Georgia OÜ Privacy Policy

Effective date: 28 Sept 2026

This Privacy Policy explains how Georgia OÜ collects, uses, shares and protects personal data when you visit georgia-app.com or use the Georgia web and mobile application (the Service), and what rights you have. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

1. Who we are and our role

Georgia OÜ is a private limited company registered in Estonia under registry code 17281016, with its registered address at Roosi tn 17, Jõgeva linn, Jõgeva vald, Jõgeva maakond, 48305, Estonia. You can reach us about privacy at admin@georgia-app.com.

Our role depends on how you use Georgia:

• Georgia OÜ as controller. We decide how and why your data is processed when you visit our website, book a demo, contact us, sign up individually, or pay for a subscription yourself. This Privacy Policy fully applies in these cases.
• Georgia OÜ as processor. When your employer or another organisation gives you access to Georgia, that organisation is the controller of the data processed in its workspace, including your practice recordings, transcripts and scores. We process that data only on its instructions under a data processing agreement in line with Article 28 GDPR. Your organisation's own privacy notice explains its purposes, and you should contact it first to exercise your rights. We will help it respond.

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

2. What data we collect and why

We collect only the data we need for the purposes below. Each purpose has a legal basis under Article 6 GDPR.

Account data. We collect your name and work email to create and manage your account and let you log in. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

Practice session data. When you practise, we process your voice recordings, chat messages, transcripts, AI feedback, scores and session history. We use this data to run role-play sessions, generate feedback and show your progress to you and, for organisation accounts, to your managers. This data is stored in anonymised form, without your name or email attached, and you can delete it at any time in your account settings. The legal basis is the performance of our contract (Art. 6(1)(b) GDPR). For organisation accounts, we process it on the organisation's instructions.

Communications. When you email us, request support, book a demo or send feedback, we process your messages and contact details to respond and help you. The legal basis is the performance of a contract or steps taken before entering one (Art. 6(1)(b) GDPR), and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Technical and usage data. We collect anonymised usage statistics, device and browser type, and error reports to keep the Service secure and working, fix bugs and prevent abuse. The legal basis is our legitimate interest in security and service reliability (Art. 6(1)(f) GDPR).

Analytics data. With your consent, we collect information such as pages visited and clicks to understand how our website and Service are used and to improve them. The legal basis is your consent for non-essential cookies (Art. 6(1)(a) GDPR), and our legitimate interest for aggregated, de-identified statistics (Art. 6(1)(f) GDPR).

Marketing data. We use your email address and newsletter preferences to send you news and offers. The legal basis is your consent (Art. 6(1)(a) GDPR). For existing customers, we may rely on our legitimate interest in promoting similar services, and you can opt out at any time.

Payments. All payments are handled directly by our payment processor. We do not collect or store your card or payment details. The processor only tells us whether a payment succeeded, so we can activate or renew your subscription. See section 3 for more information.

No AI training on your data. We do not use your recordings, transcripts or other session data to train or fine-tune AI models.

Voice recordings. Your voice is recorded only during active practice sessions you start. We use recordings to transcribe what you said and generate feedback. We do not use your voice to identify you or build a voiceprint, and we do not clone your voice.

No special category data needed. The Service does not need health, political, religious or other sensitive data. Please do not include such information about yourself or others in sessions or uploaded material.

Automated feedback and scoring. Feedback and scores are generated automatically by AI to support your training. They do not, on their own, produce legal effects or similarly significant effects for you within the meaning of Article 22 GDPR. Organisations using Georgia commit under their agreement with us not to rely on AI scores alone for decisions about hiring, promotion, discipline or dismissal.

If you do not provide the data needed for your account or sessions, we cannot provide the Service to you.

3. Third-party providers we use

We do not sell your personal data. To run Georgia, we use a small number of trusted third-party providers. Each receives only the data it needs for its task and is bound by a data processing agreement or equivalent contractual terms.

Payment processor. Our payment processor handles payments, subscriptions, invoicing and fraud prevention. It receives your billing name, email, card or payment details, transaction data and IP address. It operates from the EU, and any transfers to the United States are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

AI voice provider. Our AI voice provider generates the synthetic voices of role-play characters and transcribes your speech during practice sessions. It receives the text of the AI characters' lines and the audio of your practice sessions. It processes data in the United States under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback.

AI language model provider. Our AI language model provider generates character dialogue, feedback and scores. It receives anonymised session transcripts and scenario content. We contract with its EU entity in Ireland, and data is processed in the United States under Standard Contractual Clauses.

Server hosting provider. Our hosting provider supplies the dedicated server on which we host and operate the application and database ourselves. All Service data is stored on this server, located in Germany (EU).

