This is an English translation of the Slovenian original, provided for convenience. In case of any discrepancy, the Slovenian version prevails.
1. Controller and scope of this policy
Controller: VITASIS, informacijske tehnologije, d.o.o., Partizanska cesta 8A, 1381 Rakek, Slovenia (“Vitasis”, “we”). Data protection contact: info@vitasis.si.
This policy explains how we process personal data when you use the Truebar™ service and its associated applications (web, mobile and desktop applications, plug-ins and API) or visit the truebar.si website.
Our two roles
As a controller, we process data about your account, subscription and billing, your communication with us, technical usage data and data about website visitors. This policy applies to that data.
As a processor, we process the content you upload to or create in the service: audio and video recordings, transcripts, subtitles, translations and summaries. The controller of this data is the customer (the company or individual using the service), who determines which recordings are processed and why. The processing of this content is governed by the Data Processing Agreement (DPA) between us and the customer.
If you were recorded in a meeting or recording that someone processed with Truebar, please contact the person who made the recording to exercise your rights. If we receive your request directly, we will forward it to them.
2. What data we process, why and on what legal basis
We process data only for the purposes listed below, and we do not sell it.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Account registration and management | First and last name, e-mail address, password (stored in protected form), company | Performance of a contract, Art. 6(1)(b) |
| Provision of the service and billing | Subscription data, minutes used, invoicing data (address, tax number) | Performance of a contract, Art. 6(1)(b) |
| Accounting and taxes | Issued invoices and payments | Legal obligation, Art. 6(1)(c) |
| Support and handling of requests | Content of messages, contact details | Performance of a contract or legitimate interest, Art. 6(1)(b), (f) |
| Service notifications (updates, security, changes to terms) | E-mail address | Performance of a contract, Art. 6(1)(b) |
| News and offers about similar services for existing customers | E-mail address | Legitimate interest with the option to unsubscribe, Art. 6(1)(f) and ZEKom-2 |
| Guides and tips for using the service during the trial period | E-mail address | Legitimate interest with the option to unsubscribe in every message, Art. 6(1)(f) and ZEKom-2 |
| Newsletters for other persons | E-mail address | Consent, Art. 6(1)(a) |
| Security, abuse prevention, troubleshooting | IP address, access time, device and browser type, error logs | Legitimate interest, Art. 6(1)(f) |
| Aggregate usage analysis to improve the service | Anonymised or aggregate data on feature usage | Legitimate interest, Art. 6(1)(f) |
| Website visit analytics (Google Analytics) and ad measurement and targeting (Meta Pixel) | Cookie identifiers, visit and device data | Consent, Art. 6(1)(a) |
Where we rely on legitimate interest, we have balanced our interests against your rights; you may object to the processing at any time (section 5).
We process recording content (audio, transcripts, translations, summaries) as a processor, solely to provide the service in accordance with the customer’s instructions. We do not use it to train or improve artificial intelligence models, and neither do our sub-processors.
Automated decision-making. We do not make decisions based solely on automated processing that would produce legal or similarly significant effects for you. Automatic transcripts and summaries do not constitute such decisions.
3. Who we share data with and where it is processed
The service is hosted in a data centre in Slovenia. For certain features, we use external providers that process data on our behalf, under our instructions and on the basis of a data processing agreement. They are listed below by category:
| Recipient category | Purpose | Data | Processing location |
|---|---|---|---|
| Vitasis’s own models (not a recipient, listed for transparency) | Speech recognition (default in the Enterprise plan) | Audio and transcript | Slovenia (our environment) |
| Hosting provider (data centre) | Hosting the service and storing data | All service data | Slovenia |
| Speech recognition and translation provider | Speech recognition (in the Enterprise plan only at the customer’s choice) and translation | Audio and text; deleted after processing | EU |
| AI summarisation provider | AI summarisation | Transcript text | EU (EEA) |
| E-mail delivery provider | Sending system notifications and trial-period guides and tips | E-mail address, message content | USA (sending via EU region) |
| Payment provider | Processing payments | Payment and card data (we do not store card data) | EU and USA (Stripe, LLC) |
| Google Ireland Ltd. (Google Analytics, Google Tag Manager) | Website visit analytics | Cookie identifiers, visit and device data | EU and USA |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Ad performance measurement and targeting | Cookie identifiers, visit data | EU and USA |
| Accounting service | Accounting | Invoice data | Slovenia |
The names, purposes, processing locations and transfer mechanisms of all sub-processors and other providers are set out in the list of sub-processors at https://truebar.si/subprocessors, which we keep up to date.
