Privacy Policy
Effective from: June 21, 2026
This section explains how VAPOL CZ s.r.o. (as controller or processor) handles the personal data of the User and of third parties in compliance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing. The full Terms of Service and the Data Processing Agreement (DPA) are available in the Terms of Service.
1. Scope, purposes and legal bases for processing User data
VAPOL processes the personal data of Users (account holders) as a Data Controller for the following purposes:
| Category of personal data | Purpose of processing | Legal basis under GDPR | Retention period |
|---|---|---|---|
| Registration data (e-mail, first name, surname; for B2B also company ID, VAT ID, registered seat) | User account management, technical authorization, ensuring data isolation. | Performance of a contract under Art. 6(1)(b) GDPR. | For the duration of the active user account. |
| Operational and technical data (IP address, device type, activity logs, diagnostics) | Ensuring cybersecurity, fraud and fair-use detection, stability optimization. | Legitimate interest of the Controller under Art. 6(1)(f) GDPR. | Maximum 12 months from the date the record was created. |
| User recordings and transcripts (audio in which the registered User speaks) | Providing the core functionality of the Service (transcription, analysis, storage). | Performance of a contract under Art. 6(1)(b) GDPR. | Until deleted by the User, or until account deletion (plus a 30-day grace period). |
2. Recordings of third parties and allocation of roles
If the User records meetings, conversations, lectures or calls through the Application that capture the voices and personal data of third parties:
- The User acts as the sole and independent Data Controller of these third parties. The User determines the purpose and means of processing (recording a meeting for their own work/business purposes).
- VAPOL acts solely as a Data Processor. It performs technical processing (storage, speech-to-text conversion, AI analysis) exclusively on the User's instructions (Art. 28 GDPR).
VAPOL has no active access to these recordings, does not independently review them and does not use them for its own purposes. The processing relationship is governed by the Data Processing Agreement (DPA) — see the Terms of Service.
3. Data processing via Google Vertex AI
For the purpose of converting audio recordings to text (speech-to-text) and the subsequent text analysis (LLM analysis), the User's data is technically transferred to the Google Cloud Platform infrastructure (specifically the Google Vertex AI interface).
Enterprise interface security guarantees: VAPOL uses exclusively the paid enterprise interface of Google Cloud. Google contractually guarantees that:
- all transferred data (audio, prompts, transcripts and generated analyses) is strictly isolated within VAPOL's secure tenant;
- Google does not and may not use any User data, recordings, transcripts or prompts to train its public AI models (including the Gemini model family);
- data transfer and processing take place in encrypted form both in transit and at rest.
4. Data location and cross-border transfers
All User data is primarily stored and processed in Google data centers located within the European Union (in particular Frankfurt am Main, Germany and Saint-Ghislain, Belgium).
Any backup technical transfer of data to the parent entity Google LLC in the USA is legally and technically secured under the EU-U.S. Data Privacy Framework (DPF) certification, to which Google LLC actively adheres, and the Standard Contractual Clauses (SCCs) integrated into Google Cloud's global data processing agreement.
5. Retention periods and data deletion
Data is retained for the duration of the active user account.
Grace period (soft delete): After the User deletes a recording or the entire account, a 30-day grace period applies. During this time the data is kept in an isolated bin and the User can restore it. After 30 days, the data is permanently and irreversibly overwritten and deleted from all of the Provider's servers and backups. You can delete your account directly in the app under Settings → Delete account, or request deletion by e-mail at voxibly@vapol.net.
Inactive free accounts: If a free account is inactive for longer than 12 months, the Provider reserves the right to permanently delete the account and all its data after prior notice (sent by e-mail 30 days in advance).
6. Rights of data subjects (Users)
As a registered User (data subject) you have the following rights towards VAPOL, which you can exercise at voxibly@vapol.net:
- Right of access to personal data (Art. 15 GDPR);
- Right to rectification of inaccurate data (Art. 16 GDPR);
- Right to erasure (right to be forgotten – Art. 17 GDPR);
- Right to restriction of processing (Art. 18 GDPR);
- Right to data portability in a machine-readable format (Art. 20 GDPR);
- Right to object to processing based on legitimate interest (Art. 21 GDPR).
The User also has the right to lodge a complaint with the supervisory authority, which is the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).
The Service does not carry out any automated individual decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR.
7. Data controller and contact
The data controller is VAPOL CZ s.r.o., company ID 26783789, registered seat Zašová 270, 756 51 Zašová, Czech Republic. For privacy questions contact voxibly@vapol.net.