Privacy Policy

Vavus AI, Vavus Keyboard, and Vavus Concierge are operated by DCI Brands LLC, a Wyoming limited liability company, 312 W 2nd Street, Casper, WY 82601, United States. We are the controller of account and service data described here. For a business's Concierge visitor and customer data, we generally process data on that business's instructions under the Concierge Data Processing Agreement; an approved healthcare workspace may also be covered by a Business Associate Agreement.

Privacy contact: constantine@vavusai.com.

Our representative in the European Union under GDPR Article 27 is Dragoș Ignat, Str. General Șova nr. 21, Letea Veche, jud. Bacău, 607270, Romania. You may contact the representative on any matter relating to the processing of your personal data, in addition to or instead of contacting us. We have not appointed a UK representative or a data protection officer. Privacy questions and rights requests go to constantine@vavusai.com and are handled by DCI Brands LLC directly.

We collect what is needed to create and secure your account, provide the features you use, take payment, answer support requests, and keep the service running.

• Identifiers and account data - email address, name, login method, organization membership, security settings, device and session identifiers.
• Content you submit - translations, transcripts, audio recordings, messages, documents, files, and images you choose to process or save.
• Concierge workspace data - business settings and knowledge, customer and staff details, visitor chats and calls, transcripts, optional recordings, appointments, and information used to answer account or payment questions.
• Audio and voice data - speech you dictate or translate. Where it is used to identify or characterize you, this can be sensitive personal information under US state law.
• Health-related content - only in accounts approved for healthcare use under a Business Associate Agreement.
• Commercial data - plan, subscription, token balance, purchase and refund history. Card numbers are handled by Stripe, Apple, or Google; we never receive or store them.
• Technical and security data - device type, app version, crash diagnostics, IP-derived security signals, abuse and rate-limit records.
• With your permission, Vavus and Google Analytics measure visits, public pages, country, device category and referral sources to improve this website. Vavus uses random browser and session identifiers to count consented visits and returning browsers. Our team may receive a private notification for the start of a consented visit. We do not send form contents, URL query strings or precise location in these visitor records, and we do not use this integration for advertising.

Where the GDPR or UK GDPR applies, the legal basis for each purpose is set out below.

• To provide the service - translation, speech-to-text, text-to-speech, keyboard dictation, AI features, messaging, calls, documents, and account management. Performance of a contract (Art. 6(1)(b)).
• To bill you and keep tax and accounting records. Performance of a contract and legal obligation (Art. 6(1)(b), 6(1)(c)).
• To keep accounts and the service secure - authentication, abuse prevention, rate limiting, fraud detection, audit logging. Legitimate interests in protecting users and the service (Art. 6(1)(f)).
• To answer support requests. Performance of a contract and legitimate interests.
• To send service, billing, and security notices. Performance of a contract and legal obligation.
• Detailed website analytics, Google Analytics and optional browser identifiers rely on consent. UK anonymous first-party statistics rely on the narrow statistical-purposes exception, with notice and a free opt-out, and contain no visitor identifier. Necessary preference storage remembers a choice you request. Security and abuse prevention are separate from optional analytics.
• To meet legal requirements and to establish or defend legal claims. Legal obligation and legitimate interests.
• Health information in healthcare accounts. We process it as a business associate on the customer's documented instructions; the customer determines the lawful basis, and where the GDPR applies that is normally Art. 9(2)(h) or the customer's explicit-consent basis.

We do not use your content to train our models, and we contract with our speech, translation, and AI providers to keep your content out of the training of theirs.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act as amended and in comparable US state privacy laws.

We do not make automated decisions producing legal or similarly significant effects about you (GDPR Art. 22).

Providing account and payment data is necessary to open and keep an account; without it we cannot provide the service. Everything else - optional cookies, marketing preferences - is genuinely optional.

Translation, transcription, and AI output can be wrong. It is not medical, legal, or financial advice, and it is not for emergency use. Review output before you rely on it, and never use it as the sole basis for a clinical, legal, financial, or safety-critical decision. A person should review anything that matters.

In Vavus AI and Vavus Keyboard, personal saved history, documents, and audio use the client-side encryption controls described in Data Controls. Personal messaging uses the Signal Protocol and is end-to-end encrypted between participants. These statements do not describe Concierge workspace content.

Concierge processes chats, calls, transcripts, appointments, workspace knowledge, and any enabled recordings on our servers so the assistant and your team can use them. Authorized workspace staff and our systems can access the data needed to provide those features. Do not treat Concierge content as end-to-end encrypted or as ciphertext that our servers cannot read.

