This notice explains what data VIVA Studio processes and how it is protected. VIVA Studio is a non-commercial academic research platform: we collect as little as possible, and study data is end-to-end encrypted.
The controller for this website (viva-studio.app) is VIVA Studio. Contact:
viva.studio.app@gmail.com. Full
details are in the Imprint.
The public pages are static. We do not use third-party analytics, advertising, or tracking cookies. A strictly necessary session cookie is set only after you log in to a researcher account, to keep you signed in. Web fonts are loaded from Google Fonts; standard server logs may record IP addresses for security and are not used to profile visitors.
To use the platform, researchers provide a name and email address and set a password (stored only as a secure hash). On first login an RSA key pair is generated for the account; the private key is protected by your password and by a one-time recovery key shown to you once. Any AI-provider API keys you enter are stored encrypted at rest.
When a participant takes part in a study, the following may be processed:
End-to-end encryption: transcripts, submissions and recordings are encrypted in the participant's browser using the researcher's public key before they are uploaded. The server (and anyone who could access it, including the host) stores only ciphertext. The data can be decrypted only in the researcher's own browser after they unlock their private key.
During the live conversation, audio and text are sent to the AI provider the researcher selected (e.g. OpenAI, Google, Anthropic, ElevenLabs) to perform speech recognition, generate replies, and synthesize the voice. That processing is governed by the provider's own terms and privacy policy. Study data is not sold and is not shared with any other third party.
Data is processed for the purpose of scientific research. Each study is run by a researcher who is responsible for its lawful basis (typically the participant's consent and/or a public-interest research task) and for any applicable ethics approval.
Study data is kept only as long as needed for the research and is controlled by the researcher, who can delete individual recordings, an entire study, or their whole account. Deletion removes the database records and the associated files. Participants who wish to withdraw their data can contact the researcher or the address below.
Subject to applicable data-protection law (including the GDPR), you may request access to, correction of, or deletion of your personal data, and may lodge a complaint with a supervisory authority. To exercise these rights, use the contact below.