EN
Elio Biometric Data Retention and Destruction Policy
Effective date: September 23, 2026 · Version: 1.9 · Entity: The Elio Company LLC (“Elio,” “we”)
Why we have this policy
Elio creates personalized calming audio for your dog by blending AI-generated instrumental music with a sound layer derived from your voice. We collect a short voice recording and create a voice-identity profile from it — a set of numerical measurements of your voice (pitch, pitch variability, and loudness contour). We treat this profile as a biometric identifier under applicable law and, in the EU, the EEA and the UK, as a special category of personal data. This policy sets out what we keep, for how long, and how it is destroyed.
If you sign in with a passkey, your device verifies your fingerprint or face locally. Elio does not receive biometric data for sign-in, only a passkey public key; passkeys are outside this policy.
Consent
We obtain express, written consent before recording a voice or creating a voice-identity profile. If you are in the EU, the EEA or the UK, that consent is explicit consent to a special category of personal data, and it is requested at its own step, separately from the Terms of Service and from the rest of the signup flow.
Consent covers only the purpose described in this policy — generating your dog's personalized audio — and the disclosure of the recording and the voice-identity profile to the service providers described below, solely to provide that service on our behalf. A new purpose would require new consent.
You may withdraw your consent at any time: remove the voice in the Voices section of your Lounge, or email privacy@elio.pet. We delete the profile and stop using your voice in new tracks. New tracks pause while your household has no voice.
We keep a record of consent until 5 years after the last of the voice data it covers is destroyed, or longer while a legal claim concerning it is pending, so that consent can be evidenced, including for a recording that never leads to an account.
What we collect and store
| Data | What it is | Where it lives | Retained for | Legal basis (EU/UK) |
|---|---|---|---|---|
| Raw voice recording | Your read of a six-line script — typically 15–60 seconds, capped at five minutes per take (uncompressed audio) — uploaded during the recording session | Encrypted storage on our cloud infrastructure, and our audio-processing servers while it is processed | Deleted within 24 hours of recording — whether or not processing completes; deletion is logged | Your explicit consent — Art. 9(2)(a) — and our contract with you |
| Voice-identity profile | Numerical measurements derived from your recording (a biometric identifier), used to generate your dog's daily audio | Our database, encrypted object storage, and a working copy on our audio-processing servers | For the life of the household's subscription — destroyed within five days after that subscription ends (by cancellation or lapse), when that voice is removed, or when the account is deleted, whichever comes first. If a recording made during signup never leads to a trial or subscription, the profile and the recording are automatically deleted within 24 hours, and the deletion is logged | Your explicit consent — Art. 9(2)(a) — and our contract with you |
| Generated audio tracks | Daily tracks blending the voice-derived layer with instrumental music | Encrypted object storage | Until 72 hours after publication to your feed, then deleted; a track that is never published is deleted within 48 hours of its scheduled publication | Our contract with you |
Purpose
The sole purpose of collection is to generate the personalized calming audio you request. We do not use voice data to identify you, authenticate you, or profile you. We do not sell, lease, trade, or otherwise profit from biometric data, and we do not disclose it to any third party for that party's own use, except where legally required.
Destruction schedule and method
Absent a valid warrant or subpoena issued by a court of competent jurisdiction, biometric data is destroyed at the earliest of: (a) the schedule above; (b) your deletion request (account deletion or per-voice removal); or (c) twenty-four months after your last interaction with Elio. Destruction means permanent deletion of the database record, the stored profile objects and any working copy on our audio-processing servers, with the deletion event logged. In multi-voice households, removing one voice deletes that profile and stops that layer appearing in new tracks; other voices are unaffected.
In addition to that schedule, we review at least once a year whether any voice data we still hold has stopped serving the purpose it was collected for. Where we determine that it has, that data is destroyed within 45 days of the determination.
Service providers
Voice data is processed only on contracted cloud infrastructure acting on our behalf — cloud object storage and network services, audio-processing compute, and database hosting. Each is contractually prohibited from using the data for its own purposes. No speech-to-text vendor, advertising network or analytics provider receives voice data; the follow-along highlight during recording runs on our own servers. Your recording is stored in encrypted object storage and processed on a server in Europe; our database and remaining infrastructure are in the United States. Transfers to the United States are covered by the European Commission's standard contractual clauses — with the UK Addendum, if you are in the UK — or by a provider's certification under the EU–US Data Privacy Framework and its UK extension; for Switzerland, by the FDPIC-recognised version of those clauses or by a provider's Swiss–US Data Privacy Framework certification. A copy is available on request at privacy@elio.pet.
Safeguards
Voice data is encrypted in transit, and at rest in object storage and our database; access is restricted; raw-recording deletion is automated and logged. We use a reasonable standard of care at least as protective as the standard for other confidential and sensitive information we hold.
If there is a security incident
We respond to a security incident involving voice data under a written internal protocol and, where the law requires it, notify the people affected and the relevant regulators within the periods the law sets.
Your choices
You can remove a voice in the Voices section of your Lounge, or delete your account in its Privacy section, at any time; either triggers the destruction described above. Questions or requests: privacy@elio.pet. If you are in the EU, the EEA, Switzerland or the UK, the European section of the Privacy Policy applies in addition to this policy.