Privacy Policy

1. Who We Are

Verbato ("Verbato," "we," "us," or "our") is an audio and video transcription service operated by Versa Studio LLC, a Wyoming limited liability company. Versa Studio LLC is the data controller for your personal data.

Notice address: Versa Studio LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.

For privacy inquiries, contact us at: privacy@verbato.io

2. What Data We Collect

We collect the following categories of personal data:

Data You Provide Directly

• Account information: Your email address and, optionally, your name and profile picture (if you sign up through a social provider). We use this to create and manage your account.
• Audio and video files: Files you upload or URLs you submit for transcription. These are the files we transcribe for you.
• Channel links: If you use Verbato via Telegram or email, we store the identifier needed to deliver transcriptions back to you (your Telegram user ID or your email address). A WhatsApp channel is planned and is not active today; no data reaches WhatsApp or Meta.
• Telegram groups: In a Telegram group, our bot transcribes a voice note when a member who has linked their Telegram account to Verbato replies to it and mentions the bot. For that to work, Telegram delivers every message in the group to our servers, not only the ones addressed to the bot. Anything not addressed to the bot is discarded on arrival: none of it is stored, and its content is never logged.
• NPS feedback: If you choose to rate our service, we store your score and any optional comment.
• Requests for work we do not cover: If you send the form "Tell us what you need", we store what you write in it, the language of the page and, if you give one, your email address, which we use only to write to you about that request. If you are signed in, the request is stored with your account. We delete a request after 90 days, or with your account if it was sent with one.
• Payment information: When you subscribe to a paid plan, your payment details are collected and processed by our payment processor. We store only your subscription status, plan type, and payment customer ID — never your credit card number or full payment details.

Data Collected Automatically

• Usage data: We record how you use Verbato — transcription counts, duration processed, formats downloaded, and the method you used (web upload, URL, API, Telegram, WhatsApp, or email). This helps us enforce plan limits and improve the product.
• Analytics data: We collect page views, feature usage events and device information through our analytics provider, at one of two levels. The default level sets no cookies, stores nothing in your browser, and discards your IP address and your location; enhanced analytics, which link activity to your account across sessions, run only with your consent. Section 8 describes exactly what each level collects, and you can change the level at any time via the cookie settings.
• Cookies: See Section 8 below for details on the cookies we use.

3. How We Use Your Data

We do not use your audio files, video files, or transcription content for any purpose other than providing the transcription you requested. We do not use your content to train AI models.

4. Who We Share Your Data With

We share your data only with the third-party service providers ("subprocessors") necessary to deliver the service. We do not sell your personal data to anyone.

Every subprocessor we use is listed on a single dated page, together with what it does, the data it reaches and where it processes that data: Subprocessors. That page is the maintained copy of the list — it is not repeated here, so the two can never disagree.

5. Where Your Data Is Processed

Most of our infrastructure runs in the United States: the application servers, transcription, document generation and monitoring. Our database runs in Canada, so your account records, project metadata, transcripts and generated documents are stored there. File storage is in Eastern North America. Content delivery and DNS run on global networks.

If you are located in the European Union, European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your data — including your audio files — is transferred to and processed in the United States and Canada.

International transfer safeguards: We rely on Standard Contractual Clauses (SCCs) and on our subprocessors' own transfer mechanisms for lawful international data transfers. Each subprocessor, and the location in which it processes data, is named on the Subprocessors page.

6. How Long We Keep Your Data

Short by default, not by plan. Every new project is kept for 7 days regardless of which plan you are on. Your plan sets the maximum you may extend an individual project to — 7 days on Free, 30 on Personal, 90 on Professional and 365 on Business — not the period you are given automatically. Changing the setting affects new projects; projects that already exist keep the window they were created with.

When that window expires, the recording, its transcript and its generated documents are permanently deleted — first from file storage, then from our database. We cannot recover deleted files. If you transcribe a recording again, both projects use the same recording, and it is deleted with the last of them to go.