Email provider. Our email provider handles sending and receiving emails, support requests and demo bookings. It receives your name, email address and message content. We contract with its EU entity in Ireland, and data may be processed in the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Website analytics tool. Our analytics tool measures website usage, only after you accept analytics cookies. It receives pages visited, clicks, device and browser data and approximate location. IP addresses are not stored. We contract with its EU entity in Ireland, and data may be processed in the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Our payment processor as an independent controller. Our payment processor handles some payment data for its own purposes, such as fraud prevention and meeting its legal obligations as a regulated payment institution. For that processing, it is responsible under its own privacy policy. We never see or store your full card number.

AI voices. We use a specialised AI voice provider to give Georgia's role-play characters their voices. The voices you hear are synthetic and do not belong to real people. Our account with this provider is configured so that data we send is not used to train its models.

Other recipients. We may also share data:

• with your organisation, if you use Georgia through an organisation account (your managers can see your sessions, progress and scores as configured by the organisation);
• with our professional advisers, such as accountants, auditors and lawyers, under confidentiality obligations;
• with public authorities, courts or law enforcement, where Estonian or EU law requires it;
• with a buyer or successor if Georgia OÜ is involved in a merger, acquisition or sale of assets, subject to equivalent protection of your data.

A full list of the named providers we use is available on request at admin@georgia-app.com. Organisation customers receive this list under their data processing agreement and are notified in advance of any new provider.

4. International transfers

We aim to store and process your data within the European Economic Area (EEA). Some providers, such as our payment processor, AI voice provider and AI language model provider, may process data in the United States or other countries outside the EEA. We only allow such transfers where there is a lawful safeguard under Chapter V GDPR: an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies), or the European Commission's Standard Contractual Clauses together with additional measures where needed. You can ask us for a copy of the relevant safeguards at admin@georgia-app.com.

5. How long we keep your data

We keep account data for as long as your account is active and delete it within 30 days after you close it.

We keep practice recordings and transcripts for as long as your account is active, or for a shorter period if you or your organisation delete them or set a shorter period. They are deleted within 30 days after account closure.

We keep scores and progress history for the life of the account. Organisations may keep aggregated, anonymised reports afterwards.

We keep invoices and accounting records for 7 years from the end of the financial year, as required by the Estonian Accounting Act.

We keep support and demo correspondence for up to 24 months after the last contact.

We keep marketing consent records until you withdraw consent, and proof of consent for as long as needed to demonstrate compliance.

We keep security and server logs for up to 12 months.

Backups are overwritten within 35 days.

When the retention period ends, we delete or irreversibly anonymise the data.

6. How we protect your data

We use appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, multi-factor authentication for staff access, logging and monitoring, and regular review of our providers. Only staff who need access to perform their job can access personal data, and they are bound by confidentiality.

If a personal data breach is likely to put your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, and we will inform you without undue delay where the risk is high.

7. AI transparency

When you use Georgia, you are interacting with an AI system. Role-play characters, their dialogue, their voices, and your feedback and scores are generated by AI. We clearly label AI-generated voices and content within the Service, in line with the EU Artificial Intelligence Act.

8. Cookies

We use strictly necessary cookies to keep you logged in, remember your settings and keep the Service secure. These do not need your consent.

We use analytics and marketing cookies only if you accept them in our cookie banner, as required by the Estonian Electronic Communications Act and the GDPR. You can change your choice at any time via Cookie Preferences in the website footer. Refusing non-essential cookies does not affect your ability to use the Service.

9. Your rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data, where there is no legal reason for us to keep it;
• restrict processing in certain situations;
• data portability, meaning to receive data you gave us in a structured, machine-readable format, or have it sent to another provider;
• object to processing based on our legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time, without affecting processing that took place before withdrawal;
• not be subject to a decision based solely on automated processing that significantly affects you.

Delete your data yourself. You can delete your practice recordings, transcripts and session history, or your whole account, at any time in your account settings. Deletion takes effect immediately in the Service, and remaining copies in backups are overwritten within the period set out in section 5.

To exercise your rights, email admin@georgia-app.com. We will respond within one month. We may ask you to verify your identity first. If you use Georgia through an organisation, we may forward your request to that organisation, as it is the controller of your session data.

Right to complain. You can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee, or with the data protection authority in your EU country of residence or work. We would appreciate the chance to address your concern first.

10. Changes to this Privacy Policy

We may update this Privacy Policy when our Service, providers or the law change. The effective date at the top shows when it was last updated. If we make significant changes, we will notify you by email or in the Service before they take effect.

11. Contact

Georgia OÜ
Registry code: 17281016
Registered address: Roosi tn 17, Jõgeva linn, Jõgeva vald, Jõgeva maakond, 48305, Estonia
Email: admin@georgia-app.com
Website: georgia-app.com