Legal · Effective October 2026

Privacy Policy

What we collect, what we never receive, and how to make us delete it.

This Privacy Policy describes how Gaavala ("we", "us", or "our") collects, uses, and protects information when you use our real-time meeting translation service available at gaavala.com (the "Service").

We are committed to protecting your privacy in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law (KVKK — Kişisel Verilerin Korunması Kanunu No. 6698).

1. Data Controller

The data controller responsible for your personal data is Gaavala, based in Turkey. For all privacy-related inquiries, contact us at: privacy@gaavala.com

2. Information We Collect

2.1 Account Information (via OAuth)

When you sign in with Google or Microsoft, we receive the following data from the respective identity provider:

  • Full name
  • Email address
  • Profile picture URL (if provided by the identity provider)

We do not receive or store your OAuth provider passwords. We never request access to your calendar, emails, files, or any data beyond basic profile information.

2.2 Usage Data

We collect limited usage analytics to improve the Service, including:

  • Pages visited and features used
  • Session duration
  • Error logs (without personally identifiable information)
  • Daily usage minutes (to enforce tier limits)

2.3 Audio and Transcription Data

Audio is processed identically for both Free and Pro subscribers:

  • Speech-to-text (Soniox): Meeting audio is streamed directly from your browser to Soniox's speech recognition service via a secure WebSocket connection. Meeting audio never reaches Gaavala's servers. The connection is authenticated with a short-lived temporary key (TTL ~60 seconds) that our backend issues per session; the long-lived Soniox API key remains exclusively on our infrastructure. Soniox's own privacy policy governs their processing of audio. This section covers meeting audio. If you use the personal voice clone, a separate short voice sample is stored — see section 2.4.
  • Live transcription display and saved transcripts: Transcription output is rendered in your browser. The extension keeps your transcripts on your device (section 4.4) and deletes them after 7 days. Transcript text is never sent to Gaavala's servers, and Gaavala does not log or store it.
  • Optional summary feature: When you explicitly request a meeting summary, it is generated entirely on your device using Chrome's built-in AI (Gemini Nano). The transcript is never transmitted to Gaavala's servers or any third party for summarization, and the summary session is destroyed after each run.
  • Optional translation playback (Speak / TTS): Translated text is synthesized to audio via Soniox studio voices or your personal voice clone (see section 2.4), streamed directly from your browser to Soniox over a separate encrypted WebSocket (the same direct browser-to-Soniox pattern as captions).
  • Typed messages (Speak Text composer): You can type a message and have it spoken into the meeting. The typed text is translated entirely on your device using Chrome's built-in translation, and the resulting text is sent directly from your browser to Soniox over the same encrypted WebSocket for voice synthesis. Message text is never stored on Gaavala's servers — our backend only mints the short-lived session keys, exactly as for spoken Speak. An unsent draft is kept locally in the extension's session storage (chrome.storage.session) so it survives closing the panel; it lives only on your device and is cleared when your browser closes.

2.4 Voice Clone Reference Sample (Pro)

If you enable Speak Mode's personal voice clone (a Pro feature), you record a short voice sample of up to 120 seconds (two minutes). This sample is biometric data. It is stored encrypted at rest on Gaavala's servers using AES-256-GCM and is used only to create and maintain your personal synthetic voice — never for identification, advertising, or any other purpose. The sample is processed by our speech provider, Soniox, to build your voice, and by our own voice-style job to compute the voice style the extension's on-device voice engine uses; that style is stored encrypted and deleted with your voice. You can delete your voice at any time; deletion removes the recording, the synthetic voice, and its provider-side data (sections 6–7). Unlike meeting audio (section 2.3), which is never stored on our servers, this reference sample is deliberately stored so your voice can be reproduced across sessions — encrypted, purpose-bound, and erasable.

2.5 Technical Issue Reports

If you send a technical issue report from the extension, we receive and store it linked to your account: a category the extension assigns from recent technical events, an optional note you write (up to 2,000 characters), and a diagnostic bundle. The bundle holds the extension, Chrome and operating-system versions, the meeting platform, your UI language, theme and plan, the state of the captioning pipeline, your caption language pair and Speak voice settings, counters (such as the number of caption tokens and speakers), and recent technical log lines from which sign-in tokens, email addresses and web addresses are removed. Transcripts, captions, API keys and sign-in tokens are excluded from the bundle. We keep a report for 180 days and then delete it; a content-free receipt of the submission (an identifier and a fingerprint of the report, not its contents) is kept until you delete your account, so that a delayed retry cannot recreate a deleted report.

