FIORIRE STANDALONE BIOMETRIC DATA POLICY AND NOTICE

1. PURPOSE AND DEFINITIONS

The Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14, defines a biometric identifier to include a voiceprint and defines biometric information as information based on a biometric identifier used to identify an individual. A raw voice recording is not described here as a voiceprint merely because it contains a voice. For this Notice, "possible covered representation" means only a mathematical or technical representation of vocal characteristics that a court or regulator could later determine is a voiceprint or biometric information.

2. CURRENT CONFIGURATION AND WRITTEN VENDOR CONFIRMATIONS

Fiorire's speech-to-text provider is used for pre-recorded speech-to-text with speaker_labels set to false and speaker diarization and speaker-embedding features disabled. That provider's Legal team confirmed in writing that, under that configuration and absent future biometric products, no speaker embedding, voiceprint, or comparable representation is created, including transiently, and its Biometric Data Addendum does not apply.

Fiorire's editing provider is used for ordinary transcription and editing. During single-file speaker separation, that provider may compute a temporary, anonymous, file-specific, in-memory representation solely to group segments within that recording. That provider confirmed in writing that the representation cannot identify an actual person, cannot be matched across recordings or projects, is not stored after processing, and is not placed in a speaker database or index. The speaker-labeled transcript is retained; the representation is not. Standard transcription, playback, editing, and export do not create this representation. Fiorire does not use its editing provider's AI speaker, voice cloning, voice generation, or synthetic-presenter features. Written confirmations from both providers are on file and are available to a contracting organization or its counsel under appropriate confidentiality.

Based on those facts, Fiorire's position is that the current workflow does not create, collect, capture, obtain, possess, store, or use a voiceprint, biometric identifier, or biometric information under BIPA. The providers' descriptions are factual evidence; the legal characterization remains Fiorire's position and is subject to future judicial or regulatory interpretation.

3. CONDITIONAL PURPOSE, DISCLOSURE, AND TERM

Without conceding coverage, if the temporary single-file representation is later determined to be a biometric identifier or biometric information, its sole purpose is to distinguish the participant from the interviewer within one Signature Session so Fiorire can transcribe, edit, remove the interviewer, redact content, and prepare the participant's materials. Only Fiorire and contracted editing or transcription providers acting for Fiorire may perform or receive that processing for the stated purpose, except for another disclosure permitted by BIPA or controlling law. It is not used to identify, authenticate, enroll, or match a person and does not create a persistent voice model.

4. RETENTION AND PERMANENT DESTRUCTION

Fiorire does not retain the temporary single-file representation. It is destroyed when the speaker-separation processing step ends. If Fiorire later lawfully collects another biometric identifier or biometric information under a separate notice and written release, Fiorire will permanently destroy it when the initial purpose is satisfied or within three (3) years after the individual's last interaction with Fiorire, whichever occurs first, unless a shorter period is required by law. Fiorire will follow its published schedule absent a valid warrant or subpoena issued by a court of competent jurisdiction or another controlling legal requirement that lawfully requires preservation.

5. NO PROFIT; DISCLOSURE RESTRICTIONS; SECURITY

Fiorire will not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Fiorire will not disclose or redisclose covered biometric data except with the individual's consent, to complete an authorized transaction, as required by law or ordinance, or under a valid warrant or subpoena. Fiorire will protect any covered biometric data using the reasonable standard of care in its industry and no less protectively than it protects other confidential and sensitive information.

6. RIGHTS, WITHDRAWAL, DELETION, AND CONTACT

A participant may request information about possible covered processing, withdraw prospective consent, or request deletion. Service and deletion requests may be sent to contact@fiorirearchive.com; privacy or biometric questions may be sent to privacy@fiorirearchive.com. A privacy request received at either address will be routed and treated as received when Fiorire receives it.

Fiorire may verify identity and authority. Withdrawal of the core processing permission may end the service relationship. Fiorire ordinarily implements a verified deletion request in active systems it controls within thirty (30) days, subject to legal or evidence-preservation duties, minimal consent and defense records, provider deletion windows, and restricted backup, cache, and disaster-recovery cycles. If a backup is restored, Fiorire will reapply a completed deletion request.

7. CHANGE CONTROL

Fiorire will not enable voice identification, voice authentication, speaker enrollment, persistent voice embeddings, cross-recording matching, voice cloning, synthetic voice, digital replicas, or another feature reasonably described as biometric without documented legal, privacy, security, vendor, and insurance review and any updated public notice, specific purpose-and-term disclosure, written release, contract, security control, and retention schedule required by law. If such a feature is enabled in error, Fiorire will disable it promptly upon discovery; determine whether any biometric identifier or biometric information was created; permanently destroy any covered biometric data in systems Fiorire controls; direct applicable providers to destroy covered biometric data; preserve material subject to a valid legal hold or other legal preservation duty; and document the incident, the destruction, and the corrective action. This paragraph does not require destruction of ordinary recordings, transcripts, consent records, or security logs that are not biometric identifiers or biometric information.

8. STATUS OF THIS NOTICE

This Notice may describe practices that exceed what applicable law requires. It is not a contract, does not create a private right of action or legal standard of care, and is not an admission that BIPA or another biometric law applies to Fiorire's current workflow. Rights and remedies, if any, arise only from a signed agreement or applicable law.

Questions or biometric-data requests: privacy@fiorirearchive.com