Privacy Policy

Summary

Verso stores your email and the progress data you generate by using the app (stories read, scenes watched, words saved, lessons completed, chat conversations). We don't sell your data, we don't show ads, and we don't share your data with advertisers.

Data controller

The data controller responsible for your personal data is:

Danial Moafi
Siena, Italy
Contact: info@get-verso.org

If you have a P.IVA (VAT registration) it should appear here. Until then, the controller is the natural person named above operating as a ditta individuale.

What we collect

Account data: email address (used for sign-in), display name (optional). You can also use Verso without an account; we then create an anonymous account identified only by a random ID.

Learning state: which stories you've finished, which podcasts you've listened to, which Describe scenes you've viewed, the words you've saved, your SRS card schedule, your CEFR level, tutor lessons completed, XP, streak, daily/weekly minute counters.

Tutor lessons and voice: in a tutor lesson you can answer by speaking. Each answer is recorded on your device and sent to be transcribed so the tutor can reply (see OpenAI below). We do not keep the recording or the transcript; we keep how long the lesson ran, how many answers hit the lesson's targets, and usage counts used for the free-tier limit. If you report a tutor line, we store that line so a person can review it.

Chat conversations: when you use the chat practice feature, the Italian messages you send and the assistant's replies are stored in your account so you can resume conversations and review past sessions. See "Third-party services" below for how messages are processed.

Notifications: if you allow notifications, we store your device's push token, your time zone and the hours of day you usually practise, so reminders arrive at a useful time. We record when a notification was sent and opened.

Telegram (optional): if you connect Telegram from Profile, we store your Telegram chat ID and first name so Olo can send you practice messages there, plus the messages you exchange with the Verso bot. We never ask for your phone number. You can disconnect at any time in Profile.

App usage: app version, iOS version, and in-app events such as a lesson started or a scene watched, linked to your account ID and a random install ID. We use them only to improve Verso; they are never shared with advertisers. We do not collect device location, advertising identifiers, contacts, or any data unrelated to the learning experience.

Legal basis for processing

Under Article 6(1) GDPR, we process your data on these bases:

• Contract performance (Art. 6(1)(b)) — for your account, learning state, and any subscription you purchase. Without this data we cannot provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — for security logging, abuse prevention, and aggregate, anonymized service-improvement metrics. You can object to this processing at any time via the contact email below.
• Legal obligation (Art. 6(1)(c)) — for any data we are required to retain (e.g., tax records once subscriptions are live).

Where it's stored

Your account data and learning state are hosted on Supabase (PostgreSQL database + object storage) in the European Union (Frankfurt region). Access is restricted by row-level security policies — only you and our automated systems can read your row. Chat messages are also stored in this EU database, but each message you send is transmitted to OpenAI in the United States for processing — see "Third-party services" below for the safeguards that apply to that transfer. Tutor lessons are not stored as transcripts.

Third-party services

• Supabase — database, auth, storage. Privacy policy at supabase.com/privacy.
• OpenAI — generates the assistant replies in chat practice and your tutor's side of a lesson, and transcribes what you say to the tutor. Your chat messages are sent to OpenAI's API (api.openai.com) and the reply is returned to your device and saved to your account. In a tutor lesson, a recording of each thing you say is sent to be transcribed, and the transcript is sent on to generate your tutor's reply; neither is kept by us afterwards. Per OpenAI's API data policy, prompts, completions and audio submitted via the API are not used to train OpenAI's models and are retained for at most 30 days for abuse monitoring. OpenAI processes this data in the United States under the EU Standard Contractual Clauses.
• ElevenLabs — generates the native-Italian audio. For podcasts, Describe scenes and tutor lessons it is mostly rendered ahead of time from our own scripts; in tutor conversations some replies are synthesised as the lesson runs, from text our server writes. ElevenLabs only ever receives our words, never your recordings or anything you typed.
• Stripe — processes subscriptions bought on the web app (app.get-verso.org) and is the merchant of record for them, which means it collects payment and handles VAT. Stripe receives your payment details and email address; we never see your card number. Privacy policy at stripe.com/privacy.
• RevenueCat — manages your subscription state. Receives an anonymous app-user ID and your purchase events, no learning content.
• Apple / Google Sign-in — only used to verify your identity. The provider sees that you used Verso to sign in but receives no learning data.
• Pexels — Describe scene video footage. Pexels does not see who is watching.
• Telegram — only if you connect it. Practice messages are delivered through Telegram's Bot API, so Telegram processes those messages under its own privacy policy.
• Apple Push Notification service — delivers notifications to your device using its push token.
• Cloudflare — hosts our websites (get-verso.org and app.get-verso.org). On these websites, Cloudflare Web Analytics counts visits without cookies and without identifying you: it records the page, the site you came from, your browser and device type, and your approximate country. It is not used in the iPhone app.
• Sentry — receives crash and error reports (device model, OS version, app version, the error and your account ID) so we can fix bugs. No learning content. Hosted in the EU.

Apart from Cloudflare Web Analytics on our websites, we do not use third-party analytics, advertising, or attribution services.

How long we keep it

• Active accounts: we keep your data for as long as your account exists.
• After account deletion: your account row and all linked learning data are removed within 30 days. Backups are retained up to 30 additional days for disaster recovery, then purged.
• Anonymized aggregate metrics (no identifiers): may be retained indefinitely for service improvement.
• Legal/tax records (when subscriptions are active): retained for the period required by Italian law (typically 10 years for accounting records).

Your rights

Under GDPR Articles 15–22, you have the right to:

• Access and export your data: contact us and we'll send your full payload as JSON within 30 days.
• Delete your account: tap Profile → Delete account in the app (without an account: Profile → Delete my data). Removal is immediate (subject to the backup window above).
• Correct your data: change your display name in Profile, or contact us for other fields.
• Object to processing based on legitimate interest, or restrict processing in certain cases.
• Portability: receive your data in a structured, machine-readable format (JSON).
• Lodge a complaint with the Italian data protection authority: Garante per la protezione dei dati personali — garanteprivacy.it. You can also complain to your local EU supervisory authority.

Children

Verso is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe we have collected such data, contact us and we'll delete it.

Changes to this policy

We'll update this date and the in-app text when we change the policy. Material changes will also be communicated via email.

Contact

Questions or requests: info@get-verso.org.