Compliance · fact sheet

How we handle people’s words.

People tell us how they really work. They only do it if they know where their words end up. It is all here, from the first screen to deletion.

Rules: GDPR · EU AI Act · Italian Workers’ Statute
Roles: Controller your company · Processor Sharazad
Updated: 30 October 2026

project.yml

roles:
  controller: your company
  processor: sharazad   # GDPR art. 28
data:
  owner: your company
  where: european union   # rare exceptions
  encryption: [in transit, at rest]
  reuse: aggregate only  # never training
  retention: standard per category
  at_the_end: deleted | anonymised
results:
  detail: aggregate | individual  # decided up front
  group_threshold: 10
  declared_to_speaker: yes
ai:
  discloses_itself: yes
  recognises_emotions: no
  decides_about_people: no
  high_risk: flagged up front  # annex III
  human_checkpoints: 3

§1

Anatomy of an answer.

One sentence said in an interview, from the microphone to the report. Move through the steps or use the arrow keys.

Example · made-up data

“I’m Giulia Ferri, I work at the Padua warehouse. When Marco is on holiday I handle the urgent orders, but it isn’t written down anywhere.”

At 3 sites out of 5, one person covers urgent orders when the manager is away. No procedure mentions it.

Giulia Ferri · Padua warehouse. Covers urgent orders when the manager is away. Unwritten skill.

14 people · 5 sites · no names

Declared to the speaker up front · high risk under the AI Act if it goes to the company

01: voice → text · encrypted in transit · stored in the EU, encrypted
02: pseudonym agent · 3 identifiers replaced before analysis
03: two-pass coding · a person checks before moving on
04: report at the level of detail agreed before starting

§2

The perimeter.

Where interviews travel, where they stay and where a person checks. All in the European Union, encrypted at every step. Outside the EU only in exceptional cases of technical support, with GDPR safeguards.

encrypted
checked by a person
European Union border

§3

Requirements.

What the law asks and how we meet it. Filter by regulation.

Speakers know they are talking to an AI.: Before starting they see a screen that tells them. In voice interviews the synthetic voice is declared and marked as such.AI Act art. 50
A privacy notice for every project.: Before the first question the speaker reads who processes the data, why, who sees what, for how long and what rights they have. We build it from texts approved by our legal adviser. A person at your company approves it, with name, date and version. Without your contact person’s details the interviews do not start. If you already have your own notice, we check it and tell you what to fix.GDPR
Legal basis.: With employees it is your company’s legitimate interest. The boxes before the interview stay, as an acknowledgement. With external people, such as clients and suppliers, consent is needed. Taking part is free and people who do not take part face no consequences.GDPR art. 6
Level of detail declared up front.: Aggregate or individual is decided with the client and declared to the speaker before starting. In aggregate results a group of fewer than 10 people is normally not shown on its own.GDPR
When the system is high risk.: What matters is how the individual output is used. If the company uses it to assess the person, the system is high risk (Annex III, point 4). We flag it before starting and state it in the privacy notice. The obligations for these systems apply from 2 December 2027.AI Act

Only aggregate results to managementOutside Annex III

Individual output only to the intervieweeProbably outside

Individual output to the manager or HRHigh risk
No emotion recognition.: The system works on what people say. The audio is only used for transcription, not to infer emotions or moods.AI Act
No automated decisions about people.: The AI runs the interview. A person checks the results before they are used. Interpretation and decisions stay with people.AI ActGDPR art. 22
No sensitive data.: The questions are about work or the topic of the interview. We do not ask about health, political or religious views, union membership or private life.GDPR
Roles in writing.: We sign the data processing agreement required by Article 28. Your company is the controller, Sharazad is the processor. If you work with a partner consultant, they are normally the processor and Sharazad the sub-processor.GDPR art. 28
Data used for your project.: The interviews serve the purpose stated in the privacy notice. Sharazad also uses the content in aggregate form to improve the service and for statistics. Never to train AI models. Speakers can object.GDPR
Data in Europe, encrypted.: Encrypted in transit and at rest, stored and processed on infrastructure in the European Union. Outside the EU only in exceptional cases of technical support or content moderation, with the safeguards of GDPR Chapter V.GDPR
Named suppliers.: Voice goes through ElevenLabs Enterprise, with EU data residency. Reports are generated with Anthropic’s Claude or Google’s Gemini through Google Cloud, with processing in the EU. They are sub-processors and the privacy notice names them.GDPR
Retention periods.: One standard per category. If you need different periods we set them before starting. When they expire the data is deleted or anonymised. On request the audio is deleted right after transcription.GDPR

Interview audio90 days

Named transcript6 months from the end of the project

Analysis and derived profiles6 months, up to 12 at your request

Results about an individual12 months from delivery

Aggregate results24 months

System logs24 months from the end of the project
Employee interviews.: Under the prevailing view an interview is not a surveillance tool, so the Article 4 agreement is not needed. When the system is high risk, from 2 December 2027 the company informs workers and their representatives before use.Statute art. 4AI Act art. 26

§4

The folder for your DPO.

We hand it over before we start, ready to pass to your DPO or legal team.

GDPRData processing agreementArticle 28. Roles, instructions, security measures.
SystemInstructions for useHow Quisquilia works, how to use it and under which conditions it stays outside high risk.
PeopleProject privacy noticeFor speakers, before the first question. Texts approved by our legal adviser, approval yours.
CheckReview of your privacy noticeIf you use your own text, we tell you what does not fit and why.
DPIAImpact assessment supportNormally needed when the system is high risk.

Does your DPO have more questions?Send them over, we answer in writing

Want to read the questions we hear most first? Go to the FAQ