Vakyya Privacy Policy

Effective Date: 31 January 2026
Last Updated: 11 May 2026

1. Introduction

This Privacy Policy explains how Parakletos AI Limited ("Company", "we", "us", or "our"), a company registered in England and Wales (Company Number: 16504323), collects, uses, stores, and protects your personal data when you use the Vakyya application and related services (the "Service").

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

Registered Address:
First Floor, 85 Great Portland Street
London W1W 7LT
United Kingdom

Data Protection Contact:
Email: gdpr@vakyya.com
Postal Address: First Floor, 85 Great Portland Street, London W1W 7LT

2. Data Controller

Parakletos AI Limited is the data controller responsible for your personal data. This means we determine the purposes and means of processing your personal data in connection with the Service.

2.1 Organisational Use

If you use Vakyya on behalf of an organisation, your organisation is the data controller for any Content uploaded (including any third-party personal data contained within that Content), and Parakletos AI Limited acts as a data processor on behalf of your organisation for that Content. In such cases, your organisation's privacy policy governs the processing of personal data within uploaded Content. Organisations requiring a Data Processing Agreement should contact gdpr@vakyya.com.

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Identity Data

3.2 Media Data

Note: Media files are processed temporarily and automatically purged according to our retention schedule (see Section 7). Content you upload may contain third-party personal data (such as voices or images of other people); you are responsible for ensuring you have a lawful basis to process such data.

We do not process voice or audio data for the purpose of uniquely identifying a natural person, and accordingly do not process special category biometric data within the meaning of UK GDPR Article 9.

3.3 Billing Data

Important: Sensitive payment information (such as credit card numbers, bank account details, or CVV codes) is never stored on our systems. All payment processing is handled exclusively by our third-party payment processors (Stripe, Apple, Google) under their respective security standards.

3.4 Analytics and Technical Data

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

4.1 Performance of Contract (Article 6(1)(b))

Processing necessary to provide the Service to you, including account management, content processing, and subscription management.

4.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate business interests, including service improvement and analytics, security and fraud prevention, and technical support and troubleshooting.

We have conducted legitimate interest assessments to ensure your rights and freedoms are not overridden.

4.3 Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations, including maintaining financial records for tax and regulatory requirements.

4.4 Consent (Article 6(1)(a))

Where required, we obtain your explicit consent for specific processing activities, such as non-essential analytics cookies. You may withdraw consent at any time by contacting gdpr@vakyya.com or adjusting your preferences in the app settings.

5. How We Use Your Data

We use your personal data for the following purposes:

Service Delivery: To provide transcription, captioning, and translation services; to manage your account and subscriptions; and to process payments and issue receipts.

Service Improvement: To analyse usage patterns and optimise performance; to identify and fix bugs and technical issues; and to develop new features and capabilities.

Communication: To send service-related notifications; to respond to support requests; and to provide updates about changes to the Service or these policies.

Security: To prevent fraud and abuse; to enforce our Terms of Service; and to protect the rights and safety of users.

Legal Compliance: To maintain records as required by law and to respond to legal requests from authorities.

5.1 Marketing Communications

Where you sign up to our mailing list (for example, via the "Get on the next invitation list" form on our website), we will send you product updates and announcements relating to Vakyya on the basis of your consent under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR. We may also send service-related transactional emails (such as receipts, security alerts, and material policy changes) on the basis of contract performance and legitimate interests; these are not marketing and cannot be opted out of while you hold an active account. You can withdraw marketing consent at any time by clicking "unsubscribe" in any marketing email or by emailing gdpr@vakyya.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

6. Data Storage and Security

6.1 Storage Locations

Your data is stored on Google Cloud Platform (GCP) infrastructure. To ensure compliance with UK and EU data protection requirements, we use the following primary regions:

6.2 Content Delivery and Edge Processing

Media artifacts may be cached at edge locations via Cloudflare's content delivery network to provide faster playback and download speeds. This means your content may be temporarily processed or cached at Cloudflare data centres globally, including locations outside the UK/EEA. Cloudflare operates under strict data protection agreements (including Standard Contractual Clauses) and maintains appropriate certifications. Metadata and access logs processed by Cloudflare may also be stored in accordance with their data processing terms.

6.3 Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/SSL) and at rest, access controls and authentication, regular security assessments, and incident response procedures.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

7.1 Account Deletion

When you request account deletion, we initiate a 30-day purge cycle. During this period, your account is deactivated. After 30 days, your personal data and content are permanently deleted from our active systems.

7.2 Backups, Caches, and Legal Holds

Deletion from backup systems may take up to an additional 30 days following the purge cycle. CDN caches typically expire within 24-72 hours but may persist briefly longer. Where we are required to retain data due to legal holds, regulatory requests, or ongoing disputes, we will retain the minimum necessary data for the required period.

