PRIVACY POLICY

Last updated: 7 October 2026

This Privacy Policy explains how FoodVision23 Ltd, a company incorporated in the Republic of Cyprus trading as RingBoost AI ("RingBoost AI", "we", "us", "our"), collects, uses, stores, shares and protects personal data. We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), Cyprus Law 125(I)/2018 implementing the GDPR, Directive 2002/58/EC ("ePrivacy Directive") and the related national law, Regulation (EU) 2024/1689 on artificial intelligence ("AI Act") and other applicable laws.

1. DATA CONTROLLER

FoodVision23 Ltd, trading as RingBoost AI

Registered office: Dimosthenous 10, Gianni-Maria Court, Suite 205-206, 6058 Larnaca, Cyprus

VAT number: CY60330035M

Email: gabriele@ringboost.ai

Website: www.ringboost.ai

We have not appointed a Data Protection Officer (DPO), because our activities do not fall within the cases where an appointment is mandatory under Article 37 GDPR. For any matter relating to personal data you can write to gabriele@ringboost.ai.

2. WHO THIS POLICY APPLIES TO

This Policy applies to:

1) visitors to the website www.ringboost.ai;

2) people who contact us or request a demo;

3) contacts at businesses we approach for commercial purposes;

4) contacts at our customers, partners and suppliers;

5) people who call our demo lines;

6) people who call our customers and speak with Emma, for the parts described in section 3.6.

3. WHAT DATA WE PROCESS

3.1 Website visitors

Technical and browsing data: IP address, browser and device type, operating system, pages visited, referring page, date and time of the visit. Data collected through cookies and similar technologies, as described in the Cookie Policy.

3.2 Contact and demo requests

First name, last name, email, phone number, company, role, industry, number of properties or locations, message content, requested demo date and time and any notes.

3.3 Contacts at businesses approached for commercial purposes

When we contact a business to present our services, we process the contact person's professional data: first name, last name, role, company, business email and phone, public professional profile and communication history. We collect this data directly from the person, for example at trade fairs and events, or from publicly available professional sources such as company websites and professional social networks, and from business data providers.

3.4 Customers, partners and suppliersContact details (name, role, email, phone), billing and payment data (card details are handled by the payment service provider and are not stored by us), contracts, invoices, communications, dashboard login data and service usage data (minutes, messages sent, features used, logins).

3.5 People who call our demo lines

When you call a RingBoost AI demo number, we process your phone number, the date, time and duration of the call, the recording and transcript of the conversation and the information you give during the call. Please do not share unnecessary real personal data during demo calls, in particular health data.

3.6 People who call our customers

When you call a business that uses RingBoost AI (for example a hotel or restaurant), Emma may process your phone number, the date, time and duration of the call, the audio recording (if enabled by the business), the transcript and summary of the conversation and the information you give, such as your name, contact details and booking or request details.

For this data, the controller is the business you called, while RingBoost AI acts as processor under Article 28 GDPR, on the basis of a Data ProcessingAgreement. The business is responsible for the legal basis of the processing and for informing callers. To exercise your rights over this data, please contact the business you called; we will assist it in responding.

RingBoost AI processes as an independent controller, solely for billing, usage reporting and dispute handling, the technical call data (date, time, durationand caller number).

4. PURPOSES AND LEGAL BASES

1) Responding to contact requests and arranging demos. Legal basis: pre contractual steps at the data subject's request (Article 6(1)(b) GDPR) or our legitimate interest in responding (Article 6(1)(f)).

2) Providing the service and managing activation, accounts, support, billing and payments. Legal basis: performance of a contract (Article 6(1)(b)).

3) Operating demo lines and showing how Emma works. Legal basis: legitimate interest in presenting our services (Article 6(1)(f)). Recording is announced at the start of the call.

4) Contacting business representatives to present our services (B2B commercial communications). Legal basis: legitimate interest in developing our business with companies (Article 6(1)(f)), in compliance with electronic communications rules. You can object at any time, as explained in section 11.

5) Sending newsletters and commercial updates to those who requested them. Legal basis: consent (Article 6(1)(a)), which can be withdrawn at any time.

6) Analysing website use and measuring campaigns. Legal basis: consent given through the cookie banner (Article 6(1)(a) and ePrivacy rules).

7) Ensuring the security of the website and the service, preventing fraud and abuse, managing technical quality and usage data. Legal basis: legitimate interest (Article 6(1)(f)).

8) Complying with legal, accounting and tax obligations and responding to requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).

9) Establishing, exercising or defending legal claims. Legal basis: legitimate interest (Article 6(1)(f)).

Where we rely on legitimate interest, we have assessed that it is not overriddenby your rights and freedoms. You can ask us for more information about that assessment.

5. CALLS, ARTIFICIAL INTELLIGENCE AND RECORDINGS

5.1 AI notice. In accordance with Article 50 of the AI Act, at the start of every call Emma states that you are speaking with an AI based virtual assistant. Emma never presents itself as a human being and, on request, the call can be transferred to the business's staff where the configuration allows.

5.2 Recording. If recording is enabled, you are told at the start of the call.

5.3 Retention. Recordings and transcripts are kept for thirty (30) days and then deleted automatically, unless a different period has been agreed in writing with the business acting as controller.

5.4 No biometric use. Emma does not perform emotion recognition, biometric identification or biometric categorisation, and your voice is not used to identify you.

5.5 No automated decisions. Emma does not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Emma collects information, answers questions and handles requests according to rules set by the business, which remains responsible for decisions.

