PRIVACY POLICY

Last updated: October 20, 2026

OVERRIDE SAS ("we", "our", "us") is a French simplified joint-stock company (SAS), publisher of the Voca mobile application ("the application").

This privacy policy describes how we collect, use and protect your data when you use the application. It applies exclusively to the Voca application published by OVERRIDE SAS and available on the Apple App Store.

By using the application, you acknowledge that you have read this policy and consent to the processing of your data as described below. If you do not accept this policy, please do not use the application.

1. DATA COLLECTED

Voca collects and processes the following data, strictly necessary for the operation of the service:

Audio recordings and transcriptions: your voice recordings are sent to our servers, which hand them to Mistral AI, a French company, for transcription. Audio files are deleted from our servers as soon as processing ends, whether the transcription succeeds or fails; a file left behind by an incident is deleted automatically within a few hours. The transcribed text is kept for 48 hours after processing ends, the time your device needs to retrieve it, then deleted. If it fails, a technical error message is kept with the request, for the same length of time.

Audio files on your device: after a successful transcription, the audio file is deleted from your device. If the transcription fails, it is kept there so you can retry, until you retry successfully, keep the text obtained, or delete the note.

AI enhancement and formatting: when you use these features, or automatic formatting, the text concerned is sent to Mistral AI for processing, then deleted from our servers within the same timeframes as transcriptions.

Custom dictionary: the terms you add to your dictionary are sent with each transcription, to improve the recognition of these words. They are kept on our servers with the corresponding transcription, then deleted within the same 48 hours.

iCloud sync: if sync is on (it is by default), your notes and your dictionary, and, if you turn it on, the audio of notes whose transcription failed, are saved in your private iCloud space. This storage is provided by Apple; we have no access to it. You can turn sync off at any time in the application's settings, and delete the copy of your data kept in iCloud from there.

Crash recovery data: during recording, the application temporarily saves the live transcription text on your device to recover your work in case of an unexpected interruption. This data is stored locally and is never transmitted to any server. It is automatically cleared once the recording is processed.

Apple speech recognition: the application uses Apple's speech recognition for real-time display during recording and for offline transcription. This processing may involve Apple's servers, depending on your device settings.

Device identifier: a pseudonymous technical identifier (Device ID), created when Apple App Attest verifies the application, is used to manage your subscription and transcription quota, and to verify request authenticity. It contains neither your name nor any contact information, and is not linked to any user account. The share extension uses a token of its own, tied to that same identifier, which lets it send a transcription without reopening the application.

Technical device data: we associate with this identifier the country, which our host and our subscription manager derive from your IP address and which we update when it changes, the notification token that lets us tell you when a transcription is finished, and, where applicable, a suspension for abusive use.

Usage metadata: for each request, we record its date, type and response code, along with the dictation language and the audio's duration and size. This data is used to track your quota, detect abusive use and keep the service running. It does not contain the content of your transcriptions.

Error reports: when an error occurs in the application or on our servers, the error message, its stack trace, the application version and your device identifier are sent to our error-tracking tool, hosted in Germany. Your audio files are never included. When our transcription provider rejects a request, the report and our servers' technical logs may contain the excerpt of the request it points out, such as a term from your dictionary or a fragment of text.

IP addresses: used in the moment to limit the number of requests and block abuse (bots, automated attempts). Our services do not store them; our host's technical logs may contain them for a few days at most.

Subscription data: your subscription type, its dates and your purchase history are associated with your device identifier. Payments are entirely handled by Apple; we have no access to any banking information.

Contact data: if you contact us by email, we retain your email address and the content of the exchange for the purpose of handling your request.

2. DATA NOT COLLECTED

Voca does not collect any personally identifiable information (name, phone number, postal address). Your email address is only collected if you voluntarily contact us by email.

Your transcriptions are kept permanently on your device and, if you turned sync on, in your iCloud space. Beyond the durations given in section 1, we keep no copy and transmit them to no third party.

Voca does not create user accounts and does not require registration.

Voca does not use any cookies, advertising trackers or behavioral analytics tools. The only third-party tool of this kind is the error tracker described in section 1.

Voca does not share, sell or rent any data to third parties for advertising, commercial or profiling purposes.

Voca does not collect any geolocation data, contacts, photos or other personal data stored on your device.

3. DATA RETENTION

Audio files on our servers: deleted as soon as processing ends, successful or not, and within a few hours at most.

Audio files on your device: deleted after a successful transcription; if it fails, kept until you retry, keep the text or delete the note.

Transcription text and dictionary terms on our servers: 48 hours after processing ends, then deleted.

Notes and dictionary in iCloud: for as long as you keep them there; you can delete this copy from the application's settings.

Crash recovery data: cleared automatically once the recording is processed. Never transmitted.

Usage metadata: 12 months, then deleted automatically.

Technical device data and subscription data: deleted automatically after 12 months without using the service, unless a subscription is running.

Error reports: according to the retention period set in our error-tracking tool.

IP addresses: not stored by our services; a few days at most in our host's technical logs.

You may request deletion of all your data at any time by contacting us.

4. SERVICE PROVIDERS AND DATA TRANSFERS

We rely on the following providers, which process your data on our behalf and only for the purposes described above:

Mistral AI (French company): transcription, enhancement and formatting of texts. Mistral AI processes this data on our behalf, under the terms of its service agreement, and may keep it on its side for a limited period, for security purposes.

Cloudflare (United States, global network): hosting of our servers and database, temporary storage of audio files.

Google Cloud (Belgium): processing of long recordings and of formatting, without storage.

Sentry (hosted in Germany): error tracking.

RevenueCat (United States): subscription management.

Apple (United States): App Store payments, application verification (App Attest), notifications, speech recognition and iCloud.

Some of these providers are based in the United States, or may process data outside the European Union. These transfers are covered by the safeguards provided for by the GDPR.

5. THIRD-PARTY LIABILITY

We carefully select our service providers and ensure they offer sufficient data protection guarantees. However, once your data is transmitted to a third-party service as part of the processing described above, that service applies its own privacy policy. We cannot be held responsible for processing carried out by these third parties beyond what is contractually agreed.

6. YOUR RIGHTS

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: obtain a copy of your personal data

Right to rectification: correct inaccurate data

Right to erasure: request deletion of your data

Right to data portability: receive your data in a structured format

Right to object: oppose the processing of your data

Right to restriction: restrict the processing of your data

To exercise these rights, contact us at: [email protected], including the identifier shown in the application's settings. We commit to responding within 30 days.

In case of dispute, you may file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr.

7. SECURITY

Communications between the application and our servers are encrypted via HTTPS/TLS. Request authentication is provided by Apple App Attest, a cryptographic mechanism that ensures only the legitimate application can communicate with our servers.

On your device, your notes are encrypted by iOS. Audio files kept after processing benefit from iOS's strengthened protection: they stay unreadable while the device is locked.

8. CHILDREN

The application is not intended for children under 16 years of age. We do not knowingly collect data from minors.

9. CHANGES

We reserve the right to modify this policy. The last updated date at the top of this document shall prevail. By continuing to use the application after a modification, you accept the revised policy.