Privacy and security

Last updated 5 October 2026

Everything a buyer, data protection officer or union representative needs to assess SimLab, collected on one page. We have tried to be as clear about what we do not do as about what we do.

How we handle data

Eight claims we can evidence in the code or in the contracts.

We never store audio

Only the text transcript of the conversation is stored. The audio columns were removed from the database — there are no audio files to request access to. The audio is streamed to the speech vendor while the participant speaks; see the subprocessor list.

We never analyse the voice

Inferring emotion from voice is biometric processing and prohibited in the workplace under Article 5 of the EU AI Act. Tone is derived from text, and the feature requires the individual's active consent.

Training data is stored in the EEA

Transcripts, feedback and training history sit on one server in Germany. Speech and the language model are processed in the EU in the setup pilot accounts use. But not everything is processed in the EEA: sign-in is processed in the US. See the tables below.

Managers never see the conversations

No endpoint exists that lets an administrator of the organisation read someone else's transcript. Individual results are hidden by default, and in pilot mode they cannot be enabled. SimLab's own staff with system access can read conversation text to operate and improve the service. The feedback is formative reflection support for the person practising — not a staff appraisal, a certification test, or a diagnostic tool.

No names are sent to the AI providers

The language model and the speech vendor receive the conversation, not who held it. Names, emails and user IDs are not included. The video avatar is an exception on one point: the vendor sees the participant's IP address, because the browser connects directly to it.

Uploaded documents are never stored

If you upload an incident report to build a scenario, it is read in memory, automatically scrubbed of email addresses, national identity numbers and phone numbers before the text is sent to a language model, and discarded.

Self-service access and deletion

Any individual can download a complete copy of everything we hold, or delete their account permanently — without asking anyone.

Retention

Data is kept for as long as the account is active and deleted when the account is deleted. Backups are kept on the same server and deleted after about two weeks. We do not yet offer a configurable automatic retention limit; it is on the roadmap, and we will say so when it lands.

Subprocessors

These process data on our behalf. The table is the same as in the privacy policy. The setup pilot accounts use (EEA mode) comes first; the vendors at the bottom are used only in other setups.

The setup pilot accounts use (EEA mode)

Hetzner Online GmbH

What it does: Runs the server that holds the application, the database and the backups.
What it receives: Everything SimLab stores: account, transcripts, feedback and technical session data.
Where it is processed: Germany (Falkenstein)
Transfer basis: Inside the EEA. No transfer.

Clerk, Inc.

What it does: Sign-in.
What it receives: Pilot account: user ID and password, and IP address and browser type when you sign in. Ordinary account: also name and e-mail address.
Where it is processed: USA
Transfer basis: EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCC).

Google Cloud

What it does: The character's voice (Gemini Live), speech recognition (Chirp 3) and the language model Claude, which runs on Vertex AI. The language model writes the character's lines, the help tips during the session, the feedback report and the character's own account of the conversation.
What it receives: The audio of what you say, while you speak, the conversation as text and the scenario description. No user ID, name or e-mail address.
Where it is processed: EU (Google's “eu” multi-region; the country is not stated)
Transfer basis: Sent to Google's EU endpoint.

Anam.ai Ltd

What it does: Video avatar: renders the picture of the character speaking. When it is unavailable, a 3D figure is drawn in your own browser with no vendor involved.
What it receives: The character's audio (not your voice), a random session label and your IP address, because your browser connects directly to the vendor. We request that the session is not recorded, and delete it at the vendor when the conversation is over.
Where it is processed: The closest region: the EU for every session we have recorded. May be the US under high load. The company is in the United Kingdom.
Transfer basis: United Kingdom: the European Commission's adequacy decision. US: the transfer terms in the vendor's data processing agreement.

Used only in other setups, not for pilot accounts

OpenAI

What it does: Voice engine (voice and speech recognition) in setups without EEA mode. Also drafts scenarios and demo conversations for administrators.
What it receives: The audio of what you say, the conversation as text and the scenario description. From administrators: the text of an uploaded document after automatic scrubbing.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Simli AS

What it does: Video avatar for organisations that use this vendor.
What it receives: The character's audio (not your voice) and your IP address. The vendor's terms allow it to use the content to train its own models.
Where it is processed: Norwegian company. The audio is sent to an endpoint in the EEA (the Netherlands). The vendor states that the picture may be rendered on servers in Finland and in the US.
Transfer basis: EEA. For the US: the Standard Contractual Clauses in the vendor's data processing agreement.

Stripe

What it does: Payment and subscriptions, only when billing is set up.
What it receives: The payer's e-mail address, and customer and subscription IDs. You give card details directly to the payment provider.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Resend

What it does: Sends e-mail (invitations, reminders, notifications), only when e-mail is set up. Pilot accounts are never sent e-mail.
What it receives: The recipient's e-mail address and the content of the e-mail.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Cartesia

What it does: Norwegian character voice in a voice engine only system administrators can choose.
What it receives: The character's lines as text. Not your voice, and no user ID.
Where it is processed: USA
Transfer basis: The EU Standard Contractual Clauses (SCC).

