Privacy Policy

Protecting your privacy is a core principle at Nonverbia. This document outlines how we collect, utilize, and secure personal information across our platform and services.

The Nonverbia platform is a sophisticated cloud solution that integrates with your business video communications and related workflows. Our system captures meeting recordings (when authorized), creates transcripts, and performs comprehensive analysis of spoken dialogue and behavioral patterns, delivering intelligence through reports, metrics, visual dashboards, and strategic recommendations (referred to collectively as the "Service"). Safeguarding privacy stands at the foundation of our business model. Within this Policy, we explain the information we gather, our reasons for processing it, how we distribute it, and what control mechanisms are available to you.

This Policy applies to the Nonverbia platform, our website, and our mobile applications for iOS and Android (collectively, the "Service").

By accessing our Service or website, you confirm that you have examined and accept both this Policy and our Terms & Conditions. If these terms are unacceptable to you, you should refrain from using our Service.

1. Coverage & Responsibility Framework #

We handle three primary classifications of personal information:

Business Client Data #

All content and accompanying metadata that commercial clients link to our Service, such as: video/audio meeting recordings, screen-shared materials, text-based chat exchanges, transcribed conversations, meeting identifiers, participant rosters, CRM-linked information, and file attachments.

Responsibility Structure: For Business Client Data, our commercial client serves as the controller (or "business" per US state privacy frameworks), with Nonverbia acting as the processor/service provider under their direction.

Active User Records #

Records concerning individuals actively engaging with our platform: registration details, access credentials, connection parameters, usage patterns, and support request histories.

Responsibility Structure: For Active User Records contained within Business Client Data, we operate as a processor. For records related to platform infrastructure, user verification, financial transactions, threat detection, and analytics, we function as an autonomous controller.

Prospect & Web Traffic Data #

Information gathered from site visitors, potential clients, conference participants, and professional contacts: web behavior analytics, tracking technology data, promotional interaction records, and business profile information.

Responsibility Structure: Autonomous controller status.

Nothing in this Policy transfers ownership of Business Client Data to Nonverbia. Complete ownership remains vested in the client organization.

2. Data Collection Practices #

2.1 Business Client Data (supplied by clients or retrieved via system connections) #

• Primary Meeting Materials: Captured audio/video streams (where recording permissions exist), displayed screen content, in-call messaging, distributed files, and slide presentations.
• Mobile audio capture: When you use our mobile applications, meeting audio is recorded using your device's microphone (with your permission, and only where recording is authorized) and securely uploaded to our processors for transcription and analysis. You can grant or revoke microphone access at any time in your device settings; revoking it disables in-app recording.
• Generated Intelligence: Automated transcripts, condensed summaries, participation metrics, and behavioral pattern analysis including dialogue flow, attention tracking, and physical gesture recognition.
• Session Metadata: Meeting labels, scheduler information, attendee directories, convener details, temporal records, platform identifiers, and technical service logs.

2.2 Active User Records #

• Registration Data: Complete name, email contact, position title, company association, and optional visual profile elements.
• Authentication: You may sign in using third-party providers — Google, Apple, or Microsoft — via Firebase Authentication. We receive basic profile identifiers (name, email) from the chosen provider to create and secure your account.
• System & Activity Logs: Network identifiers, hardware/software specifications, regional settings, capability usage tracking, session recordings (supporting platform enhancement and issue resolution), crash and error diagnostics, and security event logs.
• Service Assistance Records: Exchanges with support personnel, including captured sessions from training or troubleshooting interactions.

2.3 Prospect & Web Traffic Data #

• Professional Identity Information: Work-related contact channels, employer identification, functional role, and outreach preferences.
• Campaign Engagement Metrics: Site navigation trails, origin sources, tracking codes, message response data, and advertising interaction patterns.
• Technical Monitoring Tools: Information obtained through browser cookies, tracking pixels, mobile SDKs, and equivalent technologies supporting analytics, security, and promotional activities (elaborated in §8).

2.4 Collection Origins #

Data flows from diverse channels: your direct inputs and those of authorized users; conferencing platforms like Zoom, Google Meet, and Microsoft Teams; connected external systems including customer relationship tools; your organizational vendors; analytics infrastructure; monitoring technologies; publicly accessible databases; and collaborative partners (within legal and contractual boundaries).

