How we handle data, files and transcripts.

Controller and scope

The data controller is Lunardelli Labs di Lunardelli Alessio (Italian VAT no. 02361570506), contactable at info@verbale.ai.

Verbale.ai processes personal data needed for registration, sign-in, file uploads, transcripts, summaries, exports and billing. For privacy requests, write to info@verbale.ai.

This policy applies to verbale.ai, the application at app.verbale.ai, the VerbaleAI Recorder desktop app and the product's associated API services.

Data we process

Data provided by users

• username and email address;
• uploaded audio or video files, titles, metadata and user-generated content;
• transcripts, speaker diarization, summaries and exports produced from uploaded files;
• requests sent to support or sales.

Data generated while using the service

• active sessions, login history, IP address, user agent and technical security logs;
• processing job status, minutes consumed, billing transactions and Stripe references;
• application logs and technical identifiers used for diagnostics, security and auditing;
• for the desktop app, automatic reports of technical errors and crashes, as described below;
• for the web dashboard, automatic error reports and browser performance samples, as described below.

Purposes and legal bases

• Service delivery: creating accounts, authenticating users, uploading files, generating transcripts, summaries and exports, and managing the workspace.
• Pre-contractual and contractual measures: activating plans, top-ups, the customer portal, invoicing and payment reconciliation.
• Legal obligations: retaining data needed for tax, accounting, security or requests from competent authorities.
• Legitimate interests: preventing abuse, protecting the service, monitoring reliability, resolving technical incidents and improving operations and support.

Automatic desktop app diagnostics

VerbaleAI Recorder automatically sends technical reports to Sentry when it detects an application error or a handled crash. The purpose is to diagnose incompatibilities and faults and improve reliability and support, based on the controller's legitimate interests. Usage tracking, profiling, session replay and performance monitoring are not enabled. The app has no switch to disable these reports.

Reports may include:

• exact app version and production environment;
• Windows and runtime versions, process architecture, username, computer name and IP address;
• exception type and message, full stack trace, local paths, modules and code details;
• breadcrumbs, local diagnostic text, request context when present and technical error classifications;
• other data in the standard diagnostic context built by the Sentry SDK when the error occurs.

The app does not attach audio files or settings.json to reports. Before sending, it applies one filter: VerbaleAI desktop credentials in the expected format are replaced with [REDACTED]. Other diagnostic details are not removed.

Reports received by Sentry are retained for 30 days. If Sentry is unreachable, the app may keep a local queue of up to 30 reports to retry delivery without delaying startup or recording.

Automatic web dashboard diagnostics

The dashboard at app.verbale.ai uses Sentry to automatically report application errors and a sample of browser performance. Production records 10% of traces covering page loads, navigation, HTTP requests, Web Vitals and long tasks. The purpose is to diagnose faults and slowdowns and improve reliability and support, based on the controller's legitimate interests. Session Replay, profiling, Sentry Logs, screen recordings and feedback widgets are not enabled.

Reports may include:

• dashboard release, environment, page, referring URL, browser and device information;
• exception type and message, stack trace, breadcrumbs and the Sentry SDK's standard diagnostic context;
• account identifier, username, email, system role and IP address;
• HTTP request timing and context and, for selected API errors, HTTP status, application code, request identifier and normalized path.

The dashboard does not configure attachments containing audio, transcripts, uploads or application state. Before sending, it replaces VerbaleAI desktop credentials in the expected format and the values of URL parameters token, session_id, x-amz-signature, x-amz-credential and x-amz-security-token with [REDACTED]. Other data in Sentry's standard diagnostic context is not removed.

Error and performance reports received by Sentry are retained for 30 days.

Public website traffic statistics

The public pages at verbale.ai use Cloudflare Web Analytics to understand visits and improve the website. Reports include page views, referring websites, visitor countries, device types, browsers, operating systems and page performance. This integration is limited to the public website.

Cloudflare states that Web Analytics does not use cookies or localStorage to collect usage metrics and does not fingerprint individual visitors. We do not send account identifiers, email addresses, recordings or transcripts through this integration. Reports can be consulted for the previous six months. See Cloudflare’s documentation for collection details.

Cookies

Verbale.ai does not use marketing or profiling cookies in the product. It uses cookies for authentication and to remember your chosen language:

• Authentication/session cookie: needed to maintain access to the private area and protect authenticated requests.
• Public website language preference: when you choose a language, verbale_landing_locale remembers it for one year, only on verbale.ai. It contains no authentication data and does not change your account language. You can delete it in your browser settings; without it, the website's language links still work.

Disabling session cookies may prevent parts of the app from working properly. Disabling the language cookie means the website cannot remember your choice on your next visit.

Technical providers and subprocessors

We use a limited number of technical providers, each for a specific function: object storage on cloud infrastructure in the European Union (Germany); serverless computing for audio and video processing; private routing to language models for summaries; Stripe payment services; and Sentry for receiving, grouping and viewing technical reports from the dashboard and desktop app. Cloudflare provides traffic and performance statistics for the public website.

Data retention

• account data remains linked to the profile while the account is active or as needed to resolve outstanding requests;
• files, transcripts and summaries remain available in the workspace until the user removes the meeting from their account view; this ends account visibility but does not guarantee immediate physical deletion. Physical removal is a separate administrative process; contact info@verbale.ai for erasure requests;
• billing data and security logs may be kept longer where required for tax, accounting or protection of the service;
• dashboard and desktop diagnostic reports received by Sentry are retained for 30 days.