Vendor	What it does	What it receives	Where it is processed	Transfer basis
The setup pilot accounts use (EEA mode)
Hetzner Online GmbH	Runs the server that holds the application, the database and the backups.	Everything SimLab stores: account, transcripts, feedback and technical session data.	Germany (Falkenstein)	Inside the EEA. No transfer.
Clerk, Inc.	Sign-in.	Pilot account: user ID and password, and IP address and browser type when you sign in. Ordinary account: also name and e-mail address.	USA	EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCC).
Google Cloud	The character's voice (Gemini Live), speech recognition (Chirp 3) and the language model Claude, which runs on Vertex AI. The language model writes the character's lines, the help tips during the session, the feedback report and the character's own account of the conversation.	The audio of what you say, while you speak, the conversation as text and the scenario description. No user ID, name or e-mail address.	EU (Google's “eu” multi-region; the country is not stated)	Sent to Google's EU endpoint.
Anam.ai Ltd	Video avatar: renders the picture of the character speaking. When it is unavailable, a 3D figure is drawn in your own browser with no vendor involved.	The character's audio (not your voice), a random session label and your IP address, because your browser connects directly to the vendor. We request that the session is not recorded, and delete it at the vendor when the conversation is over.	The closest region: the EU for every session we have recorded. May be the US under high load. The company is in the United Kingdom.	United Kingdom: the European Commission's adequacy decision. US: the transfer terms in the vendor's data processing agreement.
Used only in other setups, not for pilot accounts
OpenAI	Voice engine (voice and speech recognition) in setups without EEA mode. Also drafts scenarios and demo conversations for administrators.	The audio of what you say, the conversation as text and the scenario description. From administrators: the text of an uploaded document after automatic scrubbing.	USA	The EU Standard Contractual Clauses (SCC).
Simli AS	Video avatar for organisations that use this vendor.	The character's audio (not your voice) and your IP address. The vendor's terms allow it to use the content to train its own models.	Norwegian company. The audio is sent to an endpoint in the EEA (the Netherlands). The vendor states that the picture may be rendered on servers in Finland and in the US.	EEA. For the US: the Standard Contractual Clauses in the vendor's data processing agreement.
Stripe	Payment and subscriptions, only when billing is set up.	The payer's e-mail address, and customer and subscription IDs. You give card details directly to the payment provider.	USA	The EU Standard Contractual Clauses (SCC).
Resend	Sends e-mail (invitations, reminders, notifications), only when e-mail is set up. Pilot accounts are never sent e-mail.	The recipient's e-mail address and the content of the e-mail.	USA	The EU Standard Contractual Clauses (SCC).
Cartesia	Norwegian character voice in a voice engine only system administrators can choose.	The character's lines as text. Not your voice, and no user ID.	USA	The EU Standard Contractual Clauses (SCC).

Changes are announced to organisation customers before a new subprocessor is engaged, in line with the data processing agreement.

Where the data is processed

Not everything is processed in the EU/EEA. The table shows each place and what makes the processing there lawful.

Germany (EEA)

Who: Hetzner
What is processed there: All storage: database, application and backups.
Legal basis for the place: Inside the EEA. No transfer.

Elsewhere in the EU (EEA)

Who: Google, Anam
What is processed there: Speech while you speak and conversation text for the language model (EU multi-region), and the video avatar (the vendor states Spain).
Legal basis for the place: Inside the EEA.

United Kingdom

Who: Anam
What is processed there: The avatar vendor is a UK company and manages the sessions from there.
Legal basis for the place: The European Commission's adequacy decision for the United Kingdom.

USA

Who: Clerk, Anam, OpenAI, Cartesia, Simli, Stripe, Resend
What is processed there: Sign-in, always. The video avatar under high load. In other setups also the voice engine, payment and e-mail.
Legal basis for the place: The EU–US Data Privacy Framework for vendors certified under it, and the EU Standard Contractual Clauses (SCC). See each vendor in the table above.

Place	Who	What is processed there	Legal basis for the place
Germany (EEA)	Hetzner	All storage: database, application and backups.	Inside the EEA. No transfer.
Elsewhere in the EU (EEA)	Google, Anam	Speech while you speak and conversation text for the language model (EU multi-region), and the video avatar (the vendor states Spain).	Inside the EEA.
United Kingdom	Anam	The avatar vendor is a UK company and manages the sessions from there.	The European Commission's adequacy decision for the United Kingdom.
USA	Clerk, Anam, OpenAI, Cartesia, Simli, Stripe, Resend	Sign-in, always. The video avatar under high load. In other setups also the voice engine, payment and e-mail.	The EU–US Data Privacy Framework for vendors certified under it, and the EU Standard Contractual Clauses (SCC). See each vendor in the table above.

Documentation

Accessibility

SimLab is developed towards WCAG 2.1 level AA. We are not finished: an accessibility statement is being prepared, and we will happily report the status of specific success criteria during a procurement process. Ask us, and we will answer honestly about what has been tested and what has not.

The company

SimLab ASBergen, Norge

Questions?

Privacy questions and subject access requests are normally answered within one month. support@simlab.as