Privacy notice

1. Who is responsible

ROYVIRA is a product of GHQI d.o.o. Contact us directly with privacy questions or to exercise your rights.

2. When you visit the website

When you request a page, the hosting infrastructure processes connection data required for technical operation. This includes your IP address, date and time, requested address, response status and information your browser sends about the browser, operating system and, where applicable, the previously visited page.

We process this data to deliver the website, keep it stable and detect and prevent errors and abusive access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a secure, functioning website. The site cannot be delivered without the necessary connection data.

The same applies to requests for app downloads, source archives and update descriptions (appcast) for the Mac app that this website serves. A download path shows the Mac architecture you selected.

3. Hosting and recipients

We host this website with Vercel Inc., USA. Vercel and its infrastructure providers process the data needed to operate it. Processing on our behalf is described in the Vercel Data Processing Addendum. Where Vercel processes operational and security data as an independent controller, the Vercel Privacy Notice also applies.

Data may be processed outside the EU or European Economic Area, particularly in the USA. For applicable transfers, the Vercel DPA provides for safeguards including the EU Standard Contractual Clauses. Details of contractual safeguards and subprocessors are available in the linked DPA or from us on request.

4. Cookies, fonts and embedded content

Images and fonts are delivered with this website. No Google Fonts, embedded videos or social media content are loaded.

To measure reach we use Vercel Web Analytics and Vercel Speed Insights from our host Vercel (section 3). They count page views, clicks on downloads and other controls, and loading times. They set no cookies and run through the same address as this website.

Optional services load only after you agree in the cookie choice. Statistics covers Google Analytics 4 and Microsoft Clarity; marketing covers the Meta Pixel, the LinkedIn Insight Tag, Google Ads and the Reddit Pixel. The cookie settings show which of them are currently set up. Without your consent the website loads none of these services. For Google services, Google’s consent mode is set to “denied” by default.

Google Analytics 4 (only with your consent to statistics): the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records how you use the website: pages viewed, clicks, scroll depth, downloads, device, browser and approximate location. Google Analytics drops IP addresses of users from the EU, Switzerland and the UK before storing data. For this, Google sets the cookies _ga and _ga_<ID> (2 years each). Google signals and ad personalization are switched off for our property. We keep event data for 14 months. Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the cookie settings; we then delete these cookies. More: policies.google.com/privacy.

On your first page view we keep in the memory of the open page which campaign or website brought you here: UTM parameters, ref and the domain of the referring page. Only with your consent to statistics do we also store these details in your browser’s session storage (key royvira_attribution, not a cookie, deleted when you close the tab or withdraw consent). We send them along when you start a download or join the waiting list: Vercel Web Analytics receives at most two details per event, Google Analytics 4 receives all of them only with your consent to statistics, marketing services receive none.

When you save your cookie choice, we set royvira_cookie_choice. The provider is GHQI d.o.o. It contains the notice version, your choice for statistics and marketing, and the time it was saved. Its sole purpose is to remember your choice so the notice does not reappear on every visit. It contains no visitor ID and is not used to create a browsing profile.

The cookie lasts for up to 180 days from saving. Visiting the site does not renew that period. It applies to this website, uses SameSite=Lax and is marked Secure over HTTPS. Your browser sends it to this website’s hosting infrastructure when requesting the same website.

Storing the choice you request is necessary to retain that setting and does not require cookie consent. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is reliably respecting your privacy setting.

“Accept all” allows statistics and marketing; “Reject all” saves necessary cookies only. “Settings” lets you choose each category and offers “Continue without saving”. This closes the notice for the open page without setting the preference cookie. You can change, withdraw or remove your choice at any time through “Cookie settings” in the footer. You can also delete or block cookies in your browser. The website remains fully usable without consent.

The website removes the legacy domain cookies dps_site_id and _tccl_visitor if they remain from earlier visits. We do not use them for analytics or advertising. External websites open only when you click a relevant link. The respective provider’s privacy information applies there.

5. When you contact us

If you email or call us, we process the information you provide, such as your name, email address or phone number, your enquiry and any technical information you voluntarily share. We use it to answer your question and handle your enquiry.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a contract or pre-contractual steps you request. For other enquiries, it is Article 6(1)(f) GDPR; our legitimate interest is responding to your message.

Recipients are the people at GHQI responsible for handling the enquiry and our email and communications providers. Incoming email uses Google’s mail service. Data may also be processed by Google entities outside the EEA. Details about Google’s processing and international transfer safeguards are in Google’s privacy information.

Contacting us is voluntary. Without a working contact address and details of your enquiry, we may be unable to respond. An enquiry does not subscribe you to a newsletter or waiting list. Email links only open your email application; a message is transmitted when you send it yourself.

6. How long data is kept

We keep personal data for as long as needed for its purpose. For contact enquiries, this depends on whether the matter is resolved, further questions are expected, or legal retention obligations or the establishment, exercise or defence of legal claims require continued storage. We then delete the data.

Retention of technical operational and security logs depends on what is needed for delivery, error analysis and abuse prevention, and on the hosting provider’s retention policies. The Vercel information linked in section 3 describes its processing and deletion practices.

7. Your rights

Subject to the applicable legal conditions, your rights include:

• Access to your personal data and a copy of it (Article 15 GDPR).
• Correction of inaccurate data (Article 16 GDPR).
• Erasure and restriction of processing (Articles 17 and 18 GDPR).
• Data portability for applicable processing (Article 20 GDPR).
• Objection to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR).
• Withdrawal of consent for future processing, where processing relies on consent.

