Privacy Policy

PRIVACY POLICY

Last updated: April 28, 2026

OVERRIDE SAS ("we", "our", "us") is a French simplified joint-stock company (SAS), publisher of the Voca mobile application ("the application").

This privacy policy describes how we collect, use and protect your data when you use the application. It applies exclusively to the Voca application published by OVERRIDE SAS and available on the Apple App Store.

By using the application, you acknowledge that you have read this policy and consent to the processing of your data as described below. If you do not accept this policy, please do not use the application.

1. DATA COLLECTED

Voca collects and processes the following data, strictly necessary for the operation of the service:

Audio recordings and transcriptions: your voice recordings are transmitted to our server, which immediately forwards them to Mistral AI (France) for transcription and formatting. Audio files and transcription text are never stored on our servers: they transit in memory and are discarded as soon as the response is received. On your device, audio files are deleted immediately after a successful transcription. If the cloud transcription fails, the audio file is kept locally on your device for up to 7 days to allow you to retry the transcription. After 7 days, it is automatically deleted.

Crash recovery data: during recording, the application temporarily saves the live transcription text on your device to recover your work in case of an unexpected interruption. This data is stored locally and is never transmitted to any server. It is automatically cleared once the recording is processed.

Apple speech recognition: the application uses Apple's speech recognition for real-time display during recording, local mode transcription, and fallback when the cloud service is unavailable. This processing may involve Apple's servers, depending on your device settings.

Device identifier: an anonymous technical identifier (Device ID), generated by Apple App Attest, is used to manage your transcription quota and verify request authenticity. This identifier does not allow personal identification and is not linked to any user account.

Usage metadata: for each transcription, we record the audio duration, request type and response code. This data is used solely for quota tracking and service operation. The content of your transcriptions is never recorded on our servers.

IP addresses: temporarily used to detect and block abusive requests (bots, automated attempts). They expire automatically after one hour and are not retained.

Subscription data: plan type and billing period dates are associated with your device identifier. Financial transactions are entirely managed by Apple; we have no access to any banking or payment information.

Contact data: if you contact us by email, we retain your email address and the content of the exchange for the purpose of handling your request.

2. DATA NOT COLLECTED

Voca does not collect any personally identifiable information (name, phone number, postal address). Your email address is only collected if you voluntarily contact us by email.

Your transcriptions are stored exclusively on your device. We do not have access to them and do not transmit them to any third party.

Voca does not create user accounts and does not require registration.

Voca does not use any cookies, advertising trackers, behavioral analytics tools, or data collection SDKs.

Voca does not share, sell or rent any data to third parties for advertising, commercial or profiling purposes.

Voca does not collect any geolocation data, contacts, photos or other personal data stored on your device.

3. DATA RETENTION

Audio files (successful transcription): deleted immediately on your device and never stored on our servers.

Audio files (failed transcription): kept locally on your device for up to 7 days to allow retranscription, then automatically deleted. Never stored on our servers.

Crash recovery data: cleared automatically once the recording is processed. Never transmitted.

Usage metadata (audio duration, request type): retained as long as your device account is active, for quota tracking.

Subscription data: retained as long as your subscription is active, then deleted upon request.

IP addresses: automatic expiration after one hour.

You may request deletion of all your data at any time by contacting us.

4. INTERNATIONAL DATA TRANSFERS

Your audio recordings are processed by Mistral AI, whose servers are located in France. Apple's speech recognition may involve processing on Apple's servers (United States), depending on your device settings. Some third-party services are based in the United States and may process technical data (device identifier, subscription information) outside the European Union, under contractual safeguards compliant with the GDPR (European Commission standard contractual clauses).

5. THIRD-PARTY LIABILITY

We carefully select our service providers and ensure they offer sufficient data protection guarantees. However, once your data is transmitted to a third-party service as part of the processing described above, that service applies its own privacy policy. We cannot be held responsible for processing carried out by these third parties beyond what is contractually agreed.

6. YOUR RIGHTS

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: obtain a copy of your personal data

Right to rectification: correct inaccurate data

Right to erasure: request deletion of your data

Right to data portability: receive your data in a structured format

Right to object: oppose the processing of your data

Right to restriction: restrict the processing of your data

To exercise these rights, contact us at: [email protected]. We commit to responding within 30 days.

In case of dispute, you may file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr.

7. SECURITY

Communications between the application and our servers are encrypted via HTTPS/TLS. Request authentication is provided by Apple App Attest, a cryptographic mechanism that ensures only the legitimate application can communicate with our servers.

8. CHILDREN

The application is not intended for children under 16 years of age. We do not knowingly collect data from minors.

9. CHANGES

We reserve the right to modify this policy. The last updated date at the top of this document shall prevail. By continuing to use the application after a modification, you accept the revised policy.