What stays after a project is deleted. Until you delete your account, our database keeps a minimal record that the project existed: when it was created and deleted, how it reached us, the recording's length, size and file type, its language and status, which provider transcribed it and what processing it cost. That record holds no title, file name, link or sender address, and none of the content. The project's title stays on its deletion receipt (Section 7). The same holds when you delete a project, or all of them, yourself.

7. Your Rights

Depending on your location, you have the following rights regarding your personal data:

• Right to access: View your account data in profile settings, and use Settings → Data & retention → Export my data for a complete machine-readable copy.
• Right to correction: Update your name and email in profile settings. For other corrections, contact privacy@verbato.io.
• Right to deletion ("right to be forgotten"): You can erase all of your content yourself at any time — Settings → Data & retention → Delete everything permanently removes every recording, transcript and document, and writes you a receipt. To delete the account itself, use Settings → Data & retention → Delete my account in the same place. If you cannot sign in, email privacy@verbato.io and we will erase it for you.
• Right to data portability: The same export gives you your data in a machine-readable format.
• Right to restrict processing: Contact privacy@verbato.io.
• Right to object: Opt out of analytics via cookie settings. Contact us to object to other processing.
• Right to withdraw consent: Change cookie preferences at any time via the "Cookie Settings" link in the footer. Unsubscribe from marketing emails using the link in each email.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority.
• California residents: We do not sell or share your personal information as defined under CCPA/CPRA. See our Do Not Sell My Personal Information page.

How to exercise your rights: Use the self-service options in your Account Settings, or email us at privacy@verbato.io. We will respond within 30 days.

Account Deletion

When you delete your account, we:

1. Immediately cancel any active subscription
2. Permanently delete all your audio and video files from our file storage
3. Permanently delete all your transcription outputs from our file storage
4. Delete all your data from our database (transcriptions, segments, usage records, channel links)
5. Delete your user account from our authentication provider
6. Write you a deletion receipt (see below)
7. Send you a confirmation email (the last email we will send you)

Three things survive an account deletion, and we would rather say so than imply otherwise. Our payment processor retains payment records as required by tax and financial regulations. Your analytics record is not deleted — the usage events already collected stay there until they age out under our analytics provider's own retention. And if a card was used for a free trial, we keep a one-way code of that card, which holds no name, email or account, so that card cannot start a second trial. Everything else described above is removed: the recordings, transcripts, segments, generated documents and stored files are gone.

Deletion Receipts

Every deletion you perform writes a receipt — a dated, metadata-only record of what kind of thing was deleted and when. Receipts never contain your content; their purpose is to let you prove a deletion happened, not to keep a copy of it. You can read your receipts under Settings → Data & retention.

Turning Analytics Off for Your Account

Separately from the cookie settings in Section 8, you can switch off product analytics for your whole account in Settings. This is an account-level exclusion applied on our servers, not just in your browser, so it covers activity that does not originate from a page you have open. It takes effect within a few minutes. It stops new analytics being collected; it does not delete analytics already collected.

8. Cookies and Tracking

We use a two-tier analytics approach that lets us understand how Verbato is used while respecting your privacy preferences.

Essential Cookies (Always Active)

These cookies are necessary for the service to function. Authentication cookies keep you signed in. The payment cookies protect against payment fraud.

Cookieless Analytics (Always Active — No Cookies)

This is the level the cookie banner calls "Anonymous Only", and it runs whether or not you make a choice. We collect page views and feature usage to understand how Verbato is used — for example, which pages are visited and which features are popular. It is collected through our analytics provider in memory-only mode: no cookies are set on your device, nothing is stored in your browser, and no identifier survives a page load, so we cannot connect one visit to the next.