To exercise your rights, contact ad@ghqi.org. You can also complain to a data protection supervisory authority, particularly where you live or work or where the suspected infringement occurred. The Croatian authority is Agencija za zaštitu osobnih podataka (AZOP).

8. Website and Mac app

This website currently has no registration, checkout or audio upload. Section 10 describes the waiting list for other platforms. We do not use automated decision-making, including profiling, on this website.

This notice covers the website and contact enquiries. The privacy information for the Mac app, that is for the account, licence check and updates, is in section 9.

9. Mac app: privacy information

9.1 Scope and contact

This section covers the ROYVIRA Mac app version 1.x with a personal account, used privately or for work. It concerns the account, licence check, update requests and the app’s local functions. It does not describe ROYVIRA 2.0 or future business services. The provider of the app is GHQI d.o.o. (address in section 1). For questions and privacy requests, write to ad@ghqi.org.

9.2 Local data and sharing you choose

The app processes clips, microphone and call audio, grids and settings locally on your Mac. If you choose the call feature, audio passes through the local BlackHole output to the calling app you have set up. The reviewed app code contains no automatic upload of clip or call audio or transcripts to GHQI. We have not examined the data routes of the other calling app.

A profile export that you start yourself contains clips, audio and settings as an unencrypted archive at the location you choose, not account details, Keychain data or logs. Keep it protected. Local diagnostics write a limited log with startup, warning and error entries. A diagnostic report with app and system details, permission status, audio and call states and sanitised events is created only on your action and is shared only if you pass it on yourself.

9.3 Sign-in, account and licence

For email sign-in, Supabase Auth processes your email address and a one-time code. The app then receives, among other things, an Auth identifier (UUID), your email address and session tokens. Supabase sends the code through the email service Resend (Resend, Inc., USA) as a processor; Resend processes your email address, the message with the code and delivery data. For transfers to the USA, Resend relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. If you choose Google, the app opens the system browser with PKCE and a local callback; Supabase and Google take part. The browser then shows a result page on royvira.com (Vercel); it only receives whether sign-in worked, no code and no account data.

For licence checks, the app sends an access token and the action “check” or “register” to a Supabase function. “Register” also sends your name and, if you provide them, company and role. For the personal account route, the app processes your email address and, for profile registration, a name; the “register” function technically requires a name. Company and role are optional. Whether and to what extent this counts legally as required information has not yet been conclusively reviewed. According to the documented data model, an account consists of a profile, the licence status and a status history; limited counters for abuse prevention are planned. The app checks the licence status at launch and periodically.

The session and last local access proof are stored in the macOS Keychain. “Sign out” clears this local storage; it deletes neither your server account nor your local clips nor the provider’s browser session.

9.4 Updates and optional functions

The app can request an update feed (appcast) matching your Mac and a package from royvira.com (Vercel). This creates ordinary connection data and the request path. You can turn automatic update checks off in Settings.

Optional usage days and crash reports are planned but not active at present: the app does not send them. We would send them only with your explicit consent, each separately, off by default and withdrawable at any time. This information will be updated beforehand. Distinguish them from the local diagnostics in 9.2.

9.5 Recipients, locations, retention and rights

Supabase takes part in account and licence functions, Resend in sending the sign-in code, and Google if you choose that sign-in. Update requests go to Vercel as host of this website. According to the project list, the Supabase project is in region eu-west-1. Other processing locations, remote access, mail and log locations are not established by this and are not stated here. The database is backed up; a fixed retention period for backups and provider logs has not yet been confirmed.

You can contact ad@ghqi.org about access, rectification, erasure, restriction, portability, objection and any withdrawal; the applicable legal conditions govern each right. A withdrawal works for the future. You may complain to a competent supervisory authority (section 7). Our internal target is to handle access and erasure within one month of receipt. We confirm an erasure only after account and profile data, the status history, provider logs and backups have been checked. We intend to check and remove the status history in the same erasure operation; the technical implementation is not yet complete. While the periods for provider logs and backups are not established, we give no blanket confirmation of erasure.

Signing out locally is not account deletion. Erasing your account at GHQI does not automatically remove local clips and backups on your Mac or with third parties.

9.6 What this information does not yet contain

Not yet included or not yet conclusively reviewed are the legal basis for each processing activity, the legal role of GHQI and other participants for each activity, the contractual basis and subprocessors of the services used, any transfers to third countries, the retention periods of provider logs and backups, the practical process and implementation of erasure, whether the account details you provide count legally as required, and whether the automatic licence check requires additional information on automated decisions including profiling. They will follow after legal review. Until then, contact us with questions at ad@ghqi.org.

10. Waiting list for other platforms

ROYVIRA is currently available for macOS only. On the download page you can join a waiting list. We store your e-mail address, the platform you choose, the page language, the page where you signed up, and the version of the consent text and the time of your consent. A hidden form field helps us detect automated sign-ups; it contains no data about you.

The only purpose is to tell you by e-mail when ROYVIRA is available for your platform. The legal basis is your consent under Article 6(1)(a) GDPR. Signing up is voluntary. Before we send you the first e-mail about the waiting list, we ask you to confirm your address.

The sign-up goes through this website at Vercel (section 3) to our Supabase database, which according to the project list is in region eu-west-1. To prevent abuse, the database counts sign-ups per minute and hour, without any link to a person.

We keep your entry until you withdraw your consent or we end the waiting list. When we end the waiting list, we delete all entries. Section 9.5 applies to database backups.

You can withdraw your consent at any time for the future and ask us to delete your entry. Write to ad@ghqi.org and name the e-mail address you signed up with. We then delete the entry. Your other rights are in section 7.