Verbalyn Privacy Notice
1. Controllers and service-specific roles
SMARTEDTECH SL is the controller for its own Verbalyn accounts, enquiries, platform security and billing. The actual seller, employer, educational institution, clinician, charity or other provider may be an independent controller for its own fulfilment and statutory records. Where the operator acts solely on an institution's documented instructions, the signed Data Processing Agreement applies. The same organization may hold different roles for different purposes; no blanket processor designation is made.
2. Data purposes and lawful basis
The service purposes assessed for these documents are: account administration and customer communications; service delivery; billing and support; security and abuse prevention. The collection screen must mark mandatory and optional fields. Contract steps requested by the individual and performance of their contract may rely on GDPR Article 6(1)(b); corporate-contact handling and proportionate security normally require a documented legitimate-interest assessment under Article 6(1)(f). Accounting and binding authority requests require the actual legal obligation under Article 6(1)(c). Optional newsletters, optional recording, research and nonessential technology require their own basis and specific choice where consent applies. Accepting terms is not consent to all personal-data processing.
| Data class | Purpose and use boundary | Retention trigger and disclosure |
|---|---|---|
| Enquiry and contact details | Respond to the requested enquiry and manage a genuinely related proposal; no automatic marketing list | Close or delete when the enquiry purpose expires under the approved retention schedule; any claim hold is separately justified |
| Identity, account and role | Authenticate eligible users, verify representative capacity and restrict tenant access | Active account and necessary closure period; no indefinite identity-document storage |
| Orders, invoices and service records | Deliver the ordered service, handle payment/refund, comply with tax/records duties | Statutory jurisdiction-specific period must be recorded before release; restricted access after ordinary service ends |
| User content and model inputs | Only the selected feature and instructions; no automatic public release or model-training permission | Delete/export at account or instruction expiry subject to lawful, documented holds |
| Security/acceptance evidence | Prevent abuse and prove the exact action and version | Minimized evidence on a separate policy; no raw secrets or sensitive narratives in immutable logs |
The actual collection fields, production processors, locations and numeric retention periods must be confirmed in the evidence schedule before this notice is published.
3. Special categories, children and automated effects
Health, biometric-identification and other special categories require both an Article 6 basis and an Article 9 condition. A paid contract or generic checkbox does not establish either. Child-facing processing requires the relevant guardian/capacity and safeguarding analysis. AI may assist a user but cannot silently make a decision producing legal or similarly significant effects. Explain any actual profiling, meaningful human review and applicable objection/contest route before enabling it. No sensitive record should be sent through a general contact form.
4. Recipients and international transfers
Disclose the actual hosting, authentication, communications, payment, model and support recipients, their functions and data locations. The processor and subprocessor list is published in the DPA annex and updated with 30 days' notice. No statement that every vendor is in the EEA or that all data is encrypted end to end is made. Restricted transfers require a valid current adequacy mechanism or appropriate safeguards, correct SCC modules/UK instrument where relevant, a transfer assessment and necessary supplementary measures. A new external integration is OFF until its role, purpose and authorization are approved. Sharing across SET platforms requires a purpose-limited scope and is not authorized merely by an account on this site.
5. Rights and contact
You may request access, correction, erasure, restriction, portability or object where the law provides those rights. You may withdraw consent prospectively as easily as it was given. Contact the postal contact at Carrer Agricultura, 16, 1º, 9ª, 08320 El Masnou, Barcelona, Spain. Verify identity proportionately, not by routinely demanding a passport. Ordinarily respond within one month, giving a lawful extension explanation if necessary. Erasure may be limited by a specific statutory record/claim hold; explain scope and duration. You may complain to the competent supervisory authority, including the AEPD for applicable Spanish processing and the ICO where UK law applies. A mailbox labelled DPO does not prove that a DPO has been appointed.
6. Changes
Publish the version, effective date and material changes. A later policy cannot retroactively broaden consent or rewrite a contract. Provide feature-level notice before a new purpose or recipient is enabled. The complete data inventory, verified recipient list and country/retention schedule are release dependencies in these documents.
Service providers used by Verbalyn
Verified in Verbalyn's code and configuration on 2026-11-03:
- Vercel: hosting and delivery of verbalyn.com.
- Supabase: sign-in and storage of account and saved practice data, in the EU (Ireland).
- Stripe: payment, subscriptions, invoices and the billing portal. Card details are entered on Stripe's own page and are not stored by Verbalyn.
- SET Labs AI gateway (orygent-litellm): forwards practice messages, and voice clips if you allow voice practice, to an AI model provider to produce replies, corrections, transcription and speech. The gateway keeps usage records such as time and cost.
- www.joinn.net: the home page loads a partner band (script, fonts and images) from this address.
Verbalyn's code loads no analytics or advertising scripts. Where a provider processes data outside the European Economic Area, section 4 applies. Questions: support@verbalyn.com.
Platform-specific terms
Retention and deletion (ceiling wording)
1. Account data is kept for the life of the account and deleted or anonymised within 90 days after closure, except where a longer period is required by law (tax and accounting records: 6 years; acceptance and consent records: 5 years after the end of the relationship, as evidence of compliance; records subject to a legal hold: until the hold ends).
2. Conversation logs, recordings and uploads not linked to an active contract are deleted no later than «retention.conversations» (default: 12 months) after the last interaction, and earlier on your request, unless a legal hold applies.
3. Backups are rotated on a cycle not exceeding 35 days; data deleted from production is removed from backups at the end of the cycle.
4. Where a provider is an independent controller, its own retention rules apply to its records.
Implementation note: the renderer prints the registry value; the retention job must run at or before the printed ceiling (LGL-T aligned job), which is why the clause uses “no later than”.
---
Data roles
1. Platform data. The Operator is the controller of personal data processed to operate the platform: account, identity verification, acceptance records, payments, security, support, communications and analytics.
2. Provider supply data. Where a provider supplies services to a customer through the platform, the provider is an independent controller of the data it needs for that supply (booking, order, clinical, educational or professional records), and the Operator is a controller of the platform-level record of the transaction. Each party complies with its own obligations; neither acts for the other.
3. Processor services. Where the Operator processes personal data on behalf of a business customer under the customer's instructions (for example an enterprise tenant's employee data), the Data Processing Agreement (DAT-01) applies and governs; it is signed as part of the order.
4. Sharing between SET platforms. Personal data is not shared with any other platform operated by the Operator or its group unless you enable the specific destination in your settings. Enabling one destination does not enable others, and you may disable it at any time.
5. International transfers. Personal data is stored in the European Economic Area (or, for wellbridge.uk, the United Kingdom). Where a processor outside those areas is used, the transfer is covered by Standard Contractual Clauses or the UK Addendum/IDTA, listed in the subprocessor annex.
---