2.6 Waitlist (website)

If you join the waitlist on gaavala.com, we store your email address, the language of the page, the campaign parameters (UTM) and referring page of your first visit if there were any, the time you gave consent, and whether you confirmed the address. We use it only to confirm your address and to tell you when Gaavala launches. Every email carries an unsubscribe link. When you unsubscribe, we stop all waitlist emails and keep the entry marked as unsubscribed, so it is not added again without your consent. To have it erased, write to privacy@gaavala.com; we delete the entry, and our internal audit log keeps a record of the erasure that names the address.

2.7 Account Settings and Free-Trial Record

  • UI language: the language you choose in the extension is also saved to your Gaavala account, so that our account and billing emails to you (for example payment-failed and cancellation notices) are written in that language.
  • Free-trial record: to keep the one-time free allowance to one per person, when you delete your account we store a one-way keyed hash of your sign-in identity (your Google or Microsoft account identifier) together with the total seconds that account used (paid use included). The hash cannot be turned back into the identifier. It is kept after your account is deleted (section 6).

3. How We Use Your Information

We use the collected information to:

  • Create and manage your account
  • Authenticate you when you sign in
  • Enforce free and paid tier usage limits
  • Process subscription payments via our payment partner (Merchant of Record)
  • Send transactional emails (e.g., receipts, subscription status)
  • Send waitlist confirmation and launch emails, if you joined the waitlist
  • Investigate and answer technical issue reports you send
  • Improve and maintain the Service
  • Comply with legal obligations

4. Cookies and Local Storage

4.1 Authentication Cookies

We use a single httpOnly, Secure, SameSite=Lax cookie to store your refresh token. This cookie is inaccessible to JavaScript and is used solely to maintain your session across browser restarts. It expires after 7 days or when you sign out.

4.2 Local Storage

On gaavala.com we store your language preference (e.g., en, tr) and your cookie choice in localStorage. These never leave your device. The campaign parameters (UTM) of your first visit, the page that referred you and the time you arrived are kept there too; they are sent to us only if you join the waitlist (section 2.6).

4.3 Analytics Cookies (Website Only, With Your Consent)

If you accept cookies in the gaavala.com banner, the website loads Google Analytics 4, which sets its own cookies to count visits, page views and the interactions you make on the site. IP anonymization is switched on, and the page-address parameters known to carry sign-in tokens, email addresses, payment transaction identifiers and similar values are removed before anything is sent. If you decline, Google Analytics is not loaded at all. To withdraw your consent later, clear gaavala.com's site data in your browser; the banner then asks again. The Chrome extension loads no analytics service; it reports technical events only to Gaavala's own servers (section 2.2).

We do not use advertising networks or retargeting pixels.

4.4 Chrome Extension — Local Data

The Gaavala Chrome Extension stores the following data locally inside your browser using the Chrome extension storage API. This data lives on your device and is never transmitted to Gaavala's servers unless explicitly noted:

  • Authentication tokens (chrome.storage.session + chrome.storage.local): The short-lived access token (cleared on browser restart) and the long-lived refresh token (used to obtain new access tokens). Both tokens are encrypted at rest using AES-GCM 256 with a session key that lives only in browser memory (chrome.storage.session, never written to disk). On browser restart the session key is cleared and the refresh token can no longer be decrypted — you will be prompted to sign in again with one OAuth click. Both tokens are scoped to the extension origin and inaccessible to any web page.
  • OAuth flow (chrome.identity): Sign-in uses chrome.identity.launchWebAuthFlow to open the Google or Microsoft consent screen in a sandboxed window. The redirect URL is https://<extension-id>.chromiumapp.org/ — standard Chrome identity infrastructure that does not expose the OAuth response to other extensions or web pages.
  • Audio capture (chrome.tabCapture): When you start a transcription session in a meeting tab, the extension uses chrome.tabCapture to obtain a MediaStream of the tab's audio. The stream is processed entirely in an offscreen document inside the extension and is streamed directly to Soniox over WebSocket as described in section 2.3. The meeting audio never reaches Gaavala's servers. The capture stops the moment you end the session or close the tab.
  • Device identifier (chrome.storage.local): A random identifier the extension creates for this browser. It is sent with sign-in and token refresh so that a refresh token works only on the browser it was issued to.
  • User preferences (chrome.storage.local): UI language, font size, speaker labels, subtitle overlay positioning, and TTS voice selection are stored on your device for personalization. The UI language is also saved to your Gaavala account (section 2.7). The rest is not sent to our servers, except for the few settings a technical issue report you choose to send includes (section 2.5).
  • Transcripts (IndexedDB): Your meeting transcripts, the speaker list of each meeting and, while captions run, the lines you speak or type with Speak (original and translation) are saved on your device so you can reopen them. They are deleted automatically after 7 days and are never sent to Gaavala's servers.
  • Speak Text drafts and message list (chrome.storage.session): An unsent typed-message draft and the recent typed-message list (so a reopened panel shows what happened to each message) are kept in the extension's session storage on your device only. They are never transmitted to Gaavala's servers and are cleared when your browser closes.

