Privacy notice
This notice explains what personal information Sibona and Vera collect, why, who else handles it, how long we keep it, and what rights you have. Your rights depend on where you live. Section 10 lists them country by country.
- Who is responsible
- What we collect
- Why we use it, and on what basis
- Health information you write about
- Who else handles it
- Where it goes
- How long we keep it
- Security
- Your rights, and how to use them
- Your rights by country
- Automated safety checks
- Cookies and analytics
- Children
- Complaints
- Changes and contact
1. Who is responsible
The company that runs Sibona and Vera is [COMPANY_LEGAL_NAME], registered in the [COMPANY_JURISDICTION] under number [COMPANY_REGISTRATION_NUMBER], at [COMPANY_PHYSICAL_ADDRESS]. We decide why and how personal information is used to run the Service. In the language of the GDPR, UK GDPR and POPIA, that makes us the controller or responsible party.
Our privacy officer is [PRIVACY_OFFICER]. You can reach the privacy officer at [SUPPORT_EMAIL].
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email address, a name or nickname if your sign-in provides one, the sign-in method you used, the date you joined | You, and Google if you sign in with Google |
| Conversations | The messages you write, Vera’s replies, your conversation history, and the notes and summaries the Service keeps so that Vera can follow the conversation over time | You, and Vera |
| Profile and check-ins | The “About me” answers you give, and the scores of any short self-assessment you choose to answer | You |
| Voice | Voice messages, if you use voice input, which we turn into text | You |
| Health information | Anything you write about your health, mood, sleep, or what a doctor has told you. See section 4 | You |
| Payments | Top-up history, amounts and currency, balance changes, and the last four digits and brand of your card. Stripe holds the full card number, not us | You, and Stripe |
| Consent records | Which consent text you accepted, its version, the date and time, your 18-and-over declaration, and the IP address at that moment | Recorded by the Service when you accept |
| Feedback | Thumbs up or down on an answer, survey answers, and the message they relate to | You |
| Technical | IP address, browser and device type, pages visited, times of visits, error records, and session and device identifiers | Your browser and our servers, automatically |
| Marketing source | The ad, link or search that brought you here: advertising click identifiers (gclid, gbraid, wbraid) and UTM tags, and the page you landed on | Your browser, on your first visit |
| Support | Emails you send us, and our replies | You |
We do not ask you for your national identity number, your medical aid details or your home address beyond what a payment provider needs. Please do not send us those details.
3. Why we use it, and on what basis
- To give you the Service. Creating your account, generating answers and keeping your history. Basis: the agreement with you.
- To check your age and record your consent. Basis: our legal obligations and the agreement with you. For health information, your explicit consent.
- To take payment. Top-ups, your balance, refunds and tax records. Basis: the agreement with you, and legal obligations to keep financial records.
- To keep the Service safe. Automated checks for signs of danger, controls against abuse and fraud. Basis: our legitimate interest in a safe service, and our duty to show crisis lines.
- To improve the Service. Aggregated counts and error reports. We do not use the content of your conversations for this. Basis: our legitimate interest.
- To answer you. Support emails. Basis: the agreement with you, or our legitimate interest in answering questions.
- To understand where visitors come from. Analytics and advertising measurement on public pages, as section 12 describes. Basis: your consent where the law requires it.
We do not sell personal information. We do not share your conversations with advertisers. We do not use your conversations to train our own models.
4. Health information you write about
When you write about how you feel, about sleep, about what a doctor has told you, or about your physical or mental health, that is special or sensitive information in many countries. We ask for your explicit consent before your first message. The consent text is on the health-information consent page. We record the consent version, the date, the time and the IP address.
We use this information to write your replies, to keep your history, and to run automated safety checks. We do not sell it, we do not share it with advertisers, and we do not use it to train our own models.
You can withdraw your consent at any time. Withdrawal does not undo what was lawful before. Because we cannot run the Service without processing what you write, withdrawing closes your account and deletes your conversations. Section 7 explains which consent record we keep afterwards.