3. Usage Rationales & Legal Justifications #

3.1 Business Client Data Handling (processor operations) #

• Execute, maintain, protect, assist, and refine Service capabilities for client organizations.
• Produce intelligence deliverables including transcripts, condensed narratives, analytical dashboards, and participation assessments.
• Conduct diagnostic work, identify misuse patterns, and sustain system reliability.

Legal Justification: Fulfillment of contractual obligations per GDPR Article 6(1)(b); legitimate operational interests in security and quality assurance per Article 6(1)(f); execution pursuant to documented client authorization.

3.2 Active User Records & Prospect Data Handling (controller operations) #

• Platform Management: User provisioning, identity verification, revenue collection, and operational notifications.
• Threat Prevention: Attack detection, security response, audit trail maintenance, and vulnerability mitigation.
• Enhancement Initiatives: Behavioral analysis for identifying usage patterns, enhancement opportunities, and performance optimization.
• Client Enablement: Request resolution, implementation guidance, and educational delivery.
• Promotional Activities: Release announcements and offer distribution, effectiveness tracking, and preference adherence.
• Regulatory Adherence: Revenue reporting, bookkeeping, statutory requirements, and conflict resolution.

Legal Justifications: Contract execution requirements; legitimate operational necessities for platform administration, protection, and advancement; user consent where mandated (such as specific tracking technologies and promotional communications within the EEA); statutory and regulatory mandates.

3.3 Algorithm Training & Boundaries #

We may leverage anonymized and/or aggregated datasets for platform advancement, encompassing algorithm refinement, analytical technique optimization, and system performance enhancement.

Identifiable Business Client Data will not support our independent algorithm development activities without explicit client authorization via opt-in mechanisms.

Google Workspace Constraints: Information accessed via Google APIs adheres to Google's API Services User Data Policy and Limited Use specifications. Gmail-sourced data never supports generalized algorithm training, promotional purposes, or third-party distribution.

3.4 Computational Decision Systems #

Our analytical outputs derive from computational processing. We avoid biometric identification methodologies. We refrain from exclusively algorithmic decisions producing legal consequences or substantial individual impacts without incorporating appropriate protective measures and human review mechanisms.

4. Participant Awareness Mechanisms #

When platform capabilities permit, we activate visible presence signals (such as notification banners, entry announcements, or visible bot attendees) alerting participants to our platform's involvement.

Client Communication Duties: Clients must deliver explicit preliminary warnings to participants and secure all mandatory permissions under relevant legislation (encompassing GDPR, ePrivacy frameworks, and US jurisdictional recording regulations). When platform constraints prevent our presence indicators, clients bear complete responsibility for participant communication and authorization acquisition.

5. Data Distribution Framework #

We reject commercial sale of personal information. We prohibit personal information sharing for cross-contextual behavioral targeting per California Privacy Rights Act definitions. Should operational practices evolve, we will deploy mandated opt-out capabilities including Global Privacy Control signal recognition.

Information distribution occurs exclusively with these recipient categories:

• Technical Service Partners: External organizations supporting delivery operations—infrastructure provision, information storage, distribution networks, error detection, protection services, voice recognition, behavioral assessment, transaction processing, assistance platforms, messaging infrastructure, relationship management systems, and behavioral analytics. These partners operate under enforceable confidentiality and protection requirements; we retain accountability for their actions.
• Client-Selected Connections: Systems you elect to integrate (including relationship management platforms, file repositories, and collaboration tools). Information transferred to these systems follows their governing terms and privacy frameworks.
• Organizational Users: Access within client environments follows configured permission structures and assigned role authorities.
• Transaction Participants: Entities involved in organizational combinations, capital events, or asset dispositions, maintaining this Policy's protective framework.
• Governmental Bodies: When we reasonably determine disclosure aligns with legal mandates, valid procedural requirements, or protection of rights, security, and platform integrity.
• Statistical Data Recipients: Compiled and anonymized datasets incapable of identifying specific individuals or client organizations.

6. International Information Movement #

Nonverbia.com s.r.o. operates from the Czech Republic within the European Union and may handle personal information across EU territories, United States locations, and additional jurisdictions. For information transfers departing the EEA, UK, or Switzerland toward territories without adequacy recognition, we employ authorized mechanisms including EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) incorporating UK International Data Transfer Addendum and Swiss adaptations, reinforced by technical and organizational protections (including cryptographic safeguards and access limitation protocols).

