Staging Test environment: this is a demo version, no real data is processed.

Trust

Designed for AI Act and GDPR compliance

Elicitra is built for European voice elicitation and lead qualification. We do not claim formal certification. We publish what the platform actually implements.

AI disclosure by design

Respondents are told they are interacting with an AI assistant. Calls may be recorded and transcribed for structured summaries. The displayed notice is saved in the receipt; the spoken statement is logged separately with the conversation.

Granular respondent choices

Acceptance of the terms and acknowledgement of the AI notice are required; consent for optional purposes remains separate. Marketing consent is optional, never pre-checked, and stored as a distinct purpose. On Growth and Scale, campaigns can add a controller privacy informative and optional scopes—or bring your own privacy policy texts on Scale—without replacing the platform layer.

Retention and minimization

Raw transcripts and provider events follow a 90-day raw retention window. Business outputs follow a longer business window, then anonymization. Consent receipts are retained longer as evidence. Provider recordings are purged when raw retention runs.

EU hosting baseline

Application and database run on Hetzner infrastructure for Elicitra. Some subprocessors may still process data outside the EU until residency work in our deferred readiness track completes — see the subprocessor list.

Deployer responsibility

Platform customers configure scenarios and campaigns. They remain the deployer for intended purpose, what their agent asks, and any campaign-specific privacy texts they paste. Elicitra provides the runtime, platform consent layer, disclosure, and security controls.

No advertising or analytics trackers

Elicitra pages do not load profiling cookies or third-party advertising or analytics tags. Technical, preference, security, authentication, and first-party aggregate measurement cookies are documented in the cookie notice. Public immediate phone starts use Cloudflare Turnstile as a disclosed mandatory security provider. External customer pages remain under their own notice and CMP.

Cookie notice

Operational compliance text for pilots. Counsel review remains required for broader rollout.