5. Who else handles it
We use a small number of providers. Each one works under a written contract that limits it to our instructions and requires appropriate security.
| Provider | What it does | Where |
|---|---|---|
| [HOSTING_PROVIDER] | Servers, database and backups | See section 6 |
| OpenRouter, and the model providers it routes requests to | Generate the replies you read | European Union and United States |
| Speech-to-text provider (DeepInfra) | Turns voice messages into text | United States |
| Text-to-speech provider | Reads replies aloud, if you turn on spoken replies | United States |
| Stripe | Card payments, top-ups, receipts and refunds | United States and Ireland |
| Sign-in with Google. Analytics and advertising measurement on public pages, only as section 12 of the cookie notice allows | United States and other countries | |
| Resend | Sends your one-time sign-in codes, receipts and service emails | United States |
| Firebase Cloud Messaging (Google) | Push notifications in the mobile app, if you install it | United States |
We may also disclose information when the law requires it, or to establish or defend a legal claim. We do not give personal information to anyone for their own marketing.
6. Where it goes
Our company is in the [COMPANY_JURISDICTION]. Our hosting and model providers are in other countries. Your personal information is therefore transferred to and processed in the United Arab Emirates, the European Union and the United States, and possibly in other places where our providers operate.
We use contracts with each provider that require protection comparable to the law that applies to you. Where the law requires a specific transfer tool, such as the EU standard contractual clauses or the UK addendum to them, we use it. Your consent to the processing of health information covers the transfers described here.
7. How long we keep it
The periods below apply unless the law requires something else.
| Information | How long we keep it |
|---|---|
| Conversations | Until you delete them or close your account. A conversation you delete leaves your account at once and is erased from our systems within 30 days. |
| Account details | Until you close your account. Then erased within 30 days. |
| Inactive accounts | If you do not sign in for 24 months, we email you first. If you still do not sign in, we delete the account and its conversations. |
| Payment records and invoices | As long as tax and company law require. Stripe keeps its own records under its terms. |
| Consent records | While your account exists, and for 3 years after it closes, as evidence that consent was given and withdrawn. When the account closes we keep only the consent text version, the date and time, and your answer. The IP address, browser details and marketing source are erased then. |
| Feedback (thumbs and survey answers) | 180 days, then erased. Erased earlier if your account closes. |
| Marketing source | With your account, and erased when it closes. For a visit without an account, 90 days. |
| Recent model requests (debugging) | A short debugging record of recent model requests can contain conversation text. It is kept for a few days and covers only the most recent requests. |
| Security logs | A message that our checks flag is logged with a fingerprint and its length, not its text. |
| Backups | Deleted data leaves our backups within 30 days. |
8. Security
Traffic is encrypted in transit with HTTPS. Data is encrypted at rest by our hosting provider. Sign-in codes expire quickly and can be used once. Access to production systems is limited to a small number of named people, who use multi-factor authentication and are bound by confidentiality.
If a breach affects your personal information, we will notify you and the regulators where the law requires it, within the time that the law sets.
9. Your rights, and how to use them
Most things you can do yourself from the account page: see your conversations, export your data, delete conversations, and close your account.
For anything else, email [SUPPORT_EMAIL] from the address on your account. Depending on your country, you may ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct information that is wrong or incomplete;
- delete your information, or restrict how we use it;
- give your information to you, or to another service, in a common format where the law provides that right;
- object to processing based on our legitimate interests;
- withdraw a consent you gave, at any time, without affecting what was lawful before.
We respond within 30 days, or sooner where the law sets a shorter time. We may ask you to confirm who you are before we act. We do not charge for a request, unless the law allows a fee for a repeated or unfounded request.
We send you service emails only, such as sign-in codes, receipts and notices about these documents. We do not send marketing email at launch.
10. Your rights by country
The rights below are in addition to the rights in section 9. Find the section for the country where you live.
10.1 United States
There is no federal privacy law for this kind of service, but several states have one. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and under similar laws in other states, you can ask what we know about you, get a copy, correct or delete it, and limit how sensitive personal information is used. Health information is sensitive under those laws. You can opt out of the sale of personal information, and of sharing it for cross-context advertising. We do not sell personal information. On public pages we honor the Global Privacy Control signal.
California and New York have specific rules for AI companion chatbots. They are summarized in section 13.1 of the terms of use. We will not offer the Service to residents of Illinois or Nevada, and we will block it there before the Service is offered in the United States.