7. Protection Mechanisms #

We deploy extensive technical and organizational protection protocols engineered to defend personal information and Business Client Data against illicit access, inadvertent loss, unauthorized destruction, modification, or exposure. Our protection framework encompasses cryptographic protocols for transmission and storage, identity verification and authorization systems, persistent monitoring and logging infrastructure, redundancy mechanisms, weakness identification and correction processes, and protected development methodologies. Despite industry-standard implementations, absolute protection against all potential threats cannot be assured.

Incident Communication Protocol: Upon identifying a personal information breach impacting your data, we will alert the affected client promptly and within 48 hours of discovery, delivering accessible details concerning incident characteristics, anticipated impacts, and executed countermeasures, with continuing updates as intelligence develops.

8. Tracking Technology Deployment #

Cookies on this website (nonverbia.com)

When you first visit our website, a consent banner lets you accept or reject optional cookies by category. Optional cookies are off by default and are set only after you opt in. You can change or withdraw your choice at any time via the "Cookie settings" link in the website footer — withdrawing consent is as easy as giving it. We ask again roughly every 6 months, or sooner if our use of cookies changes.

Cookies we set:

• nv-consent (first-party, strictly necessary) — stores your cookie preferences for this website. Expires after 182 days. As a strictly necessary cookie it does not require consent; the legal basis is our legitimate interest in honoring your choice.
• Cloudflare Turnstile (strictly necessary) — protects the sign-up form against bots. It is a privacy-preserving alternative to CAPTCHA and does not track you across sites. Our hosting provider, Cloudflare, may also set operational security cookies (e.g. __cf_bm).

Analytics on this website (loaded only with your consent):

• PostHog (analytics) — product analytics hosted in the EU. Loads only after you allow analytics cookies; sets first-party cookies (ph_*, up to 12 months) and local storage to distinguish visitors. See PostHog's privacy policy: https://posthog.com/privacy
• Google Tag Manager (analytics/marketing) — loads only after you allow analytics or marketing cookies, and runs in Google Consent Mode: its tags may set Google cookies (e.g. _ga, _gcl_au) only for the categories you allowed. See Google's Privacy Policy: https://policies.google.com/privacy

Third-party content loaded only with your consent:

• Google Calendar appointment booking (functional) — the booking calendar on our sign-up page is embedded from Google and sets Google cookies when it loads. We load it only after you allow functional cookies. See Google's Privacy Policy: https://policies.google.com/privacy
• YouTube video player — product videos are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com) and load only after you press play; no cookies are set until playback starts.

In our product and mobile applications

In the Nonverbia application and our mobile apps, we and our technical partners additionally use cookies, development kits, and comparable tracking mechanisms for several objectives:

• Core Platform Operations: Identity verification, session continuity, and threat mitigation.
• Performance Analysis: Pattern identification and enhancement through instruments including Google Analytics, Mixpanel, PostHog, and interaction recording systems.
• Stability & Error Monitoring: Crash and error diagnostics through Sentry, supporting reliability assurance and issue resolution.
• Internal Campaign Assessment: Evaluating our promotional initiative effectiveness.

Mobile product analytics: Our mobile applications use PostHog to understand feature usage and improve the app. It processes device and diagnostic identifiers, with your account email as the analytics identifier — never for advertising or cross-app tracking.

Mobile crash & error reporting: Our mobile applications use Sentry to capture crashes and handled errors. Reports contain device, diagnostic, and technical failure details, linked to your account email when signed in — used solely for app stability, never for advertising or cross-app tracking.

Within territories mandating preliminary authorization (encompassing EEA and UK), we obtain user permission through consent interfaces. Users may adjust preferences via consent controls and browser configurations. Blocking certain tracking technologies may constrain platform capabilities. We acknowledge Global Privacy Control signals where jurisdictionally applicable.

External Opt-Out Mechanisms:

• Google Analytics: https://tools.google.com/dlpage/gaoptout
• Mixpanel: https://mixpanel.com/optout
• Mouseflow: https://mouseflow.com/opt-out
• PostHog: managed via in-app/account controls and support@nonverbia.com
• Sentry (crash reporting): managed via support@nonverbia.com

9. Information Preservation Timeframes #

Business Client Data #

Preservation aligns with client-determined parameters and directives. Standard provisions permit clients to extract Business Client Data and generated Intelligence (via formats including MP4, WAV, VTT, CSV, JSON, PDF) during subscription validity and for 30 days post-conclusion. Following this retrieval window, we eliminate or permanently anonymize remaining Business Client Data and Intelligence absent legal preservation mandates. Archive systems retire per our defined rotation protocols.