For end-to-end encrypted personal messaging, there are two feature-specific exceptions:

• Group polls. The server has to read a poll to tally votes and show results, so polls are not end-to-end encrypted. They are disabled in healthcare conversations.
• Voice-message translation. Translating a voice message requires decrypting that one message on our servers. We ask for your consent first, record the consent, and audit the access. It never happens unless you choose it.

For personal translation and dictation, content you do not save is not retained as personal history once your result has been produced. Concierge conversations and optional recordings follow the workspace retention setting described below.

• Saved history, documents, and files - until you delete them or close your account.
• Account and profile records - for the life of the account, then up to 30 days after closure.
• Billing, tax, and transaction records - 7 years, as tax and accounting law requires.
• Security, fraud, and abuse logs - 12 months.
• Support conversations - 24 months.
• Healthcare audit records - retained under our six-year policy. These describe access and actions, including the authorized account and workspace, without customer messages, medical notes or recordings.
• Concierge conversation material, including visitor sessions, transcripts and enabled recordings - the workspace setting defaults to 90 days. Standard workspaces can select 1 to 730 days; approved healthcare workspaces can select 1 to 90 days. Earlier authorized contact or workspace deletion also starts removal. Recording-object cleanup may finish asynchronously.
• Concierge contacts, appointments, workspace configuration and billing evidence - kept while needed to provide the workspace or meet applicable legal and accounting requirements, subject to the relevant deletion workflow. Consent and compliance audit records use a separate six-year schedule. Encrypted backups age out under their configured lifecycle; they are not erased instantly from every backup.
• A necessary preference cookie (sv_privacy on ShopVavus or vb_privacy on Vavus Space), or vavus_cookie_consent in local storage on Vavus AI, remembers a choice valid for 180 days. Expired local-storage choices are discarded when you next visit. Only after analytics opt-in, vavus_site_visitor remembers a random browser identifier for up to 90 days, and vavus_website_session in session storage groups activity until 30 minutes of inactivity or the tab closes. Google Analytics uses _ga and _ga_* cookies, configured for up to 90 days. Vavus AI may also save consented referral attribution in vavus_first_touch for up to 90 days.
• Vavus keeps detailed website sessions, events and related visitor-notification records on its server for 30 days, and anonymous website totals for 13 months. Notifications already delivered to your phone follow its notification settings. Browser identifiers expire after at most 90 days and privacy choices are valid for 180 days. Google Analytics processes consented measurements separately under its privacy and data-processing terms, including network information it receives directly. Its event and user retention follows the relevant property settings; aggregate Google reports and existing report history may be retained longer. These Vavus retention periods do not describe Google report retention.

We use service providers by function: cloud hosting and storage; speech recognition and synthesis; machine translation and AI models; payment processing; email delivery; push notification delivery; and support operations. Each receives only what its function requires, under written data-processing terms.

Providers that process speech, translation, or AI content are configured to exclude it from model training and to minimize retention wherever the service supports it. The information needed for a Concierge request can include a prompt, workspace settings, and relevant customer or staff details, including names or other identifying information when the request requires them. The Setup Assistant asks for permission before sending its prompts and workspace context to the configured AI provider. Payment and app-store providers also receive identifying and transaction data needed to process a purchase.

Our support chat is self-hosted on our own infrastructure, so support transcripts are not handed to a third-party vendor.

A named sub-processor list is provided to enterprise and healthcare customers under a data processing agreement. We may also disclose data to comply with law or a lawful request, to enforce our Terms, to protect rights and safety, and in connection with a merger or acquisition, in which case this policy continues to apply.

We operate from the United States, with edge infrastructure in the European Union and Asia. Your data may be transferred to and processed in the United States and other countries whose laws differ from those of your own.

For transfers out of the EEA, the UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK Addendum and the Swiss annex where they apply, together with the technical measures described in Section 6. Client-side and end-to-end encryption protect the personal features identified there; Concierge content needs server processing and is not covered by that ciphertext-only description. A copy of the relevant transfer terms is available on request.

If you are in the EEA, the UK, or Switzerland you may request access, rectification, erasure, restriction, and portability, object to processing based on legitimate interests, and withdraw consent at any time without affecting processing already carried out.

You may also lodge a complaint with a supervisory authority: in the EU, the authority in your country of residence, place of work, or the place of the alleged infringement; in the UK, the Information Commissioner's Office.

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you may request to know and access the personal information we hold, correct it, delete it, and receive a portable copy, and you may opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects.

We do none of those things. We honor the Global Privacy Control and other recognized opt-out preference signals anyway: when your browser sends one, we treat it as an opt-out of the analytics and marketing categories for that browser, with no further action from you.

