Privacy Policy

ARTICLE 1 - PREAMBLE

Personal data means any information that makes it possible to identify, directly or indirectly, a natural person (e.g., email address, IP address, account identifier).

This policy aims to inform users:

• about the personal data collected;
• about the purposes and legal basis of processing;
• about data recipients;
• about their rights;
• about the Platform's cookie policy.

ARTICLE 2 - PRINCIPLES APPLICABLE TO DATA PROCESSING

In accordance with Article 5 of the GDPR, personal data are:

• processed lawfully, fairly, and transparently;
• collected for specified, explicit, and legitimate purposes;
• adequate, relevant, and limited to what is necessary;
• accurate and kept up to date where necessary;
• kept for a limited period;
• protected by appropriate security measures.

Processing is lawful only if it is based on at least one of the following grounds:

• the user's consent;
• performance of a contract;
• a legal obligation;
• the legitimate interest of the data controller.

ARTICLE 3 - DATA COLLECTED AND PROCESSED

Article 3.1 - Collected data

As part of the use of the Platform, the following data may be collected:

Identification data

• Email address
• Username
• Password (encrypted)
• Identifiers from third-party services (Google, Discord)

Usage data

• Campaigns, Sessions, notes, characters, and preferences created by the user
• Text content, images, documents, or audio files provided by the user, as well as voice tracks, transcripts, and attributed passages from Discord audio capture; imported audio remains subject to confirming participant information and authorization
• Content made public voluntarily via public campaign or Session sharing

Technical data

• IP address
• Connection logs
• Browsing data
• Browser and device type
• Anonymized browsing data used for minimal audience measurement

Billing data

• Subscriptions, credits, invoices
• Payment history

(Banking data is never stored by VoLog)

Article 3.2 - Purposes of processing

Personal data is collected for the following purposes:

• creation and management of user accounts;
• provision of Platform features, including Discord audio capture, its free automatic transcription and delivery to the designated owner of the game, as well as audio import, transcription, and user-requested content generation (contract performance and legitimate interest in providing the requested service);
• backup, organization, and retrieval of content (contract performance);
• management of subscriptions, payments, and credits (contract performance and legal billing obligations);
• security and abuse prevention (legitimate interest);
• user support and service-related communications (contract performance);
• continuous improvement of the Platform (legitimate interest, while respecting private content);
• minimal and anonymized audience measurement to improve the user experience (legitimate interest).

Article 3.3 - Collection method

Some data is collected automatically during browsing:

• IP address;
• session and security data;
• technical logs;
• anonymized browsing data for minimal audience measurement.

Other data is collected when the user:

• creates an account;
• starts or joins a game recorded by the Discord bot, without a VoLog account being created or required;
• enters, imports, or generates content;
• subscribes to a plan or purchases credits;
• uses public sharing or search features;
• browses public or private pages of the Platform.

Article 3.4 - Retention period

Data is retained:

• as long as the user account is active;
• until the account is deleted by the user;
• then deleted or anonymized within a reasonable period.

Certain data is kept longer to meet legal obligations or under specific product rules:

• billing data: 10 years;
• technical and security logs: 12 months maximum; Discord audio files and imported audio: after a temporary failure, up to five transcription attempts, immediately, then 2 minutes, 30 minutes, 1 hour, and 2 hours after the first; the fifth starts at 2 hours and may run until the provider timeout; deletion only occurs after a complete or usable partial transcript, or after terminal failure; any deletion failure is retried without restarting transcription;
• transcript linked to an account: no automatic time limit, until the user deletes it; unclaimed orphan Discord transcript: up to 12 months; passages attributed to a participant: removal request by email to contact@volog.app, without a VoLog account, reviewed manually case by case;
• OpenAI Responses stored with the user's separate consent: provider retention currently at least 30 days, with a deletion request upon withdrawal; background operations retain only the technical storage required for retrieval, then VoLog requests deletion after terminal local persistence.

Article 3.5 - Hosting and subprocessors

The Platform is hosted by professional providers that meet security and GDPR compliance requirements.

Data may be transferred to processors needed for service operation or for the purposes described in this policy, including:

• hosting and infrastructure;
• payment provider (Stripe);
• transactional email delivery services;
• Mistral AI, for automatic transcription of Discord audio through the regional EU endpoint api.eu.mistral.ai; provider-side zero data retention (ZDR) was confirmed active on August 13, 2026;
• OpenAI, for transcription of imported audio and other assisted operations; ZDR was confirmed active on August 13, 2026 for compatible requests; required content is still transmitted with a pseudonymised technical identifier, diagnostic retention of synchronous or streamed Responses is disabled by default, and the specific Response storage rules described above continue to apply;
• a privacy-friendly audience measurement service.

These providers act only on VoLog's instructions.

Article 3.6 - Transfers outside the European Union

The use of certain third-party services integrated into the Platform may involve data transfers to countries located outside the European Union.

Where applicable, these transfers are governed by the legal mechanisms provided for by the GDPR, including the standard contractual clauses approved by the European Commission.

Article 3.7 - Automated processing

Some Platform features rely on automated processing intended to organize, rephrase, or search the content provided by the user.

For Discord, transcription starts automatically after audio capture begins. The public message informs participants, preserves individual opt-out from that point on, and names the owner who can access the transcript. The bot does not require or create a VoLog account. Each participant can request removal of passages already transcribed by emailing contact@volog.app; the request is reviewed manually, case by case.

Other processing is triggered at the user's request or when strictly necessary for the relevant features to function. Manual audio imports require prior confirmation that recorded participants have been informed and that the user has the necessary authorization. API data is not used to train or improve models. Optional diagnostic retention of OpenAI Responses is separate from other consents, can be withdrawn in My account > Privacy, and does not affect technical storage required while background processing is retrieved.

These processes:

• are not intended to produce legal effects with regard to the user;
• do not constitute automated decision-making within the meaning of Article 22 of the GDPR.

ARTICLE 4 - DATA CONTROLLER

The data controller is EURL FOOBAR, publisher of VoLog, whose registered office is located at 19 rue Louis David, 62280 Saint-Martin-Boulogne, France.
Website: https://volog.app
contact@volog.app

VoLog is not required to appoint a Data Protection Officer (DPO).

ARTICLE 5 - USERS' RIGHTS

In accordance with the GDPR, the user has the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to give instructions about their personal data after death;
• right to lodge a complaint with the competent supervisory authority (CNIL).

Rights may be exercised by email at: contact@volog.app

A participant whose voice was captured on Discord can request removal of passages already transcribed at the same address without creating a VoLog account. VoLog responds as soon as possible and no later than one month after receipt. This period may be extended by two months depending on the complexity and number of requests; VoLog then informs the requester of the extension and its reasons within the first month. Only the information needed to locate the game and passages is requested; additional proof of identity is requested only where there are reasonable doubts.

When the user relies on a third-party authentication service (for example Google or Discord), some associated data may also be managed from the relevant third-party account.

ARTICLE 6 - COOKIES

VoLog only uses technical cookies required for sign-in, security, session persistence, and real-time features.

VoLog uses Umami to measure aggregate traffic without setting cookies. These statistics are not used for targeted advertising or cross-site tracking. The technical affiliate cookie volog_aff stores the referring partner for 30 days so that the benefit or commission provided by the program can be attributed. It is not used for advertising and is not sent to Umami.

The user may configure their browser to limit certain technical cookies, subject to possible degradation of the service.

ARTICLE 7 - POLICY CHANGES

VoLog reserves the right to modify this policy at any time to ensure compliance with applicable legislation.

Users are encouraged to consult this page regularly.