Verbaico privacy policy

1. Summary

Verbaico turns speech into text and translations. We keep your data to provide the service and so that you can review your own sessions later. We do not sell your data, we do not share it for advertising, and nobody else may use it for their own purposes. We use no analytics or advertising trackers.

To run the service we rely on a few providers that process data only on our instructions, listed in section 6.

2. Who is responsible

The data controller is Aivanta AS, org. no. 938 472 424, Emil Stangs vei 36, 1346 Bærum, Norway, email support@aivanta.no. Verbaico is a product of Aivanta AS.

Questions about privacy, and requests about your data, go to support@aivanta.no.

3. What we collect

Account: your email address, and if you sign in with Google or Apple, the identifier that service gives us for your account. Your interface language and other preferences.

Sessions: the text of your transcriptions and translations, the languages, the title, the date and the length of each session. We keep the text so you can read, copy and export it from your history.

Audio: We do not record or store the audio, only to produce text while you speak. We only keep how many seconds were processed, for billing.

Purchases: what you bought, when, the amount and the minutes added. Payments are made with PayPal; we never see or store your card details.

Technical data: when you use the service our servers record technical information such as your IP address, the time and the request, to keep the service secure and to limit abuse (for example how many accounts are created from one network). In the iPhone app we also use Apple's DeviceCheck to make sure the free minutes are given only once per device; it stores no personal data about you with us.

4. Why we use it and the legal basis

To provide the service: sign you in, transcribe and translate, show your history and balance, and handle purchases. Legal basis: the contract with you (GDPR art. 6(1)(b)).

To keep accounting records of purchases, as Norwegian bookkeeping law requires. Legal basis: legal obligation (art. 6(1)(c)).

To keep the service secure and prevent abuse, such as collecting the free minutes many times. Legal basis: our legitimate interest in a secure, fair service (art. 6(1)(f)).

To answer you when you contact us. Legal basis: the contract, or our legitimate interest in helping you.

We do not use your data for advertising or profiling, and we do not use your sessions to train any model.

5. Sharing

We do not sell, rent or give away your personal data, and we do not share it with anyone for their own marketing or other purposes.

Your data is disclosed only to the providers in section 6, which process it on our behalf to run the service, and to public authorities when the law requires it.

6. Providers that process data for us

Hosting and database: the servers that run Verbaico and store your account, sessions and purchases. They are located in the European Union.

Email delivery: sends sign-in codes and service emails to your email address.

PayPal: processes your payments. PayPal is responsible for the payment data it handles under its own privacy policy.

Google and Apple: if you choose to sign in with them, they confirm your identity to us under their own privacy policies.

Where a provider processes data outside the EU/EEA, the transfer is protected by safeguards required by the GDPR, such as the EU Standard Contractual Clauses.

7. How long we keep it

Account and sessions: for as long as you have an account, so you can review your history.

Deleting a session from your history hides it from your account at once. Deleting your account signs you out on every device and closes the account. In both cases you can ask us to erase the text and your other personal data permanently by emailing us; we do so within one month.

Purchase and payment records: 5 years after the end of the financial year, as Norwegian bookkeeping law requires, even if you delete your account.

Sign-in codes expire after 10 minutes. Technical logs are kept only for a short period for security and troubleshooting.

8. Cookies and local storage

We use only what the service needs: a cookie that keeps you signed in (up to 30 days), and a short-lived cookie used during Google sign-in. Your browser's local storage keeps your preferences, such as language, theme and text size, on your device.

We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

9. Your rights

Under the GDPR you have the right to access your data, have it corrected, have it erased, restrict or object to its processing, and receive it in a portable format. You can export your sessions yourself from your history.

To use these rights, email support@aivanta.no. It is free, and we answer within one month.

10. Security

Connections to Verbaico are encrypted. Access to your account requires a sign-in code sent to your email or sign-in with Google or Apple. Only people at Aivanta AS who need it to run and support the service can access the data.

11. Children

Verbaico is not intended for children under 16. If you are under 18, you need a parent's or guardian's consent to buy minutes or subscriptions.

12. Changes

We may update this policy. The date at the top shows the latest version. If a change affects how we use your data, we will tell you by email or in the service before it takes effect.

13. Contact

Aivanta AS, org. no. 938 472 424, Emil Stangs vei 36, 1346 Bærum, Norway, email support@aivanta.no.