Effective Date: July 6, 2026
RillaVoice, Inc. (“Rilla,” “we,” “us,” or “our”) provides an AI-powered speech analytics platform (the “Platform” or “Services”) that records, transcribes, and analyzes in-person sales and service conversations on behalf of our enterprise customers (“Customers” or “Business Clients”). In connection with the provision of these Services, the Platform leverages voiceprints generated from Business Client personnel who have specifically consented to having their Biometric Data processed. Rilla does not enroll, retain, store, disclose, or use any voiceprint of a Business Client’s customer to identify that individual, and any transient processing of our Business Client’s customer’s voice data is used solely to separate and attribute speech and is not retained following the transcription process. Rilla retains and uses voiceprints only for Business Client personnel who have specifically consented to having their voiceprint generated.
This Biometric Information Processing Policy (“Policy”) is made publicly available pursuant to the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”), the Texas Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001 et seq. (“Texas CUBI”), the Washington Biometric Privacy Act, RCW 19.375 et seq. (“Washington BPA”), and other applicable biometric privacy laws (collectively, “Biometric Privacy Laws”). This Policy describes how Rilla collects, uses, stores, retains, discloses, and destroys Biometric Data in connection with the Services.
With respect to Biometric Data collected through the Platform in connection with the Services, Rilla acts as a data processor (or “service provider”) on behalf of its Business Clients, who act as data controllers. Rilla processes Biometric Data solely at the direction of and on behalf of its Business Clients and in accordance with the terms of its agreements with such Business Clients, including any applicable Data Processing Addendum.
Rilla’s Business Clients are solely responsible for: (a) determining whether and how to deploy the Platform’s recording, transcription, and analytics features; (b) ensuring that all applicable legal requirements are met prior to and during the collection of Biometric Data through the Services, including obtaining any required notices, consents, or releases from individuals whose voices are recorded; and (c) complying with all Biometric Privacy Laws applicable to their collection and use of Biometric Data through the Services.
In connection with the provision of the Services, Rilla will process Biometric Data on behalf of its Business Clients, solely from Business Client personnel who have specifically consented to having their voiceprint generated. This may include mathematical representations of vocal characteristics that are generated, with the applicable individual’s consent, during the transcription process to facilitate speaker diarization (distinguishing between individual speakers within a recorded conversation) and speaker attribution.
Rilla processes Biometric Data exclusively on behalf of and at the direction of its Business Clients, which may include transcription services, speaker diarization and attribution, conversation analytics, and enabling platform functionality. Rilla does not use Biometric Data for any purpose other than providing the Services as directed by its Business Clients.
Under applicable Biometric Privacy Laws, the obligation to provide written notice to individuals and obtain written informed consent prior to the collection of Biometric Data rests with the data controller — i.e., Rilla’s Business Client. Business Clients are responsible for: (a) providing individuals whose voices will be recorded with written notice that Biometric Data is being collected or stored; (b) informing such individuals of the specific purpose and length of term for which Biometric Data will be collected, stored, and used; and (c) obtaining a written release from such individuals authorizing the collection, storage, and use of their Biometric Data.
To assist Business Clients in meeting their consent and notice obligations, Rilla may provide resources like configurable consent workflows within the Platform, documentation and guidance materials, and contractual commitments in Rilla’s Data Processing Addendum regarding Rilla’s obligations as a processor with respect to Biometric Data.
Rilla retains Biometric Data in accordance with its contractual obligations to its Business Clients and in compliance with applicable Biometric Privacy Laws. Unless a shorter retention period is specified by the Business Client, Rilla will, acting at the direction of its Business Clients, permanently destroy Biometric Data at the earlier of: (a) the date on which the initial purpose for collecting or obtaining such Biometric Data has been satisfied; (b) three (3) years following the individual’s last interaction with the Business Client through the Platform; or (c) within thirty (30) days of receiving a verified deletion request from the Business Client. Notwithstanding the foregoing or any longer period a Business Client may direct, Rilla will destroy Biometric Data subject to Texas CUBI within a reasonable time, and in no event later than the first anniversary of the date on which the purpose for collecting such Biometric Data expires.