7.3 Automated Purging

Our systems employ automated processes (cron jobs) to ensure media artifacts are purged 30 days after job completion, maintaining data minimisation principles.

8. Third-Party Data Processors

We share your data with the following categories of third-party processors, all of whom are contractually bound to protect your data:

8.1 AI Processing

Vakyya combines self-hosted AI models with selected third-party AI providers depending on the task and language pair. Where we use third-party providers, they act as data processors on our behalf and are contractually prohibited from using your Content to train their own models.

Transcription. Audio transcription is performed on Parakletos AI Limited's own infrastructure using Whisper models of various sizes. Audio content is not transmitted to any third party for transcription.

Translation. Depending on the language pair and quality tier selected, translation is performed by one of the following systems:

In-app assistant (Suka). The in-app assistant feature is powered by Anthropic's Claude Haiku model via the direct Anthropic API. Where you interact with Suka, the content of your messages is shared with Anthropic for the sole purpose of generating a response. Anthropic does not use this content for model training under our API agreement.

No training use. We do not use your Content to train our own AI models, and our agreements with third-party AI providers prohibit them from using your Content to train their models. If our processing arrangements change materially, we will update this Privacy Policy and notify affected users in advance.

8.2 Payment Processors

These processors handle all sensitive payment data under PCI DSS compliance.

8.3 Infrastructure Providers

8.4 Authentication Services

8.5 Observability Services

9. International Data Transfers

Your data may be transferred outside the UK or European Economic Area in the following circumstances:

CDN and Edge Processing: Cloudflare's global network may process or cache content at data centres worldwide. Cloudflare maintains appropriate safeguards including Standard Contractual Clauses and participation in recognised data protection frameworks.

AI Processing. Most translation models we use are either self-hosted on our UK/EU infrastructure or accessed via Google Vertex AI within UK/EU GCP regions. DeepL Pro processes data within the European Union. Where translation is performed by Anthropic's Claude or where you interact with our in-app assistant Suka (also powered by Claude Haiku), transcribed text and conversation content are transmitted to Anthropic in the United States. These transfers are governed by Anthropic's Data Processing Addendum, which incorporates the UK-approved Standard Contractual Clauses and the UK International Data Transfer Addendum.

Infrastructure: While our primary storage is in the UK/EU, certain infrastructure providers may process data in other jurisdictions for support or operational purposes.

Safeguards We Use:

• Standard Contractual Clauses (SCCs): UK-approved SCCs for transfers to countries without adequacy decisions
• Data Processing Agreements: Contracts with all processors requiring appropriate security measures
• Supplementary Measures: Additional technical and organisational measures where necessary, following ICO guidance

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

10.1 Right of Access

You may request a copy of the personal data we hold about you.

10.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data.

10.3 Right to Erasure

You may request deletion of your personal data in certain circumstances ("right to be forgotten").

10.4 Right to Restriction

You may request that we restrict processing of your personal data in certain circumstances.

10.5 Right to Data Portability

You may request to receive your personal data in a structured, commonly used, machine-readable format.

10.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

10.7 Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. Vakyya does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of UK GDPR Article 22. AI-driven transcription, captioning, and translation are content-processing operations and do not constitute such decision-making.

10.8 Exercising Your Rights

To exercise any of these rights, please contact us at gdpr@vakyya.com. We will respond to your request within one month, as required by law. We may request verification of your identity before processing your request.

11. Cookies and Tracking Technologies

Our Service uses cookies and similar technologies across web and mobile platforms:

11.1 Web (Browser)

11.2 Mobile (iOS/Android)

We do not access iOS Identifier for Advertisers (IDFA) unless you grant permission via Apple's AppTrackingTransparency prompt. On Android, we respect your "Opt out of Ads Personalisation" setting.

11.3 Managing Your Preferences

Web: You can manage cookie preferences through your browser settings. Where we provide a cookie preference banner, you can also adjust settings there. Essential cookies cannot be disabled as they are required for the Service to function.

Mobile: You can control analytics and advertising identifiers through your device's privacy settings (Settings > Privacy on iOS; Settings > Google > Ads on Android) and through in-app preferences where available.

12. Children's Privacy

We do not offer the Service to children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us at gdpr@vakyya.com, and we will take steps to delete such information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons.

Notification of Changes: We will notify you of material changes by posting the updated policy on our website, displaying a notice within the Service, and, for significant changes, sending an email notification at least 14 days before changes take effect.

Review: The "Last Updated" date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically.

14. Complaints

If you are dissatisfied with how we handle your personal data or your privacy concerns, please contact us first at gdpr@vakyya.com so we can attempt to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Contact
Parakletos AI Limited
First Floor, 85 Great Portland Street
London W1W 7LT
United Kingdom

Email: gdpr@vakyya.com

General Support: support@vakyya.com

This Privacy Policy was last updated on 11 May 2026.