Privacy policy

Vehsa Pty Ltd (ACN 702 799 951, ABN 80 702 799 951) of Unit 2, 35 Birriga Road, Bellevue Hill NSW 2023, Australia (“Vehsa”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the VEHSA application and related services (the “Service”).

This Privacy Policy should be read together with our Terms of Service and, if you use the Live Interview feature, our Voice-Consent Form.

1. Summary (quick overview)

This summary is provided for convenience; the full Privacy Policy below prevails in the event of any inconsistency.

• We collect account details, journal entries, photos, subscription and referral data, and, if you use the Live Interview feature, your voice.
• Journal entries and voice recordings may reveal sensitive information (such as health or mental health references). We collect Journal Entries on the basis of your explicit consent given at sign-up, and voice recordings only with your separate, explicit consent.
• We share personal information with service providers, most of them located overseas (mainly in the United States), including Google Gemini, Supabase (hosted in Sydney), Stripe, Resend, RevenueCat, and Vercel, to operate the Service.
• You have rights to access, correct, and, in many cases, delete your personal information, and additional rights if you are located in the United Kingdom or California.
• We do not sell your personal information.
• We do not use your content to train AI models. If you opt in, our AI also scans your journals, interviews, and read-aloud text for signs of distress and may show you a supportive message with helpline details. It does not flag your Account or store a note (see Clause 4.4).

2. Who we are and how to contact us

Data Controller / APP Entity: Vehsa Pty Ltd, Unit 2, 35 Birriga Road, Bellevue Hill NSW 2023, Australia.

Privacy Officer: Alexander James Haworth, Director, email privacy@vehsaapp.com.

UK Representative (Article 27 UK GDPR): Christopher Brian Haworth, 2 Stone Crescent, Clitheroe, Lancashire, BB7 1RJ, United Kingdom; email chris@vehsaapp.com. You may contact our UK representative on any issue relating to our processing of your personal data and the exercise of your rights under the UK GDPR. Our UK representative is a contact point for data protection correspondence only and is not a support, crisis, emergency or welfare service.

Availability: The Service is not currently offered in the European Union. If we later offer the Service there, we will appoint an EU representative and update this Privacy Policy.

3. Information we collect

3.1 Information You Provide

(a) Account details: name, nickname, pronouns, email address;

(b) Preferences: life areas of focus, narrator tone, chosen AI voice, single or two-narrator setting;

(c) Journal Entries: free-text writing about your life, goals, and feelings;

(d) Vision Board content: photographs you upload, plus captions and categories;

(e) Voice data: if you use the Live Interview feature (Tier 2), your voice captured via your device’s microphone during the session, streamed to Google Gemini for AI processing in real time (a recording is saved only if you turn on “Record this conversation”; see Clause 4.3);

(f) Payment-related information: your Subscription plan, billing period, and active/inactive status and your purchases and remaining balance of Live Interview minute credits. We do not collect or store your full card or bank account details; these are held solely by our payment processors (Stripe, Apple, Google, via RevenueCat).

3.2 Information We Generate

Generated content: the daily scripts and audio episodes created for you, and any Live Interview transcript or response generated during your session.

3.3 Information from Your Use of the Service

(a) Referral data: your referral link and information about sign-ups resulting from it;

(b) Usage and device data: device type, operating system, browser type, and IP address, recorded in our server logs.

(c) Cookies and similar technologies: on our website, we use cookies and similar technologies only for essential site functionality. We do not use analytics tools or advertising pixels. See Clause 9 (Cookies).

4. Sensitive information — voice and journal data

4.1 Classification

Your Journal Entries and voice recordings may reveal information about your health, mental health, religious or philosophical beliefs, or other matters that Australian, UK, and California law treat as a special or sensitive category of personal information requiring heightened protection. We treat this information as sensitive regardless of whether it also meets narrower technical definitions (such as biometric identification), because of the content it may reveal. We do not create or store voiceprints, and we do not use your voice to identify you.

4.2 Consent

• We collect voice recordings only after you provide separate, explicit, opt-in consent via our Voice-Consent Form, presented before the Live Interview feature becomes available to you. This consent is not bundled into general account sign-up and is not inferred from silence.
• You may decline or withdraw consent to voice data collection at any time without losing access to the rest of the Service (other than the Live Interview feature itself). Withdraw consent, by contacting privacy@vehsaapp.com.
• We rely on your explicit consent as our lawful basis for processing this sensitive information under Australian Privacy Principle 3, UK GDPR Article 9(2)(a), and equivalent provisions of applicable law.
• We collect Journal Entries only after you provide your explicit consent through a separate consent prompt at sign-up. Your consent to the optional wellbeing check described in Clause 4.4 is requested separately. You may withdraw this consent at any time by deleting your Journal Entries or closing your Account.

