This Privacy Policy describes how Gaavala ("we", "us", or "our") collects, uses, and protects information when you use our real-time meeting translation service available at gaavala.com (the "Service").

We are committed to protecting your privacy in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law (KVKK — Kişisel Verilerin Korunması Kanunu No. 6698).

1. Data Controller

The data controller responsible for your personal data is Gaavala, based in Turkey. For all privacy-related inquiries, contact us at: privacy@gaavala.com

2. Information We Collect

2.1 Account Information (via OAuth)

When you sign in with Google or Microsoft, we receive the following data from the respective identity provider:

Full name
Email address
Profile picture URL (if provided by the identity provider)

We do not receive or store your OAuth provider passwords. We never request access to your calendar, emails, files, or any data beyond basic profile information.

2.2 Usage Data

We collect limited usage analytics to improve the Service, including:

Pages visited and features used
Session duration
Error logs (without personally identifiable information)
Daily usage minutes (to enforce tier limits)

2.3 Audio and Transcription Data

Audio is processed identically for both Free and Pro subscribers:

Speech-to-text (Soniox): Audio is streamed directly from your browser to Soniox's speech recognition service via a secure WebSocket connection. Audio bytes never reach Gaavala's servers. The connection is authenticated with a short-lived temporary key (TTL ~60 seconds) that our backend issues per session; the long-lived Soniox API key remains exclusively on our infrastructure. Soniox's own privacy policy governs their processing of audio. This section covers meeting audio. If you use the personal voice clone, a separate short voice sample is stored — see section 2.4.
Live transcription display: Transcription output is rendered in the browser session only. Gaavala does not log or persist transcript text on its servers by default.
Optional summary feature: When you explicitly request a meeting summary, it is generated entirely on your device using Chrome's built-in AI (Gemini Nano). The transcript is never transmitted to Gaavala's servers or any third party for summarization, and the summary session is destroyed after each run.
Optional translation playback (Speak / TTS): Translated text is synthesized to audio either via Soniox studio voices or your personal voice clone (see section 2.4), streamed directly from your browser to Soniox over a separate encrypted WebSocket (the same direct browser-to-Soniox pattern as captions), or — if you opt in — via ElevenLabs using your own ElevenLabs API key (BYOK). With BYOK, translated text is sent directly from your browser to ElevenLabs over TLS and Gaavala's backend never receives it. ElevenLabs' own privacy policy governs their processing.
Typed messages (Speak Text composer): You can type a message and have it spoken into the meeting. The typed text is translated entirely on your device using Chrome's built-in translation, and the resulting text is sent directly from your browser to Soniox over the same encrypted WebSocket for voice synthesis. Message text is never stored on Gaavala's servers — our backend only mints the short-lived session keys, exactly as for spoken Speak. An unsent draft is kept locally in the extension's session storage (chrome.storage.session) so it survives closing the panel; it lives only on your device and is cleared when your browser closes.

2.4 Voice Clone Reference Sample (Pro)

If you enable Speak Mode's personal voice clone (a Pro feature), you record a short voice sample of up to 20 seconds. This sample is biometric data. It is stored encrypted at rest on Gaavala's servers using AES-256-GCM and is used only to create and maintain your personal synthetic voice — never for identification, advertising, or any other purpose. The sample is processed by our speech provider, Soniox, to build your voice (see section 5). You can delete your voice at any time; deletion removes the recording, the synthetic voice, and its provider-side data (sections 6–7). Unlike meeting audio (section 2.3), which is never stored on our servers, this reference sample is deliberately stored so your voice can be reproduced across sessions — encrypted, purpose-bound, and erasable.

3. How We Use Your Information

We use the collected information to:

Create and manage your account
Authenticate you when you sign in
Enforce free and paid tier usage limits
Process subscription payments via Paddle
Send transactional emails (e.g., receipts, subscription status)
Improve and maintain the Service
Comply with legal obligations

4. Cookies and Local Storage

4.1 Authentication Cookies

We use a single httpOnly, Secure, SameSite=Lax cookie to store your refresh token. This cookie is inaccessible to JavaScript and is used solely to maintain your session across browser restarts. It expires after 7 days or when you sign out.

4.2 Local Storage

We store your language preference (e.g., en, tr) in localStorage so the application remembers your chosen UI language. This data never leaves your device.

4.3 No Third-Party Tracking Cookies

We do not use advertising networks, retargeting pixels, or third-party tracking cookies.