Removing the extension from chrome://extensions/ clears all of this data at once. Signing out clears your tokens. The "Delete account" flow in the extension settings clears the extension's local storage (chrome.storage.local) and wipes the corresponding records from our servers as described in section 6, but it does not delete your saved transcripts: they stay on your device until the 7-day automatic deletion, until you use "Delete all" in the extension's History, or until you remove the extension.

5. Data Sharing and Third Parties

We share data with the following third parties only as necessary to operate the Service:

  • Google / Microsoft: OAuth identity providers. Your sign-in is handled by their authentication infrastructure.
  • Soniox: Speech-to-text provider for both Free and Pro users, and studio-voice synthesis provider for Pro Speak Mode. Meeting audio, any custom vocabulary you add, and translated text are exchanged directly between your browser and Soniox over encrypted WebSocket using short-lived temporary keys. Gaavala's backend never receives your meeting audio or the speech Soniox synthesizes — for these streams it only issues the temporary keys. The one recording our servers hold is your voice-clone reference sample (section 2.4): for Pro voice clones, Soniox receives it to build and host your synthetic voice.
  • AI meeting summaries (on-device, no third party): Summaries are generated locally by Chrome's built-in AI (Gemini Nano). The transcript is not sent to Gaavala's backend or any external AI provider.
  • Our payment partner: Payment processor and Merchant of Record. It handles checkout, billing, tax collection and payment data. Your card is entered on the payment partner's checkout and stays with the payment partner: we never receive or store your card number, the name on the card, its expiry date or the last four digits. What the payment partner tells us about a payment — the amount, the tax, the currency, the date and whether you paid by card or another method — we keep as the invoice record the law requires us to hold.
  • Vercel: Cloud hosting provider. Your requests are served through Vercel's infrastructure. They do not have access to your personal data beyond standard web server logs.
  • Neon (PostgreSQL): Database hosting. Your account data (name, email, subscription status) and the other server-side data described in section 2 are stored in their infrastructure.
  • Resend: Email delivery. It receives your email address and the content of the emails we send you (account, billing and waitlist emails).
  • Google Analytics (website only, with your consent): Measures visits and interactions on gaavala.com after you accept cookies (section 4.3).

We do not sell your personal data to any third party. We do not share your data with advertisers.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account (see Data Deletion for how), we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes, which we retain for 5 years as required by Turkish tax law) and except for the free-trial record listed below.

Voice-clone reference sample and synthetic voice — retained until you delete your voice or your account; deletion is immediate and propagates to Soniox.

Other retention periods:

  • Technical issue reports — 180 days, then deleted; all of them are deleted with your account. A content-free submission receipt is kept until you delete your account (section 2.5).
  • Waitlist entries — until you ask us to erase them; an unsubscribed address is kept only as unsubscribed (section 2.6).
  • Free-trial record — the one-way hash of your sign-in identity and the account's total usage seconds, written when you delete your account and kept, so that the free allowance cannot be claimed again (section 2.7).
  • Usage records — your usage events are deleted with your account; the speech-provider usage and on-device engine records lose their link to your account, and on-device engine records are deleted after 365 days.
  • Transcripts — kept only on your device, 7 days by default (section 4.4).

7. Your Rights

Under GDPR and KVKK, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate data.
  • Right to erasure: Request deletion of your personal data ("right to be forgotten"), including your voice-clone reference sample and synthetic voice. Both ways to do it — from the extension, or by e-mail — are on the Data Deletion page.
  • Right to restriction: Request that we limit processing of your data.
  • Right to data portability: Request your data in a portable format.
  • Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@gaavala.com. We will respond within 30 days.

8. Security

We implement the following technical safeguards:

  • All data in transit is encrypted via TLS 1.2+
  • Passwords are never stored (OAuth-only authentication)
  • Refresh tokens are stored in httpOnly cookies, inaccessible to JavaScript
  • API endpoints are protected with rate limiting and CSRF mitigations
  • Database access is restricted to application services only
  • Voice-clone reference samples are encrypted at rest with AES-256-GCM.

9. International Data Transfers

Your data may be processed in countries outside Turkey or the European Economic Area (EEA) by our service providers (e.g., Vercel's infrastructure in the US). Where required, such transfers are governed by appropriate safeguards such as Standard Contractual Clauses (SCCs).

10. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints, contact us at: privacy@gaavala.com

You also have the right to lodge a complaint with your local data protection authority. In Turkey, this is the Personal Data Protection Authority (KVKK — Kişisel Verileri Koruma Kurumu).