Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for processing your personal data is:

Faruk AB is established in Sweden and is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Swedish Data Protection Act (Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning).

2. What Data We Collect and Why

The table below describes every category of personal data processed by YourVoices, its purpose, legal basis under GDPR, and where it is stored.

3. Where Your Data is Stored

All data is stored within the European Economic Area (EEA):

• Server (Private Box) — hosted on Hetzner Online GmbH, Nuremberg, Germany. Stores your V-ID, voice centroid, public key, and optional profile data.
• Bunker (Object Storage) — hosted on Hetzner Object Storage, Helsinki, Finland. Stores your encrypted messages, media, and call logs. All content is end-to-end encrypted before it leaves your device. We cannot decrypt or access your content.
• Your device — the voice embedding, your private keys, and your PIN-derived encryption key (MonocodeKey) are stored exclusively on your Android device using Android's encrypted storage. They are never transmitted to our servers.

We do not use cloud services outside the EEA for storing personal data. No data is transferred to third countries.

4. How Long We Keep Your Data

• Account data (V-ID, voice centroid, public key, email, profile) — retained for as long as your account is active. Deleted immediately and permanently upon account deletion.
• Bunker content (messages, media, call logs) — retained until you delete individual items or delete your account. Account deletion triggers a complete, permanent purge of all Bunker objects.
• Email address — retained only for the duration of your account. Not used for any purpose other than verification.
• Server access logs — technical logs (IP address, timestamp, request type) are retained for a maximum of 30 days for security monitoring, then deleted.

There are no automatic retention periods that extend beyond account deletion. When you delete your account, all server-side data is permanently erased with no recovery possible.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data to any third party.

The only third parties involved in data processing are our infrastructure providers, acting as data processors under Article 28 GDPR:

• Hetzner Online GmbH (Germany/Finland) — server hosting and object storage. Hetzner processes data only as instructed by us and cannot access encrypted Bunker content.

We may disclose data if required by a valid legal order from a Swedish or EU authority. We will notify you of any such request unless prohibited by law.

Public profile data (display name, photo, bio) is visible to all registered users of the platform by design, as you have explicitly chosen to publish it.

6. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15) — you can request a copy of all personal data we hold about you.
• Right to rectification (Art. 16) — you can correct inaccurate personal data through your account settings at any time.
• Right to erasure (Art. 17) — you can delete your account at any time from within the app. This triggers immediate, permanent deletion of all your data from our servers and Bunker storage.
• Right to data portability (Art. 20) — you can request an export of your personal data in a machine-readable format.
• Right to restrict processing (Art. 18) — in certain circumstances, you can request that we limit how we use your data.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent (voice data, email, profile), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77) — you have the right to lodge a complaint with the Swedish supervisory authority, IMY (www.imy.se).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Biometric Data (Voice)

Voice data is classified as a special category of personal data under Article 9 GDPR (biometric data processed for the purpose of uniquely identifying a natural person).

Processing of voice biometric data is based on your explicit consent (Art. 9(2)(a) GDPR), provided at registration when you record your voice samples. You can withdraw this consent at any time by deleting your account, which removes all voice data from our systems.

We do not use voice data for any purpose other than identity verification within the YourVoices platform. Voice data is never shared with third parties, never used for advertising, and never used to train AI models after your initial embedding is computed.

8. Children's Privacy

YourVoices is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use the app or provide any information through it.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information immediately. If you believe we may have inadvertently collected data from a minor, please contact us at [email protected].

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you within the app.

We encourage you to review this policy periodically. Continued use of YourVoices after changes become effective constitutes your acceptance of the revised policy.

10. Contact & Data Requests

For any privacy-related questions, data access requests, or to exercise your GDPR rights, contact:

If you are not satisfied with our response, you have the right to contact the Swedish Data Protection Authority (IMY) at www.imy.se.