California residents may also ask us to limit the use of sensitive personal information. We already use it only to provide the service you asked for and to keep it secure, which are permitted purposes. We will not discriminate against you for exercising any privacy right.

Appeals. If we decline a request, you may appeal by replying to our decision or emailing constantine@vavusai.com with "Privacy appeal" in the subject line. We respond within 45 days - 60 in Colorado - with our decision and the reasons for it. If we deny the appeal you may complain to your state attorney general. Utah does not provide an appeal right, but we will still review your appeal.

We grant bonus tokens for verifying your email address and for referrals. These are financial incentive programs under California Civil Code section 1798.125(b). The material terms are on our pricing and referral pages: the tokens are promotional, carry no cash value, and can be used only for Vavus features.

We estimate the value of the personal information involved as approximately the retail price of the tokens granted, using our published token price. We calculate it that way because the data involved - an email address and a referral relationship - generates no separate revenue for us, since we do not sell personal information. Participation is voluntary and you can withdraw at any time by emailing us; withdrawing does not reclaim tokens you have already spent.

Use the in-product controls where they are available, or email constantine@vavusai.com. We verify requests by matching what you give us against account, billing, support, or security records, and we may ask for more information when a request is sensitive. An authorized agent may act for you with written authorization. We respond within 45 days and may extend once by a further 45 days, telling you why.

HIPAA protections apply only to accounts we have approved for healthcare use under an executed Business Associate Agreement. If you have not signed a BAA with us, your account is not a HIPAA workflow and you must not upload protected health information to it.

Approved healthcare accounts use 8-hour session tokens, a 15-minute idle timeout, PHI-handling controls, secure deletion of PHI assets, and 6-year audit retention, and application logs are designed to exclude PHI. In those accounts we act as a business associate, so your organization - not we - decides what happens to the data, and we act on its instructions.

We use TLS in transit, the client-side and end-to-end encryption described above, authentication with rotating tokens, separate stream tokens for real-time sessions, SSO for enterprise accounts, brute-force protection, token revocation on logout and password change, rate limiting, access controls, and audit logging.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authorities without undue delay and within 72 hours of confirming a breach affecting your personal data, as the law requires.

Vavus AI and Vavus Keyboard accounts require you to be at least 16. A person operating a Vavus Concierge workspace must be at least 18. These services are not directed to children below those ages.

A parent or guardian who believes a child has created an account can email constantine@vavusai.com. We will verify the report and delete the account and its data promptly. We also close any account we discover belongs to someone under 16.

We may update this policy. The Last updated line shows the current version. Where a change materially affects how we handle personal data, we will give notice in the product or by email before it takes effect.

经您同意，Vavus 和 Google Analytics 统计访问、页面、国家、设备及来源，以改进网站。无广告或表单内容。拒绝会停止可选统计。

来自英国的访问默认启用匿名 Vavus 统计，无访客标识或 Google。选择拒绝可关闭。

A necessary preference cookie (sv_privacy on ShopVavus or vb_privacy on Vavus Space), or vavus_cookie_consent in local storage on Vavus AI, remembers a choice valid for 180 days. Expired local-storage choices are discarded when you next visit. Only after analytics opt-in, vavus_site_visitor remembers a random browser identifier for up to 90 days, and vavus_website_session in session storage groups activity until 30 minutes of inactivity or the tab closes. Google Analytics uses _ga and _ga_* cookies, configured for up to 90 days. Vavus AI may also save consented referral attribution in vavus_first_touch for up to 90 days.

Vavus keeps detailed website sessions, events and related visitor-notification records on its server for 30 days, and anonymous website totals for 13 months. Notifications already delivered to your phone follow its notification settings. Browser identifiers expire after at most 90 days and privacy choices are valid for 180 days. Google Analytics processes consented measurements separately under its privacy and data-processing terms, including network information it receives directly. Its event and user retention follows the relevant property settings; aggregate Google reports and existing report history may be retained longer. These Vavus retention periods do not describe Google report retention.

Accepting optional analytics is not a condition of browsing or sending an inquiry. Reject is available alongside Accept. Use Cookie settings in the footer to change your choice at any time. Rejecting stops future optional analytics and clears the website analytics identifiers in your browser. Global Privacy Control and Do Not Track override optional analytics. Withdrawal does not erase previously lawful records immediately; they remain subject to retention and applicable deletion rights. Anonymous combined totals cannot be separated into your individual activity.

Google Analytics receives measurements only after your analytics opt-in. Google processes them under its own privacy and data-processing terms and may process information outside your country. Advertising features and Google Signals are disabled for this website integration. We do not sell visitor information or share it for targeted advertising.