Biometric Data Retention and Destruction Policy

Effective 26 September 2026. Version 1.

Who we are

Carillio (“Carillio”, “we”), operated by Ravinaro. Contact: privacy@ravinaro.com.

What biometric data we collect

If you choose to use “Your voice” in Carillio, we create a voice model (sometimes called a voiceprint) from about 30 seconds of your own speech captured during a Carillio call. We only do this after you tap “I agree — use my voice” on a screen that explains this policy. We do not collect fingerprints, face scans, or any other biometric data.

Why we collect it

For one purpose only: so that the specific person you allowed hears your translated speech in a voice that sounds like yours, during calls between the two of you. We do not use your voice model to identify or verify you, to recognize you in other calls, for advertising, or to train AI models.

Who we share it with

Only the service provider that creates and runs the voice model on our behalf: Cartesia, Inc. (USA). Inworld AI, Inc. (USA), which provides some of our standard voices, is not currently used for voice copies. Our providers act on our written instructions under data processing agreements, may not use your voice for their own purposes (including training their models), and must delete it when we tell them to.

We do not sell, lease, trade, or otherwise profit from your biometric data. Using “Your voice” is free for you, and it costs the other person exactly the same as a standard voice. We will not disclose it to anyone else unless you consent or we are required to by law, subpoena, or warrant. The other person never receives your voice model — only the translated speech it produces during your calls.

How long we keep it

We keep your voice model and the recording used to make it only as long as needed for the purpose above. We permanently destroy them at the earliest of:

1. when you turn off “Your voice” for that person (Settings → Privacy → Voice & translation);
2. 12 months after the voice model was last used in a call;
3. when you delete your Carillio account; or
4. in any event, no later than 3 years after your last interaction with Carillio.

The short audio sample used to create the model is never stored on our servers. It is held in memory during the call only until it is sent to our provider to create the model, then discarded, whether or not the model was created. Our provider keeps it with the voice model until we tell it to delete them.

How we destroy it

We delete the voice model from our systems and instruct our provider to delete its copy, including the sample, as soon as one of the events above happens. We keep the provider's response as a record that deletion happened, but not the biometric data itself.

We also keep a record of your consent — who agreed, for which person, in which call, when, and which version of the consent text in which language — so we can show you agreed. That record contains no voice data, and we keep it after you turn “Your voice” off or delete your account, because it is our proof of your consent.

How we protect it

Encrypted in transit and at rest, access limited to the staff and systems that need it, never written to logs, and protected at least as carefully as the other confidential information we hold. The identifier of your voice model at our provider is kept on our servers only and is never sent to any app.

Your choices

Using “Your voice” is optional and free. If you don't allow it, the other person hears a standard voice instead, and your calls are otherwise unchanged. You can withdraw consent at any time in Settings → Privacy → Voice & translation, or by emailing privacy@ravinaro.com. Residents of certain places (for example the EU, UK, California, Washington, Colorado and Texas) have additional rights described in our Privacy Policy. Washington residents: see also our Consumer Health Data Privacy Policy.

Changes

If we change this policy in a way that affects how your voice is used — including a change of provider — we will ask for your consent again before continuing.