Privacy Policy
How IAMX collects, uses, and protects personal data across our digital human platform, plugin, and web embed.
Last updated: 9 October 2026
This policy also covers IAMX AI Avatar Assistant for Wix, including its embedded Wix dashboard and website assistant.
1. Who we are (data controller)
The data controller responsible for your personal data is:
- Legal entity: IAMX LIVE DIGITAL HUMAN BİLGİ TEKNOLOJİLERİ VE YÖNETİM DANIŞMANLIĞI A.Ş. ("IAMX", "we", "us", "our"), operating the IAMX platform.
- Registered address: Maslak Mah. Eski Büyükdere Cad. Giz 2000 Plaza No:7 İç Kapı No:34, Sarıyer / İstanbul, Türkiye
- Trade registry no: 1013909 (Istanbul Trade Registry)
- Data protection contact: Ercan Barış — service@iamx.live, or reach us through https://iamxlive.com/contact
Where you use IAMX as an operator to build and deploy your own characters that interact with your end users, you may act as the data controller for the conversation data generated by your end users, and IAMX acts as your data processor for that content. In those cases, this policy describes how we process data on your behalf and as controller for our own account, billing, and platform-operation purposes.
2. What data we collect
We collect the following categories of personal data, depending on how you use the Service.
| Category | Examples | Source |
|---|---|---|
| Account data | E-mail address, name, company/team name | Provided by you at sign-up |
| Authentication data | Login credentials, session tokens, password reset data | Provided by you / generated by the Service |
| Wix installation and subscription information | App installation and site identifiers, site name and URL, subscription package, installation status, and configuration timestamps | Wix and your use of the IAMX app |
| Personal voice information | A recording submitted to create a voice, its chosen name, voice identifier, creation and verification status, and your recording-permission confirmation | Provided by you or returned by the voice provider |
| Character configuration | Character settings, prompts, personas, and any knowledge files you upload | Provided by you in the web panel |
| Conversation content | Text messages and microphone audio processed to generate live responses, and the responses returned | Captured during your (or your end users') use of a character |
| Usage & interaction analytics | Feature usage, session activity, interaction counts, quotas | Collected automatically as you use the Service |
| Billing data | Plan, invoices, transaction records (full card numbers are handled by our payment processor and not stored by IAMX) | Provided by you / generated during checkout |
| Technical data | IP address, device and client/engine information, log data, timestamps, error reports | Collected automatically |
| Face data (enterprise only) | Facial features processed for identity-verification / face-recognition features | Processed only where an operator explicitly enables these features |
3. How and why we use it
We process personal data for the purposes below. For each purpose we identify the legal basis under the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law (KVKK).
| Purpose | Legal basis |
|---|---|
| Provide, operate, and maintain the Service (including creating and running characters) | Performance of a contract |
| Generate real-time conversational responses, voice, and animation from your input | Performance of a contract; consent where required for microphone access |
| Process payments, manage subscriptions, and issue invoices | Performance of a contract; legal obligation (accounting/tax) |
| Provide customer support and respond to your requests | Performance of a contract; legitimate interests |
| Ensure security, prevent fraud and abuse, and protect the Service | Legitimate interests; legal obligation |
| Improve, troubleshoot, and develop the Service | Legitimate interests |
| Comply with legal and regulatory obligations | Legal obligation |
| Enable identity-verification / face-recognition features (enterprise) | Explicit consent (obtained by the operator); or another lawful basis established by the operator |
Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.
4. Microphone audio & conversation data
To power live, voice-based conversation, the Service processes the microphone audio and text you (or your end users) provide. In general terms:
- When you speak to a character, your microphone audio is streamed to our platform and processed to understand your input and generate a spoken, animated response in real time.
- Your text and audio input, together with relevant character configuration, may be sent to third-party AI model providers (see Section 5) to generate the language and voice of the response.
- Audio is captured only while a character session is active and you have granted microphone permission in your browser or client. You can revoke that permission at any time through your device or browser settings.
If you upload a recording to create a personal voice in the Wix app, IAMX sends that recording and the chosen voice name to ElevenLabs using IAMX's configured service account. You must confirm that you own the recording or have the speaker's permission. IAMX stores the voice's name, provider identifier, creator, creation time, permission confirmation, and verification status. The upload route processes the original recording in memory and does not save a separate original recording file to IAMX storage. The resulting voice remains in the configured ElevenLabs account until it is deleted there. When you delete an unused personal voice through the app, IAMX requests its deletion from ElevenLabs and removes its ownership record after the provider confirms deletion or that the voice is absent.