In the Enterprise plan, speech recognition is performed by default using Vitasis’s own models, deployed in our environment in a data centre in Slovenia, so audio is not disclosed to third parties for transcription. An Enterprise customer may also choose speech recognition via the external provider that is used for translation in all plans.
Transfers outside the EU. Some sub-processors and other providers have their registered office or parent company in the USA (details are given in the list of sub-processors). Although the speech recognition, translation and AI summarisation providers process content in the EU, limited access from the USA is possible (e.g. for security or technical support). In such cases, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Analytics and advertising pixel data (Google, Meta) may be processed in the USA on the basis of the EU-U.S. Data Privacy Framework. The e-mail delivery provider also processes data in the USA, on the basis of the EU-U.S. Data Privacy Framework, under which it is certified, and Standard Contractual Clauses. The payment provider systematically transfers payment data to Stripe, LLC in the USA, on the basis of Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
Payment provider as an independent controller. For selecting banks and payment method providers, preventing fraud, managing financial and security risks, verifying customers and preventing money laundering, and for developing its own services, the payment provider Stripe processes your data as an independent controller, not on our behalf. That processing is governed by Stripe’s privacy policy, available at stripe.com/privacy.
Other recipients. We may disclose data to public authorities where required by law, or in the event of an acquisition or merger of the company, of which we will notify you in advance. Other users of the service cannot see the customer’s content unless the customer shares it.
4. Data retention
| Data | Retention period |
|---|---|
| Account data | For the lifetime of the account; up to 90 days after closure |
| Content (recordings, transcripts, translations, summaries) | Until deleted by the user or until the subscription ends; thereafter up to 90 days |
| Invoices and accounting data | 10 years after the end of the year of issue, as required by ZDDV-1 |
| Technical logs | 90 days |
| Support correspondence | Until the subscription ends; thereafter up to 30 days |
| E-mail address for guides and newsletters | Until you unsubscribe or until the subscription ends |
We may retain data for longer where required by law or where necessary to establish, exercise or defend legal claims. With external providers, audio for speech recognition and translation is processed in real time and is not stored by default.
5. Your rights
Subject to the conditions of the GDPR, you have the right to:
- access your personal data and obtain a copy;
- rectification of inaccurate data;
- erasure, where we no longer need the data or there is no legal basis for it;
- restriction of processing;
- data portability for data you provided to us on the basis of a contract or consent;
- object to processing based on legitimate interest and, at any time, to direct marketing;
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal.
Send your request to info@vitasis.si. We respond within one month; for complex or numerous requests, we may extend this period by up to two months, in which case we will inform you. To protect your data, we may verify your identity. You can also edit and delete your data and content yourself in your account settings.
Complaints. If you believe we are infringing data protection law, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or with the supervisory authority in the Member State where you reside.
6. Security
We implement technical and organisational measures to protect data, including encrypted transmission (TLS), access control based on the principle of least privilege, access logging and backups. Complete security cannot be guaranteed, but we will notify you of any breach that is likely to result in a high risk to you.
7. Children
The service is not intended for persons under the age of 18, and we do not knowingly collect their data. If we discover that we have collected such data, we will delete it.
8. Cookies
We use strictly necessary cookies and local storage required for signing in and for the operation of the service; no consent is required for these. Strictly necessary cookies also include those of the payment provider Stripe, which are used during payment for security and fraud prevention. We use analytics cookies (Google Analytics) and marketing cookies (Meta Pixel), which we load via Google Tag Manager, only with your prior consent, which you can change at any time in the cookie settings. The list of cookies is available at https://truebar.si/cookies.
9. Links and integrations
The service may contain links to third-party websites or integrations (e.g. Google Drive, OneDrive, Google Meet, Zoom, Microsoft Teams) that you use at your own choice. Their processing of data is governed by their own privacy policies.
Meeting platform integrations
At your choice, the Truebar note-taker can connect to Google Meet, Zoom or Microsoft Teams. When you connect your account (via OAuth), we access only the data needed for the note-taker to function.
We use data from these platforms solely for the operation of the note-taker; we do not sell it or use it for advertising or for training models. You can revoke the authorisation at any time in your account settings or with the platform provider.
The use and transfer of data received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The processing of data by Google, Zoom and Microsoft as platform providers is governed by their own privacy policies.
10. Changes to this policy
We may update this policy. We will notify you of material changes by e-mail or in the application before they take effect. The current version is always published on this page with the date of the last update.
11. Contact
VITASIS, informacijske tehnologije, d.o.o., Partizanska cesta 8A, 1381 Rakek
Data protection: dpo@vitasis.si