Privacy Policy
This Privacy Policy explains how Prestance Lab handles personal data in connection with the Prestance AI assistant for retail sales advisors and their managers — reached by telephone, WhatsApp, SMS or email, or through the optional Prestance application — and the related service (together, the “Solution”). It is written to be read alongside the Data Processing Agreement and the Security policy, which govern in the event of any conflict for business-customer relationships.
1. Who we are and our role
Prestance Lab (“Prestance Lab”, “we”, “us”) provides a business-to-business AI assistant for retail sales advisors and their managers. It helps the advisor before, after and between client visits — who to reach out to, what to prepare, what to follow up — and lets them practise a hard conversation with the assistant playing a client. The Solution is made available to professionals (“Authorized Users”) by their employer or principal (the “Customer”) under a subscription agreement.
Our role depends on the data in question:
- As a processor. For the personal data generated when an Authorized User uses the assistant — their calls and messages with it, the client files they build through their own debriefs, their practice sessions (audio, transcripts, scores, and coaching feedback), and the aggregated team signals derived for management — the Customer is the data controller and Prestance Lab acts as its processor, processing that data only on the Customer’s documented instructions under the Data Processing Agreement. If you are an Authorized User, your employer determines why and how this data is used; please direct rights requests to them in the first instance (see Section 9). If you are a client of one of our Customers, that Customer is the controller of your client file.
- As a controller. For a limited set of data we need to run the Solution as a business — account administration, authentication and security logs, billing records, and aggregated product analytics — Prestance Lab acts as the controller.
2. The data we process
| Category | Examples | Our role |
|---|---|---|
| Account & identity | Name, professional email address, professional mobile number, workspace and role assignment, login credentials. | Controller |
| Advisor exchanges | The advisor’s calls with the assistant (audio and transcripts) and their WhatsApp, SMS and email messages with it; the briefs and drafts the assistant produces in reply. | Processor |
| Client files | What the advisor records about a client through their own debriefs: name or initials, contact preferences, purchase and visit history, stated preferences and sizes, occasions and dates, notes. Where the Customer agrees, a bounded, read-only set of its own data: product and stock information, calendars, CRM data. | Processor |
| Practice sessions | Audio, transcripts, performance scores, and coaching feedback from practice calls with the assistant playing a client. Visible to the advisor only. | Processor |
| Manager signals | Activity counts and recurring conversation patterns per team and per advisor. Never transcripts, never one person’s words. | Processor |
| Device & technical | Device type and operating-system version, app version, IP address, crash and diagnostic logs, connection quality metrics. | Controller |
| Product analytics | Pseudonymous events about how features are used (for example, a brief requested or a practice session completed), to operate and improve the Solution. | Controller |
The Solution is a professional tool. It is not directed at the general public. Client files hold only what clienteling requires and never special-category personal data; practice sessions use synthetic client personas — see the Acceptable Use Policy.
3. Voice data
Your voice is captured only on your own calls with the assistant and during practice sessions — by telephone, or through the application’s microphone when you use it. Audio is used to power the live spoken interaction, to produce a transcript, to update your client files from your debriefs, and to generate coaching feedback in practice.
The assistant never listens to or records a client: it has no presence in the room during a client conversation. Voice data is used for speech interaction and communication coaching only. We do not use your voice to identify you biometrically, and we do not deploy emotion-inference models, nor do we use the content of your exchanges to build advertising profiles. Microphone access for the application can be revoked at any time in your device settings; doing so disables in-app voice sessions but not the telephone channel.
4. Why we process personal data
Where Prestance Lab acts as a controller, we rely on the following legal bases under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and equivalent laws:
- Performance of a contract — to provision accounts, authenticate users, and deliver the Solution.
- Legitimate interests — to keep the Solution secure, prevent abuse, and understand and improve how it is used, balanced against your rights and freedoms.
- Legal obligation — to meet accounting, tax, and security obligations.
Where Prestance Lab acts as a processor, the legal basis for processing your exchanges, client files, and practice data is determined by the Customer as controller.
5. Sub-processors and how data is shared
We do not sell personal data and we do not share it for third-party advertising. We rely on a small set of vetted infrastructure and artificial-intelligence sub-processors to operate the Solution — for hosting and storage, real-time audio transport, the telephone, WhatsApp, SMS and email channels, speech and language processing, and product analytics. The authoritative, current list, together with their locations and the safeguards that apply, is maintained in the Data Processing Agreement and the Security policy.
Sub-processors are bound by contract to process personal data only to provide their service to us, and our AI sub-processors operate under a no-training posture — your data is not used to train their models. We may also disclose data where required by law or to establish, exercise, or defend legal claims.
International transfers
We host and store personal data in Europe: the application and advisor-memory tiers in the European Union (Germany), the database, authentication and file-storage tier in the United Kingdom under the European Commission's adequacy decision. Where a sub-processor processes data outside the European Economic Area, the transfer is covered by an adequacy decision or by Standard Contractual Clauses, as detailed in the Data Processing Agreement.
6. Retention
Your exchanges with the assistant, client files, and practice data (audio, transcripts, scores, and coaching feedback) are retained for the duration of the Customer’s subscription and the retention period the Customer configures or instructs, after which they are deleted or returned in line with the Data Processing Agreement. Account, security, and billing records that we hold as controller are kept only as long as necessary for the purposes above and to meet our legal obligations.
7. Security
Personal data is encrypted in transit and, except as disclosed in the Security policy, at rest; access is restricted on a need-to-know basis, and the Solution is operated under the controls described there. Suspected security issues can be reported to security@prestancelab.com.
8. Children
The Solution is a workplace tool intended for professional use by adults. It is not directed at children and we do not knowingly collect personal data from anyone under the age of 16.
9. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability.
If you are an Authorized User, your employer (the Customer) is the controller of your exchanges, client files, and practice data. Please send rights requests to your employer first; we will assist them in responding, as required by the Data Processing Agreement. If you are a client of one of our Customers, that Customer (the maison or retailer you deal with) is the controller of your client file; please address your request to them, and we will assist. For data we hold as controller, or if you are unsure who to contact, write to privacy@prestancelab.com.
You also have the right to lodge a complaint with a supervisory authority. In France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL).
10. Apple App Store disclosure
For the optional Prestance app distributed via the Apple App Store, the data described above — account and contact details, microphone audio and the resulting transcripts, client files and coaching outputs, identifiers, usage data, and diagnostics — may be linked to your identity to deliver the Solution. We do not use this data to track you across apps or websites owned by other companies.
11. Changes to this Policy
We may update this Policy from time to time. Material changes affecting business Customers are notified at least 30 days in advance in line with our general terms, unless a shorter period is required by law or to address a security risk. The date at the top of this page records the latest revision.
12. Contact
- Privacy and data-protection matters: privacy@prestancelab.com
- Security incidents: security@prestancelab.com
- General legal enquiries: legal@prestancelab.com