Xicoia face-scans every Tilly Norwood caller worldwide before the first call connects

A caller's video selfie goes from the device to Didit in Spain, which returns an age estimate, and an unclear estimate triggers a request for a government photo ID ^[1]. The call that follows is recorded, transcribed and processed live by US providers, and Google's Gemini generates the character's replies through the conversational video platform Tavus ^[7]. Xicoia says the selfie travels straight to Didit, that no faceprint or biometric template is created, that neither the selfie nor any ID image survives the check, and that it keeps an approximate age band and a reference number instead ^[6]. Those are the company's statements about its own processing.

Xicoia runs all of this without asking the caller to agree. It gives legitimate interests, not consent, as the legal basis for both the age check and the in-call mood inference, and its own version history dates that decision to September ^[5]. The privacy policy says the mood analysis "cannot be switched off for an individual call" ^[4].

The automated safety layer misfires. A classifier reads each call transcript for abusive language and withholds the caller's recording when it flags one ^[8]. The BleepingComputer reporter who tested the service made three calls, and one of them, a conversation about the weather and news headlines, was withheld for "hateful or abusive language" that never occurred ^[9]. A human reviewer can release a wrongly flagged recording, and every recording is permanently deleted after 24 hours regardless ^[10]. The deletion clock gives that reviewer 24 hours to act ^[6].

The pricing runs backwards. After the free five minutes, 99p buys a one-time five-minute starter, £13 buys 15 minutes and £22 buys 30, capped at 35 purchased minutes per person ^[11]. That is 19.8p a minute for the starter against 86.7p for the 15-minute pack and 73.3p for the 30, so the bulk packs cost between 3.7 and 4.4 times the starter rate per minute ^[1][2]. Every minute expires on September 27 and unused minutes are forfeited ^[12].

The source describes no intrusion and no exploited flaw ^[7]. Xicoia added a mandatory worldwide biometric check to a consumer product mid-run, with about eight days of service life left when the reporter tested it ^[3]. Recordings last 24 hours and transcripts up to eight weeks, 56 times longer, and Xicoia staff and third-party partners may read them ^[5][13]. A transcript from a call on the final day can sit until roughly November 22 ^[4]. Xicoia's founder Eline van der Velden describes the character as an awareness project intended to show how far AI video has come ^[16].