4.4 Chrome Extension — Local Data

The Gaavala Chrome Extension stores the following data locally inside your browser using the Chrome extension storage API. This data lives on your device and is never transmitted to Gaavala's servers unless explicitly noted:

Authentication tokens (chrome.storage.session + chrome.storage.local): The short-lived access token (cleared on browser restart) and the long-lived refresh token (used to obtain new access tokens). Both tokens are encrypted at rest using AES-GCM 256 with a session key that lives only in browser memory (chrome.storage.session, never written to disk). On browser restart the session key is cleared and the refresh token can no longer be decrypted — you will be prompted to sign in again with one OAuth click. Both tokens are scoped to the extension origin and inaccessible to any web page.
OAuth flow (chrome.identity): Sign-in uses chrome.identity.launchWebAuthFlow to open the Google or Microsoft consent screen in a sandboxed window. The redirect URL is https://<extension-id>.chromiumapp.org/ — standard Chrome identity infrastructure that does not expose the OAuth response to other extensions or web pages.
Audio capture (chrome.tabCapture): When you start a transcription session in a meeting tab, the extension uses chrome.tabCapture to obtain a MediaStream of the tab's audio. The stream is processed entirely in an offscreen document inside the extension and is streamed directly to Soniox over WebSocket as described in section 2.3. Audio bytes never reach Gaavala's servers. The capture stops the moment you end the session or close the tab.
User preferences (chrome.storage.local): UI language, font size, speaker labels, subtitle overlay positioning, and TTS voice selection are stored on your device for personalization. None of this is synced to our servers.
Speak Text drafts and message list (chrome.storage.session): An unsent typed-message draft and the recent typed-message list (so a reopened panel shows what happened to each message) are kept in the extension's session storage on your device only. They are never transmitted to Gaavala's servers and are cleared when your browser closes.
ElevenLabs BYOK API key (chrome.storage.local, optional): If you choose to enable ElevenLabs voices for translation playback, your ElevenLabs API key is stored in the extension's local storage so it can be used directly from the extension to ElevenLabs (BYOK — the key never reaches Gaavala's backend). The key is encrypted at rest using AES-GCM 256 with a session key that lives only in the browser's memory (chrome.storage.session, never written to disk). When you restart your browser the session key is cleared and you will be prompted to re-enter your ElevenLabs key on first use — this is the audit-prescribed trade-off that blocks a local-disk attacker from extracting the key from your Chrome profile. You can rotate the key at any time from the ElevenLabs dashboard and re-enter it in the extension settings.

You can clear all of this data instantly by removing the extension from chrome://extensions/, by signing out (which clears tokens), or by using the "Delete account" flow in the extension settings (which also wipes the corresponding records from our servers as described in section 6).

5. Data Sharing and Third Parties

We share data with the following third parties only as necessary to operate the Service:

Google / Microsoft: OAuth identity providers. Your sign-in is handled by their authentication infrastructure.
Soniox: Speech-to-text provider for both Free and Pro users, and studio-voice synthesis provider for Pro Speak Mode. Audio and translated text are exchanged directly between your browser and Soniox over encrypted WebSocket using short-lived temporary keys. Gaavala's backend never receives audio bytes — it only mints the temporary keys. For Pro voice clones, Soniox also builds and hosts your synthetic voice from your encrypted reference sample.
AI meeting summaries (on-device, no third party): Summaries are generated locally by Chrome's built-in AI (Gemini Nano). The transcript is not sent to Gaavala's backend or any external AI provider.
ElevenLabs (optional, BYOK): Translation-playback voice synthesis when you opt in with your own ElevenLabs API key. Translated text is sent directly from your browser (web app or extension) to ElevenLabs over TLS. Gaavala's backend never receives the request payload, the API key, or the response audio.
Paddle: Payment processor and Merchant of Record. They handle billing, tax collection, and payment data. We do not store your payment card information.
Vercel: Cloud hosting provider. Your requests are served through Vercel's infrastructure. They do not have access to your personal data beyond standard web server logs.
Neon (PostgreSQL): Database hosting. Your account data (name, email, subscription status) is stored in their infrastructure.

We do not sell your personal data to any third party. We do not share your data with advertisers.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes, which we retain for 5 years as required by Turkish tax law).

Voice-clone reference sample and synthetic voice — retained until you delete your voice or your account; deletion is immediate and propagates to Soniox.

7. Your Rights

Under GDPR and KVKK, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate data.
Right to erasure: Request deletion of your personal data ("right to be forgotten"), including your voice-clone reference sample and synthetic voice.
Right to restriction: Request that we limit processing of your data.
Right to data portability: Request your data in a portable format.
Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@gaavala.com. We will respond within 30 days.

8. Security

We implement the following technical safeguards:

All data in transit is encrypted via TLS 1.2+
Passwords are never stored (OAuth-only authentication)
Refresh tokens are stored in httpOnly cookies, inaccessible to JavaScript
API endpoints are protected with rate limiting and CSRF mitigations
Database access is restricted to application services only
Voice-clone reference samples are encrypted at rest with AES-256-GCM.

9. International Data Transfers

Your data may be processed in countries outside Turkey or the European Economic Area (EEA) by our service providers (e.g., Vercel's infrastructure in the US). Where required, such transfers are governed by appropriate safeguards such as Standard Contractual Clauses (SCCs).

10. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints, contact us at: privacy@gaavala.com

You also have the right to lodge a complaint with your local data protection authority. In Turkey, this is the Personal Data Protection Authority (KVKK — Kişisel Verileri Koruma Kurumu).