Rilla will not sell, lease, trade, or otherwise profit from any individual’s Biometric Data. This prohibition applies regardless of whether Rilla receives consideration in exchange for such data. Rilla will not disclose, redisclose, or otherwise disseminate Biometric Data to any third party except as expressly set forth in this Policy.
Rilla may disclose Biometric Data to its subprocessors (including cloud hosting providers, transcription service providers, and AI/ML infrastructure providers) as necessary to provide the Services on behalf of its Business Clients. All subprocessors are subject to written agreements that impose data protection obligations materially equivalent to those set forth in this Policy, including limitations on use, retention, and further disclosure of Biometric Data.
Rilla may also return or make available Biometric Data to the Business Client that directed its collection through the Platform, as required by a valid warrant, subpoena, or court order issued by a court of competent jurisdiction, or as otherwise required by applicable law, or otherwise where the individual whose data is at issue (or the Business Client on whose behalf the data is processed) has provided explicit consent to such disclosure.
Rilla does not use Biometric Data to train general-purpose AI or machine learning models that are made available to other customers or third parties.
Rilla implements and maintains commercially reasonable administrative, technical, and physical safeguards to protect Biometric Data from unauthorized access, disclosure, alteration, or destruction.
Because Rilla acts as a processor of Biometric Data on behalf of its Business Clients, individuals seeking to exercise rights with respect to their Biometric Data should direct their requests to the Business Client (the data controller) that deployed the Platform in the context in which their data was collected.
Upon receiving a verified data subject request from a Business Client (or, where required by applicable law, directly from an individual), Rilla will use commercially reasonable efforts to assist in fulfilling such request in a timely manner.
If you are a resident of Illinois or your Biometric Data was collected while you were in Illinois, you have rights under the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.), including the right to receive written notice prior to collection, the right to provide or withhold written consent, and the right to have your Biometric Data permanently destroyed in accordance with the retention schedule set forth in Section 6.
If you are a resident of Texas, the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001 et seq.) provides protections regarding the capture and use of your Biometric Identifiers, including the requirement that Biometric Data be destroyed within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the data expires.
If you are a resident of Washington, the Washington Biometric Privacy Act (RCW 19.375 et seq.) regulates the collection and use of biometric identifiers and provides that biometric data enrolled for a commercial purpose may not be used for a purpose that is inconsistent with the purpose disclosed at enrollment.
Biometric Data may also be subject to protections under comprehensive state privacy laws (including those of California, Colorado, Connecticut, Virginia, and other states) that classify biometric information as sensitive personal information requiring heightened protections. Rilla is committed to complying with all applicable Biometric Privacy Laws.
Rilla reserves the right to update or modify this Policy at any time to reflect changes in our practices, legal requirements, or the Services. Material changes will be posted at the URL where this Policy is published, and the “Last Updated” date above will be revised accordingly. Continued use of the Services after any such update constitutes acceptance of the updated Policy.
If you have questions about this Policy or Rilla’s biometric data practices, please contact:
RillaVoice, Inc.
Attn: Privacy Team
25 Kent Ave
8th Floor
Brooklyn, NY 11249
Email: legal@rilla.com
For questions about how a specific Business Client uses the Platform or has directed the collection of your Biometric Data, please contact that Business Client directly.
For purposes of this Policy:
“Biometric Data” means, collectively, Biometric Identifiers and Biometric Information as defined below.
“Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, as defined under applicable Biometric Privacy Laws. Biometric identifiers does not include a physical or digital photograph, video or audio recording or data generated therefrom.
“Biometric Information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s Biometric Identifier used to identify an individual. Biometric Information does not include information derived from items or procedures excluded from the definition of Biometric Identifier.