Privacy Policy

Photos, voice and AI

What is saved

Entered fields, documents and their revisions, uploaded photos, videos, files and sent voice messages are saved. Conversation text and information that helps you resume your work are also saved.

Live conversation versus recording

In a live conversation, audio is sent to AI immediately. During an inspection, individual camera frames are transmitted; the assistant may save useful frames as attachments. You can review a voice message or short video before sending it.

What AI receives

Google Cloud processes the request, the context of your current work and the materials needed to answer. Details from a document or conversation may therefore be processed along with a new question. AI output is a suggestion for a person to review.

Google states that it does not train its models on customer data without permission. This does not mean zero retention: technical caching and security reviews may apply. To resume a Live conversation, Google may retain session data for up to 24 hours. Google Cloud data policies

What to remove before sending

Include only what the task needs. Remove bystanders' faces, identity documents, payment details and health information. If you need another person's data, explain the purpose beforehand and check the legal basis for sharing it. Your checkbox does not replace their rights.

Session recording

PostHog in the EU region receives recordings of clicks, scrolling and navigation to improve the interface. Recording is enabled by default. Text and fields are masked; photos, videos, audio and document content are not recorded. We do not send PostHog your account name or email. You can disable recording using the recording settings link below. Your choice is saved in this browser. Disabling stops new recordings but does not delete those already sent: contact us for deletion.

After you sign in, recordings are linked to your account using its internal ID, without sending your name or email.

Recording settings

Who can access your data

If you followed a specialist's link

Before submission, the specialist cannot see your unfinished response in their request list. After submission, they can access the final document and attachments. They can download them; deleting your copy does not delete their downloaded copies. When a document moves to the next stage, participants in that stage may receive the materials.

Services that make the app work

Railway runs server operations; Supabase provides sign-in and the database; Cloudflare stores files and protects access; Google Cloud processes AI requests. Stripe receives payment information during checkout. Passwords and full card details are not sent to the assistant.

International processing and safeguards

Some AI requests use global infrastructure. Providers and their contractors may process data outside the European Economic Area, including in the United States; Supabase identifies an importer in Singapore, and Resend identifies its main processing in the United States. A European server region does not mean that all processing is confined to Europe.

For transfers outside the EEA, VAU must ensure an applicable basis under GDPR Chapter V: an adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses and necessary supplementary measures. The published provider agreements below include such clauses; applicability depends on the recipient, service and agreement in force. You may request details of a specific transfer and a copy of the applicable safeguards at our contact email.

Google Cloud DPASupabase DPACloudflare DPARailway DPAResend DPA

Resend delivers service reminders about the trial period. It receives the email address and message content for this purpose. This is not a marketing subscription.

Who is responsible for processing

VAU LIMITED is responsible for account data and operating the platform. The specialist or company that sent you the request determines why client information is collected and is responsible for its subsequent use. You can contact both them and us about your request.

Data, purposes and legal bases

Account and selected functions: contact details, sign-in, settings, documents and conversations are needed to provide the requested service — performance of a contract or steps before entering it (GDPR Article 6(1)(b)). For a business customer’s contact persons, the basis is the legitimate interest in serving that customer (Article 6(1)(f)). Without necessary data, the relevant function cannot be provided; optional photos, voice and video need not be sent.

A specialist’s client materials: VAU processes them on the specialist’s instructions under the DPA appended to the terms. The specialist, as controller, determines the legal basis for their clients’ data; the contract with VAU does not itself replace that basis. VAU acts as an independent controller for its own account, payment and security data.

Security and support: access information, technical errors and enquiries are used to protect accounts, investigate abuse and answer requests. The basis is the legitimate interest in running a secure service and resolving enquiries (Article 6(1)(f)); actions under your contract also rely on Article 6(1)(b). You may send us an objection to processing based on legitimate interests.

Payments and mandatory records: order and payment information is needed to perform the contract; documents required for accounting and tax obligations are retained to comply with the law (Article 6(1)(c)). Service reminders about the trial relate to administering your account and are not a marketing subscription.

Consent applies only where it is the basis for specific processing (Article 6(1)(a)); it can be withdrawn without affecting the lawfulness of earlier processing. The acknowledgement checkbox before sending materials and browser permissions do not give blanket consent for any purpose or replace other people’s rights.

Storage and deletion

Work materials are saved so you can continue working. Ending a conversation, signing out or reaching the end of a plan does not delete them. Moving items to the bin and permanently deleting them are different actions; check the explanation in the bin.

To delete your account, conversation history or all related materials, send us a request. We will clarify its scope and confirm completion. If some data must be retained by law or to handle a dispute, we will explain the basis and retention period. Deletion from backups should not be assumed to be immediate.

How retention is determined

The account, documents, attachments and history are retained to let you access and continue your work until they are deleted or an account-deletion request is fulfilled, subject to mandatory exceptions. For client materials, the specialist may instruct return or deletion under the DPA. The end of a trial or paid period is not such an instruction.

Items in the bin can be restored for 30 days after being moved there, after which they are due for permanent cleanup. The deletion date is shown in the bin; cleanup runs in the background. You may permanently delete an item earlier. A file used by another saved document is retained while that link exists.

For payment and accounting records, retention is determined by applicable mandatory record-keeping periods; for enquiries, security information and disputes, by the time needed to resolve the matter, investigate the incident and protect claims within applicable time limits. The exception concerns only necessary records, not all account materials. If we refuse deletion of such records, we explain the specific basis and period or the criterion used to determine it.

Backups and providers’ technical data have separate retention and cleanup cycles. Their duration depends on the service used, backup settings and applicable provider obligations; deleting a working record does not mean all copies disappear at the same time. When fulfilling a request, we explain the applicable procedure and limitations. Documents downloaded locally by you or a recipient must be deleted separately by their holder.

What remains in your browser

Your browser stores sign-in information, language preferences, drafts and recovery data for unfinished recordings. On a shared device, sign out and clear site data. Save any work you need first: clearing data can remove guest access and local drafts.