# Privacy Policy

**Vasily Salmin**, sole proprietor — Montréal, Québec, Canada
Last updated: 2026-09-04

## The short version

**Your audio, your transcripts and your voiceprints are not stored** (voiceprints being the voice
embeddings speaker diarization computes). All of them exist only in memory, only for the duration of
the request that carries them, and are gone once the response completes. No model is trained on
them, and no human at Verbi reads them.

What is kept is the minimum needed to run an account and bill it accurately, and it is less
than you might expect:

- an opaque account identifier and a **hash** of your API key (never the key itself);
- **your email address only if you chose to give one** — an account without one carries no personal
  identifier here, though a payment ties it to the details Stripe holds;
- for each payment credited, the Stripe **event** id that credited it — not a customer or card
  reference, and not the number on your receipt. The link runs one way: the checkout created for you
  carries your account id to Stripe, and nothing about you comes back;
- per-request usage numbers: how much audio, how much detected speech, and when.

Your name, postal address, phone number and date of birth are never asked for and never held. If you
pay, Stripe's hosted checkout collects the contact and billing details **it** needs to take a card;
those stay on Stripe's systems and are never passed on, and an email you enter there does not
become your account's email.

## 1. What is collected

**You provide:**
- **Account data** — an opaque account ID plus the API key stored only as a hash, never in plain
  text. An email address and its verification state **only if you signed up with one**. An account
  with no verified address carries no personal identifier here. If that account has paid,
  the payment reference held by Stripe links it to the details you gave at checkout — that link
  lives on Stripe's side, and it is how a refund or key-recovery claim on an address-less account
  is answered.
- **Payment data** — handled entirely by Stripe on their hosted checkout. Card numbers never touch
  Verbi. What is kept of a payment is the Stripe event id that credited it, recorded against
  the account so the credit cannot be applied twice and so a bill can be audited — not a customer
  reference, not a card reference, and not an identifier you were shown. Stripe collects the contact
  and billing details it needs under its own privacy terms; those are neither received nor retained, and
  paying does not attach an email to your Verbi account.
- **Support correspondence** — if you write in or use the contact endpoint.

**Processing generates:**
- **Usage metering** — per request: audio duration, billed speech seconds, timing, whether the
  machine was cold, and a request ID, linked to your account so the bill is auditable.
- **Signup-network counters** — a derived, non-reversible bucket of the network a signup came
  from, used solely to enforce free-key limits.
- **Operational logs** — request IDs, status codes, timings and error types. Audio, transcripts and
  API keys are excluded by an allowlist, and a continuous automated check scans production logs for
  leaked content or keys.
- **Admin audit entries** — records of administrative actions on accounts.

**What is never collected:** the content of your audio or transcripts, beyond the moment of
processing.

## 2. Why, and on what legal basis

| Purpose | Basis (GDPR terms) |
|---|---|
| Providing the transcription service you asked for | Performance of a contract |
| Billing, and keeping bills auditable | Performance of a contract; legal obligation (tax/accounting) |
| Preventing abuse and enforcing free-tier limits | Legitimate interests |
| Security monitoring and incident response | Legitimate interests; legal obligation |
| Service emails (verification, notices) | Performance of a contract |

Your data is never used for advertising, never sold, and never shared for anyone else's marketing.

## 3. Your audio, and who is responsible for it

When you send audio, **you decide** what to send and why. In GDPR terms you are the *controller* and
Verbi acts as your *processor* for that content. You are responsible for having the right to send
it, including any consent needed from the people recorded. There is no standing Data Processing
Agreement yet; if you need one to proceed, email contact@verbi.services — asking is what
schedules it, and you will get a straight answer about where it stands rather than a maybe.

## 4. Who else is involved (subprocessors)

| Provider | Role | What it sees |
|---|---|---|
| Fly.io, Inc. (US) | Compute — the machines that transcribe | Audio in memory, for the request duration only |
| Neon, Inc. (US) | Managed Postgres | Account and usage metadata — never audio or transcripts |
| Stripe, Inc. (US/EU) | Payments (its own controller for the payment) | Payment data, directly on their systems |
| Resend — Plus Five Five, Inc. (US) | Outbound service email (SMTP relay) | Recipient address and message content of service emails |
| Migadu-Mail GmbH (Switzerland) | Mailboxes that receive support correspondence | Sender address and content of email you send in |
| Healthchecks.io | Operational alerting | Operational signals only — no customer data |

Notice is given before a subprocessor that handles customer data is added.

## 5. Where data goes, and for how long

Processing takes place on servers in the **United States**. If you are in the EEA, the UK or
Canada, transfers rely on the recipients' standard contractual clauses and equivalent safeguards.

| Data | Retention |
|---|---|
| Audio and transcripts | **Not retained** — memory only, for the request |
| Account records | While the account exists, then deleted |
| Usage/billing records | Kept as long as needed for billing and tax/accounting obligations |
| Deleted-account billing record | A record with no personal data (see §6) — kept for the same billing and tax obligations |
| Operational logs | Short-lived, on a rolling window |
| Support email | While needed to handle the matter |

## 6. Your rights

Depending on where you are, you may **access, correct, delete, port, or object to** the processing
of your personal data, and withdraw consent where consent is the basis. Under Quebec's Law 25 you
also have the right to **data portability** and to be informed of automated decision-making; no
automated decisions with legal effects about individuals are made here.

You can exercise the deletion right yourself, without asking anyone: `POST /v1/account/delete`
permanently removes your account, every api key on it, and its usage history. It is deliberately a
two-step call — the first shows you what would go, the second carries it out — because it cannot be
undone. What survives is a record carrying **no personal data**: the plan tier, the purchased
credit that was unused, the total speech billed over the account's life, whether an address had
been attached, and the dates. It is kept for the billing and tax obligations named above and so
that a refund claim or a card payment dispute can still be answered after the account is gone; it
holds no email address, no api key, no audio and no transcript. Payment records held by the payment
processor (see §4) are likewise retained for tax purposes and are not removed by deleting your
account.

For anything else, email **contact@verbi.services**; a reply follows within the period the
applicable law requires (30 days under GDPR and Law 25). If you are unsatisfied you may complain to your supervisory
authority — in Quebec, the *Commission d'accès à l'information*; in the EEA/UK, your national
authority.

Because audio, transcripts and voiceprints are not stored, requests about *those* have nothing
to retrieve or erase — that is by design.

## 7. Privacy Officer

Under Quebec's Law 25, responsibility for the protection of personal information rests with the
person exercising the highest authority. Verbi is operated by a sole proprietor, who holds that
responsibility personally and is reachable directly:

**Vasily Salmin, Privacy Officer** — contact@verbi.services

Write to that address for any privacy question, request or complaint, or to reach the Privacy
Officer directly.

## 8. Security

API keys are stored as hashes. Transport is HTTPS-only with HSTS. Access to production is limited
and audited, database connections are bounded and encrypted, and operational invariants — including
a continuous scan for leaked keys or transcript content in logs — are checked automatically every
five minutes with alerting to a human.

If a breach affecting your personal data occurs, you and the relevant authority are notified as
required, including under Law 25's mandatory reporting rules.

## 9. Children

The Service is for businesses and developers and is not directed at children under 16. Their data is
not knowingly collected.

## 10. Changes

Updates are posted here, and material changes are announced by email to accounts with a verified
address and by publishing the updated policy with a new date — that publication is the notice for
any account that cannot be reached at a verified address. A material change takes effect 30 days after the
published date. The current version is always at https://verbi.services/privacy.