We discard your IP address, and we do not look up your location. Our analytics service is configured to drop the client IP at the moment an event is received, and at this level we also switch off the location lookup, so these events carry no country, region or city. Both are settings we chose and turned on in September 2026 — they are not an inherent property of running without cookies.

What these events do still contain. Cookieless is not the same as anonymous, and we would rather tell you what is sent than claim more than we can support. Each event carries your browser and its version, your operating system, your device type, your screen and window size, your language and your time zone, along with the page you were on and the site you arrived from. We use it to tell a phone from a desktop and to reproduce faults that happen in only one browser. We do not combine it into a fingerprint and, with no stored identifier, we cannot link it across visits — but we do not claim it could never identify anyone.

Legal basis: Legitimate interest (Art. 6(1)(f)) — we have a legitimate interest in understanding product usage to improve the service. We rest that on how narrow the collection is rather than on a claim of anonymity: no cookies, no stored identifier, no IP address and no location. On that basis we judge it not to override your privacy rights.

Enhanced Analytics Cookies (Require Your Consent)

If you accept enhanced analytics, our analytics provider stores cookies and localStorage data on your device to track your activity across sessions, link your actions to your account, and provide us with insights like user journeys, retention cohorts, and UTM attribution. This data helps us understand how users like you interact with Verbato over time.

Session replay is part of enhanced analytics. With your consent, our analytics provider records a playback of your interactions with the interface — clicks, navigation and scrolling — so we can see where the product is confusing. It is configured to mask all text and all form inputs, so the replay shows the shape of a page and not its contents. If you choose "Anonymous Only", reject enhanced analytics, or send a GPC signal, no session is recorded at all.

If you choose "Anonymous Only" or reject enhanced analytics, these cookies are never set. You still contribute to the cookieless analytics described above — without an IP address, without a location, and with nothing stored that would let us recognise you on a later visit.

Error Reporting (Always Active)

When something breaks in your browser, we record the error — the message, where in the code it happened, and an identifier that lets us match it to our own server logs. This is how we find faults nobody reports, and it is the only error reporting Verbato has, so it runs whether or not you accept enhanced analytics. At the cookieless level no persistent identity is attached to it, and it carries no IP address and no location.

Global Privacy Control (GPC): We detect and honor the Global Privacy Control browser signal. If your browser sends a GPC signal, we disable enhanced analytics and operate at the cookieless level described above.

9. How We Handle Your Files

Your audio and video files are processed entirely on our servers. Here is exactly what happens:

1. Upload: Your file is uploaded via encrypted connection (TLS) to our file storage. The original filename is replaced with a random identifier.
2. Processing: Your recording is sent over an encrypted connection to the AI services that work on our behalf, which turn it into a transcript and, when documents are written, write them from that transcript. We never use your recordings, transcripts or documents to train or improve any model, and we never sell or rent them. We use these services under terms that do not permit them to train on your content. The Subprocessors page lists them.
3. Storage: The transcript is stored in our database and as a file in our file storage. Your original audio file remains for the duration of that project's retention window.
4. Download: You can download your transcript in various formats. Download links are time-limited and tied to your authenticated session.
5. Deletion: After the project's retention window — 7 days by default, as described in Section 6 — files are permanently deleted by our automated cleanup process. You can also delete any project manually at any time, and every deletion writes you a receipt.

Files are encrypted at rest (server-side encryption) and in transit (all connections use TLS 1.2+).

We do not use your files for any purpose other than providing the transcription you requested. We do not use your files to train AI models. We do not review, listen to, or access your files unless you specifically request technical support that requires it.

10. Children's Privacy

Verbato is not directed to children under the age of 16 (or 13 in jurisdictions where COPPA applies). We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@verbato.io.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email (if you have an account) or by displaying a notice on the website. The "Last updated" date at the top will always reflect the most recent revision.

12. Contact Us

For any questions or requests regarding your privacy or this policy:

• Email: privacy@verbato.io
• Mailing address: Versa Studio LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States
• Response time: Within 30 days