10.2 Canada
The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our handling of personal information in commercial activity. You can ask for access and correction, and you can complain to the Office of the Privacy Commissioner of Canada.
10.3 Quebec
Under Quebec’s Act respecting the protection of personal information in the private sector (Law 25), you can ask for access to and correction of your information, and for your information in a structured, commonly used format. You can withdraw consent, and you can ask to be told when a decision about you is made only by automated means. Our privacy officer for Quebec is [PRIVACY_OFFICER].
For Quebec residents, tracking and profiling technologies are off by default. Analytics on public pages stays off unless you turn it on. You can complain to the Commission d’accès à l’information du Québec.
10.4 United Kingdom
The UK GDPR and the Data Protection Act 2018 apply. You have the rights in section 9, including the right to complain to the Information Commissioner’s Office (ico.org.uk). Health information is processed on the basis of your explicit consent (section 4). Transfers outside the UK are covered by section 6.
10.5 Ireland and the European Union
The EU General Data Protection Regulation (GDPR) applies to people in Ireland and the rest of the European Union. You have the rights in section 9. You can complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the supervisory authority in your own country. Health information is processed on the basis of your explicit consent (section 4). Transfers outside the EU are covered by section 6.
10.6 Australia
The Privacy Act 1988 and the Australian Privacy Principles apply. You can ask for access to and correction of your information, and you can complain to us first and then to the Office of the Australian Information Commissioner (oaic.gov.au). We follow the Notifiable Data Breaches scheme.
10.7 New Zealand
The Privacy Act 2020 and its information privacy principles apply. You can ask for access to and correction of your information. You can complain to the Office of the Privacy Commissioner (privacy.org.nz). Section 6 explains how we handle disclosures outside New Zealand.
10.8 Singapore
The Personal Data Protection Act 2012 applies. You can ask for access to and correction of your personal data, and you can withdraw consent. You can complain to the Personal Data Protection Commission (pdpc.gov.sg). Our data protection officer is [PRIVACY_OFFICER].
10.9 South Africa
The Protection of Personal Information Act 4 of 2013 (POPIA) applies. You can ask us what personal information we hold, ask us to correct or delete it, object to processing based on our legitimate interests, and withdraw your consent. You can complain to the Information Regulator (inforegulator.org.za). Health information is special personal information under POPIA. We process it with your explicit consent under section 27, which section 4 describes. Transfers are covered by section 6.
10.10 United Arab Emirates
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) applies to our company as a UAE establishment. You can ask for access, correction, erasure, restriction, portability, and to object, and you can withdraw consent. You can complain to the UAE Data Office.
10.11 India
The Digital Personal Data Protection Act 2023 (DPDP Act) applies. You can ask for access to a summary of your personal data, correction and erasure, and you can withdraw consent. You can use our grievance process by emailing [SUPPORT_EMAIL], and if we do not resolve it, you can complain to the Data Protection Board of India. The Service is for people aged 18 and over (section 13).
11. Automated safety checks
We run automated checks on conversations to spot signs that someone may be in danger, and to show crisis lines. A check can interrupt a conversation or change what Vera says next. Checks do not make legal or similarly significant decisions about you. If you think a check treated you wrongly, email us and ask for a person to review it.
12. Cookies and analytics
Cookies and similar storage are described in the cookie notice. In short, the chat uses only the cookies it needs to work. Public pages may use Google Analytics 4 and advertising measurement, as the cookie notice explains. In the EEA, the UK and Switzerland, they load only after you allow them. Elsewhere you can turn them off.
We also count visits and sign-ups on our own servers. These counts use no cookies and never include the text of your conversations.
13. Children
The Service is for people aged 18 and over. We do not knowingly collect personal information from children. If you tell us that a child under 18 has given us information, or we learn that, we delete it. To tell us, email [SUPPORT_EMAIL].
14. Complaints
Please tell us first at [SUPPORT_EMAIL], and we will try to put things right. You can also complain to the regulator for your country, listed in section 10.
15. Changes and contact
We may update this notice. If a change is significant, we tell you by email or in the app before it takes effect. The version and date are at the top of this page. Earlier versions are available on request.
[COMPANY_LEGAL_NAME], [COMPANY_PHYSICAL_ADDRESS], [COMPANY_JURISDICTION]. Email: [SUPPORT_EMAIL].