights

The Swiss data protection act (nFADP) applies, and the GDPR where members are in the European Union. Depending on applicable law, you can request access, rectification, erasure, restriction or delivery of your data, object to certain processing, and lodge a complaint with the competent data protection authority.

The product itself exercises most of these rights directly: you read everything that concerns you, correct your positions in the conversation and erase your conversation yourself. For the rest, write to contact@millevoix.ai. One honest limit: without one of your access keys, we may be unable to find your seat or to verify that data is yours, and we do not collect additional information solely to identify you.

Security

Encryption in transit (TLS), protected session cookies, restricted access on the operator’s side.

Changes

This policy is versioned and dated; substantial changes are announced in the app and on this site.