Active User Records / Prospect & Web Traffic Data #

Maintained throughout periods necessary for Service provision, statutory compliance, dispute adjudication, and agreement enforcement, followed by elimination or anonymization under our preservation framework.

10. Individual Entitlements & Exercise Procedures #

Contingent upon governing regulations, individuals may possess entitlements including: information access, correction of errors, data elimination, processing limitations, processing objections, and information portability (per GDPR), alongside knowledge rights, deletion rights, correction rights, and sensitive information usage restrictions without discriminatory consequences (per CPRA). For consent-dependent processing, individuals may revoke authorization prospectively without invalidating prior lawful processing.

For Participants & End Users: When your information resides within Business Client Data, direct entitlement requests toward the applicable commercial client (functioning as controller). We process such information following client directives and will support clients in fulfilling their legal responsibilities.

For Nonverbia-Controlled Data: Regarding platform administration, financial matters, or promotional/website data, transmit requests to privacy@nonverbia.com. We may seek verification credentials to authenticate your identity and will respond within legally prescribed intervals.

Account Deletion: You can request deletion of your account and associated Active User Records at any time by emailing support@nonverbia.com, or directly within the mobile app (Profile → Delete Account). Deleting your account removes your registration details, access credentials, and associated usage records, subject to any data we must retain for legal, billing, or security purposes as described in §9. Business Client Data (such as meeting recordings and generated Intelligence) is handled per the controlling client organization's instructions and retention settings.

Communication settings can be modified through platform controls or via unsubscribe mechanisms in promotional messages. Critical operational communications (including security advisories and financial notifications) remain mandatory during active account status.

11. Auxiliary Processor Administration & Challenge Mechanisms #

We contract with rigorously evaluated auxiliary processors bound by contractual terms establishing data protection duties matching or exceeding our own standards. We preserve an accessible auxiliary processor registry and deliver clients minimum 15-day preliminary notification when introducing new processors. When clients raise legitimate data protection objections to newly introduced processors, we pursue collaborative resolution; absent resolution, clients may discontinue affected Service elements and obtain proportional reimbursement for prepaid unutilized periods.

12. Minor Protection Standards #

Our Service targets professional business applications and excludes direction toward individuals below 16 years. We deliberately avoid collecting information from minors. Should you identify minor-sourced information in our systems, immediate notification enables us to implement appropriate corrective measures.

13. Geographic-Specific Provisions #

European Economic Area, European Union & United Kingdom #

Individuals retain the entitlement to file grievances with territorial data protection oversight bodies. Within the Czech Republic, the designated authority is the Úřad pro ochranu osobních údajů (Personal Data Protection Office).

US (California and similar laws) #

Regarding Business Client Data, we operate as Service Provider/Processor under California and comparable state privacy legislation. We reject commercial sale or cross-contextual behavioral targeting information sharing. We honor relevant privacy entitlements and privacy control signals (encompassing Global Privacy Control) and will establish supplementary mechanisms should practices transform.

14. Policy Evolution #

We maintain authority to revise this Policy periodically. Substantive modifications receive communication via email or platform notification minimum 30 days preceding effectiveness, except where abbreviated timelines are legally mandated or security circumstances demand urgency. Continued Service utilization following modification effectiveness constitutes revised Policy acceptance.

15. Communication Channels #

• Privacy matters & entitlement requests: privacy@nonverbia.com
• Account deletion requests: support@nonverbia.com
• General assistance: support@nonverbia.com
• Physical correspondence: Nonverbia.com s.r.o., Na příkopě 857/18, Nové Město, 110 00 Praha, Czech Republic

16. Obligation Overview #

Nonverbia Undertakings: #

Activate presence signals where platforms enable; handle Business Client Data exclusively per client instructions; deploy robust protective mechanisms; deliver breach alerts within 48 hours; apply anonymized/aggregated datasets for advancement; abstain from commercial information sale or cross-contextual behavioral targeting sharing; exclude identifiable Business Client Data from algorithm training absent explicit client authorization; and maintain Standard Contractual Clause compliance for international movements.

Client Undertakings: #

Supply legally sufficient participant communications and secure mandatory authorizations; establish appropriate preservation parameters and access governance; avoid special category data submission absent lawful justification and necessity; and address data subject entitlement requests concerning Business Client Data.