5.6 No training. We do not use recordings, transcripts or other call data to train, fine tune or improve AI models, ours or third parties', and we require the same commitment from our technology providers.

5.7 Sensitive data. Emma is not designed to collect health data or other special categories of data. Please do not share them during the call unless strictly necessary for your request.

5.8 Emergencies. Emma is not an emergency service. In an emergency, call 112.

6. WHO WE SHARE DATA WITH

We do not sell personal data. We share it only to the extent necessary with the following categories of recipients, acting as our processors bound by agreements compliant with Article 28 GDPR, or as independent controllers where stated:

1) providers of the voice agent platform and of AI models for speech recognition, language processing and speech synthesis (infrastructure in the United States in the standard configuration; in the European Union where agreed for specific customers);

2) telephone carriers, number providers and SMS, WhatsApp and email messaging services (European Union and United States);

3) workflow automation providers (European Union);

4) hosting, database and customer dashboard providers (European Union, with the region of some components being confirmed);

5) website, analytics and online advertising providers, subject to consent where required (European Union and United States);

6) email, productivity, CRM and sales contact management providers (European Union and United States);

7) payment service providers, acting as independent controllers for payment data;

8) our customers' management and booking systems, when the customer enables the integration;

9) legal, accounting and tax advisers, bound by confidentiality;

10) public and judicial authorities, where required by law.The up to date list of sub-processors used for the service is available to customers on request at gabriele@ringboost.ai.

7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of our providers, in particular the voice platform and the AI models used in the standard configuration, process data in the United States. These transfers take place only with the safeguards required by Chapter V GDPR:

1) the European Commission adequacy decision on the EU US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), where the recipient is certified;

2) failing certification, the standard contractual clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), together with a transfer assessment and supplementary measures such as encryption of data in transit and at rest.

For customers who request it, a configuration with EU data residency is available where provided for in the contract. You can ask for information on the safeguards applied and a copy of the clauses by writing to gabriele@ringboost.ai.

8. HOW LONG WE KEEP DATA

1) Customer call recordings and transcripts: 30 days, unless otherwise agreed in writing with the customer.

2) Demo line call recordings and transcripts: 30 days.

3) Technical call data for billing and disputes: up to 12 months.

4) Contact and demo requests that do not lead to a contract: 12 months from the last contact.

5) Data of business contacts approached for commercial purposes: 12 months from the last interaction, unless you ask us to delete it earlier or object.

6) Customer and partner data: for the duration of the relationship and thereafter for the time needed to protect our rights.

7) Accounting and tax records: for the period required by Cyprus accounting and tax law.

8) Marketing consents: while consent is active and, after withdrawal, for the time needed to show that it was collected and respected.

9) Objections to commercial communications: for as long as needed to ensure we do not contact you again.

10) Cookies: according to the durations stated in the Cookie Policy.

At the end of the applicable period, data is securely deleted or anonymised.

9. SECURITY

We apply technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest, role based access control, authentication of internal systems, automatic deletion of data on expiry, logical separation of customer data, supplier assessment and contractual agreements with processors. In case of a personal data breach, we notify the supervisory authority within 72 hours where required by Article 33 GDPR, the data subjects where required by Article 34, and customers acting as controllers without undue delay.

10. YOUR RIGHTS

Under Articles 15 to 22 GDPR you have the right to:

1) access your data and receive a copy;2) request rectification;

3) request erasure;

4) request restriction of processing;

5) receive the data you provided to us in a structured, commonly used and machine readable format and transmit it to another controller (portability);

6) object to processing, as explained in section 11;

7) withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;

8) lodge a complaint with a supervisory authority, as explained in section 17.

To exercise your rights, write to gabriele@ringboost.ai. We reply within one month of receiving the request; this may be extended by two further months for complex requests, in which case we will inform you within the first month. We may ask for information to verify your identity.

11. RIGHT TO OBJECT

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest.

You can object at any time, without giving any reason, to the processing of your data for direct marketing, including commercial communications addressed to businesses. Simply reply to one of our emails or messages asking not to be contacted again, or write to gabriele@ringboost.ai. From then on you will no longer receive commercial communications from us.

12. COMMERCIAL COMMUNICATIONS

We send newsletters and commercial updates only to those who requested them or to business representatives, within the limits allowed by law. Every communication includes a simple way to stop receiving them.

13. WHETHER PROVIDING DATA IS REQUIRED

Providing the data needed to respond to requests and to supply the service is necessary: without it we cannot respond or enter into and perform the contract.

Providing data for marketing and consenting to non necessary cookies is optional.

14. CHILDREN

Our services are intended for businesses and professionals and are not directed at children. We do not knowingly collect children's data through the website. If you believe a child has provided us with personal data, write to gabriele@ringboost.ai and we will delete it.

15. COOKIES

For information on the use of cookies and similar technologies on the website, please see our Cookie Policy.

16. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in law, technology or our services.

The date of the last update is shown at the top of this document. In case of material changes we also inform customers by email.17. CONTACT AND COMPLAINTS

For any question: gabriele@ringboost.ai

FoodVision23 Ltd, trading as RingBoost AI

Dimosthenous 10, Gianni-Maria Court, Suite 205-206, 6058 Larnaca, Cyprus

If you believe the processing of your data infringes the GDPR, you can lodge a complaint with the Cyprus supervisory authority, the Office of the Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, Cyprus, www.dataprotection.gov.cy), or with the supervisory authority of the Member State where you live, work or where the alleged infringement took place.