Retention of conversation data. Conversation content (text and, where applicable, audio) may be retained to operate the Service — for example to maintain conversation context, provide the account holder with history and analytics, enforce quotas, and for security and troubleshooting — for the period described in Section 7. Operators can configure retention behavior for their characters where the Service provides such controls. We do not sell conversation data.
5. Sharing & subprocessors
We do not sell your personal data. We share it only with the categories of recipients below, and only as needed to operate the Service.
| Recipient category | Examples | Purpose |
|---|---|---|
| AI model providers | OpenAI, Anthropic, Google | Generate the language and voice of real-time conversational responses from your input |
| Speech and voice provider | ElevenLabs | Generate speech from response text and create personal voices from recordings you submit |
| Wix app platform and billing | Wix | Verify app installations and subscription entitlements, embed the website assistant, and handle purchases made through Wix |
| Cloud hosting / infrastructure providers | Cloud hosting and infrastructure providers | Host, run, store, and secure the platform |
| Payment processor | iyzico | Process payments and manage subscriptions (handles card details; IAMX does not store full card numbers) |
We may also disclose personal data (i) to comply with a legal obligation, court order, or lawful government request; (ii) to protect the rights, safety, and security of IAMX, our users, or the public; or (iii) in connection with a corporate transaction such as a merger, acquisition, or asset transfer, subject to appropriate confidentiality protections.
6. International transfers
IAMX operates a cloud service, and some of our providers (including the AI model providers and infrastructure providers listed above) are located in countries outside your own, such as within the European Union and the United States. As a result, your personal data may be transferred to and processed in those countries.
Where personal data is transferred internationally, we take steps to ensure an appropriate level of protection, for example through the use of recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses and equivalent safeguards required under KVKK, together with additional technical and organizational measures where appropriate.
7. Data retention
We retain personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymize it. Retention periods depend on the type of data:
- Account and authentication data — for as long as your account is active, and for a reasonable period afterwards.
- Character configuration and uploaded knowledge files — for as long as they remain in your account, until you delete them.
- Conversation content (text and audio) — retained for the period needed to operate the Service and any period configured by the operator, then deleted or anonymized.
- Billing records — retained for the period required by applicable accounting and tax law.
- Technical logs — retained for a limited period for security, debugging, and abuse prevention.
Removing IAMX AI Avatar Assistant from a Wix site disables that installation's website assistant and revokes its app sessions. Removal does not automatically erase the IAMX workspace or its stored characters, uploaded files, conversation records, or personal voices held by ElevenLabs. To request deletion, contact service@iamx.live and identify the Wix site or app installation concerned.
We may retain certain data for longer where required to comply with legal obligations, resolve disputes, or enforce our agreements. Contact service@iamx.live for information about retained data and to request deletion. A fixed automatic deletion period after Wix app removal is not currently implemented.
8. Security
We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include, in general terms:
- Encryption of data in transit;
- Access controls and authentication for administrative access to systems;
- Segregation of duties and least-privilege principles for staff access;
- Logging and monitoring for security events;
- Use of reputable cloud infrastructure providers.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not make any certification claims in this policy; where we adopt formal certifications in the future, we will update this section accordingly.
9. Your rights
Subject to applicable law (GDPR for users in the EU and KVKK for users in Turkey), you have the following rights over your personal data:
- Access — obtain confirmation of, and a copy of, the personal data we hold about you;
- Rectification — correct inaccurate or incomplete data;
- Erasure — request deletion of your data where applicable;
- Restriction — request that we limit processing in certain circumstances;
- Objection — object to processing based on legitimate interests;
- Portability — receive certain data in a structured, machine-readable format;
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us via https://iamxlive.com/contact or at service@iamx.live. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority — in Turkey, the Personal Data Protection Authority (KVKK / KVKK Kurumu); in the EU, your national supervisory authority.
If your data was provided to a character operated by another party (an operator using IAMX), you may need to direct certain requests to that operator; we will assist as required.
10. Children
The Service is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us via https://iamxlive.com/contact and we will take appropriate steps to delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or legal requirements. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by e-mail. We encourage you to review this page periodically.
12. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data:
- Contact form: https://iamxlive.com/contact
- Data protection contact: Ercan Barış — service@iamx.live
- Legal entity: IAMX LIVE DIGITAL HUMAN BİLGİ TEKNOLOJİLERİ VE YÖNETİM DANIŞMANLIĞI A.Ş., Maslak Mah. Eski Büyükdere Cad. Giz 2000 Plaza No:7 İç Kapı No:34, Sarıyer / İstanbul, Türkiye
Related documents: Terms of Service · KVKK Notice · Cookie Policy · Documentation · Community Forum.
Governing law: This policy is governed by the laws of Turkey, including KVKK, and the GDPR applies to users in the European Union.