Privacy policy
Last updated: 20 August 2026
secretaire.lu is an AI-powered virtual receptionist service: the assistant answers phone calls, understands the caller's language, answers questions from a knowledge base, books appointments and forwards messages. Delivering that service necessarily involves personal data — of visitors to this site, of our prospects and clients, and of the people who call our clients. This policy explains what we process, why, and for how long.
1. Controller and roles
TealSpark S.à r.l.-S, 3 Rue Edouard Oster, L-2272 Howald, Luxembourg (VAT LU35495321) — "we". Contact: info@secretaire.lu, +352 27 63 13 83.
- Controller for data relating to this website, our prospects, our clients and people who contact our own demonstration line.
- Processor (Article 28 GDPR) for the calls and messages the assistant handles on behalf of a client: in that case the client is the controller, determines the purposes, and is responsible for informing its own callers. A data processing agreement (DPA) is available to clients on request.
2. Data we process
2.1 Website visitors
- Contact form: name, email address, phone number (optional) and the content of your message.
- Demonstration assistant (chat widget on the site or a call to +352 27 63 13 83): the content of the conversation, its transcript, the detected language, the date and duration, and any contact details you volunteer. Depending on the voice provider's configuration, an audio recording of the call may be retained.
- Technical data: hosting access logs (IP address, timestamp, pages viewed, browser type), needed to run and secure the site.
2.2 Prospects booking a demonstration
- Name, email address, phone number, chosen time slot and any note about the topic, so we can create the meeting and send you a confirmation.
2.3 Clients
- Business contact details, the information needed to build the knowledge base, billing data and usage statistics (minutes consumed, number of calls).
2.4 People calling our clients
- Calling number, call content and transcript, call summary, language, contact details and information volunteered during the call (for example for a callback or an appointment), and appointments created. This data is processed on behalf of the relevant client.
We ask our clients not to route conversations involving sensitive data (health, banking details) to the assistant. The assistant does not take payments and does not collect card details over the phone.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering a request sent through the contact form | Pre-contractual steps (Art. 6(1)(b)) / legitimate interest in replying (Art. 6(1)(f)) |
| Running the demonstration assistant so you can test the service | Legitimate interest in presenting the service (Art. 6(1)(f)) |
| Arranging and confirming a discovery meeting | Pre-contractual steps (Art. 6(1)(b)) |
| Delivering the subscribed service (answering calls, booking appointments, notifications, reports) | Performance of the contract (Art. 6(1)(b)); for our clients' callers: the client's documented instructions as controller (Art. 28) |
| Invoicing, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Security, fraud and abuse prevention, technical logging | Legitimate interest (Art. 6(1)(f)) |
| Improving service quality (reviewing calls and transcripts) | Legitimate interest (Art. 6(1)(f)), with a right to object |
4. Sub-processors and recipients
We do not sell or rent your data. It is accessible to authorised staff on a need-to-know basis and to the following technical providers, acting on our instructions:
| Provider | Role |
|---|---|
| ElevenLabs | Conversational and voice AI: speech processing, call transcription, summaries |
| Twilio | Telephony and Luxembourg numbers (call routing) |
| Vercel | Hosting of the website and serverless functions, technical logs |
| Supabase (PostgreSQL database) | Storage of account configuration, appointments and service data |
| Trigger.dev | Execution of background jobs (recap and confirmation emails) |
| Our email delivery provider (SMTP) | Sending call recaps, confirmations and reminders |
| Google (Google Calendar) | Creating and reading appointments in the relevant calendar |
| Calendly | Availability and time slots offered when booking |
| Web3Forms | Delivery of messages sent through the website contact form |
| Google Fonts | Loading the site's web fonts (processes your IP address) |
The list of sub-processors actually used for a client account is provided on request and annexed to the DPA. We may also disclose data to a competent authority where the law requires it.
5. Transfers outside the European Union
Primary storage of service data is on servers located in the European Union. Some of the providers listed above are established in the United States or may carry out support operations there: such transfers are covered by the European Commission's standard contractual clauses and, where relevant, by additional technical measures (encryption in transit and at rest, minimisation of the data transmitted).
6. Retention periods
| Data | Retention |
|---|---|
| Messages received through the contact form | 24 months from the last exchange |
| Conversations and transcripts from the demonstration assistant | 12 months |
| Calls, transcripts and recaps processed for a client | As instructed by the client and set out in the contract; failing that, 12 months, then deletion or anonymisation |
| Appointments and confirmations | Duration of the relationship, then 12 months |
| Account and billing data | Duration of the contract, then 10 years (Luxembourg accounting obligations) |
| Hosting technical logs | 12 months maximum |
When a client account ends, the data processed on its behalf is deleted or returned as provided in the contract.
7. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy;
- have inaccurate data corrected;
- have data erased, within the limits of our legal obligations;
- restrict processing;
- object to processing based on our legitimate interest;
- receive the data you provided in a portable format;
- withdraw your consent at any time where processing is based on it;
- give instructions on what happens to your data after your death.
To exercise these rights, write to info@secretaire.lu. We respond within one month. If your data was processed on behalf of one of our clients, we forward your request to that client, who is the controller.
You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu.
8. Cookies and trackers
This site uses no advertising cookies and no analytics tools. Third-party resources needed to run it are loaded from their publishers' servers (Google Fonts, the ElevenLabs conversation widget): those publishers then process your IP address, and the widget may store technical information in your browser to maintain the conversation session.
9. Security
Access to data is limited to those who need it, secrets and access tokens are encrypted, traffic to our servers is encrypted in transit, and inbound webhooks are authenticated by signature. A non-disclosure agreement (NDA) and a data processing agreement (DPA) are available on request.
10. AI transparency
Calls are handled by an automated assistant. When asked what it is, the assistant always states that it is an artificial intelligence. It does not provide legal, medical or financial advice and passes such requests to a human.
11. Changes
This policy may be updated to reflect changes in the service or in applicable regulation. The date of the latest update appears at the top of this page.