4.3 Voice Recordings and Transcripts

(a) Audio from your Live Interview is streamed from your device to Google Gemini in real time so that the AI interviewer can respond to you.

(b) A recording of the conversation is saved only if you turn on the “Record this conversation” setting. This setting is off by default and must be turned on again for each session. Saved recordings are stored on Supabase in Sydney, Australia until you delete them or delete your Account.

(c) A transcript of every Live Interview is always saved until your Account is deleted. We use transcripts to show captions when you replay a session, to inform your next interview and your next episode, and for the wellbeing check described in Clause 4.4.

(d) You may delete a saved recording at any time by contacting privacy@vehsaapp.com. When you delete your Account, your recordings and transcripts are deleted immediately, other than backup copies, which are kept for up to 7 (seven) days (see Clause 8).

4.4 Wellbeing Check

(a) If you opt in, our AI scans your Journal Entries, Live Interview content, and any text you ask the App to read aloud, in real time, for signs of distress. If it detects such signs, the App shows you a supportive message with helpline details.

(b) The wellbeing check is automated and based only on the content you submit. It does not flag your Account, alert our administrators or staff, pause your access, or create or store any note or record of the result. It may be wrong or miss signs of distress, it is not a medical or psychological assessment or diagnosis, and a supportive message is not a conclusion about your health. We do not make decisions with legal or similarly significant effects on you based on the wellbeing check.

(c) We carry out the wellbeing check only if you choose to opt in and give your explicit consent, which we ask for separately from your consent to Journal Entries and voice data, and on which we rely as our lawful basis under Australian Privacy Principle 3, UK GDPR Article 9(2)(a), and equivalent provisions of applicable law. You may withdraw your consent at any time by contacting privacy@vehsaapp.com. If you withdraw, scanning stops for future content, and you can keep using the Service, including Journal Entries and the Live Interview feature, without the wellbeing check.

(d) The wellbeing check is not a crisis or emergency service. If you are in distress or need urgent help, please contact a qualified healthcare professional or your local emergency services.

4.5 Safety Responses

Separately from the wellbeing check, and whether or not you have opted in, the AI models we use apply automated safety rules to the content you submit. If your content refers to self-harm, suicide or harming others, the App may decline to create that day’s episode, end a Live Interview, or refuse to read the content aloud, and in some cases it will show helpline details. This is an automated response, not an assessment of you, and it is not a crisis or emergency service. If you are in distress or need urgent help, please contact a qualified healthcare professional or your local emergency services.

5. How and why we use your information

We use personal information for the following purposes and on the following legal bases (the Australian Privacy Act does not require a “legal basis” framework as such, but we identify UK GDPR-equivalent bases for users in the UK):

We do not use your Journal Entries or voice data for automated decision-making that produces legal or similarly significant effects on you without additional notice and, where required, your consent.

We do not use your Journal Entries, Vision Board content, voice data, transcripts, or any other content you provide to train AI models. Under the terms of the paid Google Gemini API we use, Google does not use that content to train its models either.

6. How we share your information

6.1 Service Providers

We disclose personal information to the following categories of third-party service providers, each engaged to perform specific functions on our behalf:

6.2 Overseas Disclosure

(a) Several of our service providers are located, or process data, outside Australia, principally in the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles in relation to that information, including through data processing agreements that are incorporated automatically into each provider’s terms of service and cover security, confidentiality, breach notification, and deletion obligations.

(b) You acknowledge that Vehsa remains accountable under Australian law for the acts of these overseas recipients in relation to your personal information, except where an exception under the Privacy Act applies.

(c) For users located in the United Kingdom, we transfer personal data outside the UK (to Australia, the United States and any other country where our service providers process data) only with a safeguard required by Chapter V of the UK GDPR. Where the recipient is a United States organisation certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that certification. Otherwise, including for storage in Australia and for processing by Google Gemini outside the United States, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses under UK GDPR Article 46, and carry out a transfer risk assessment where required. Further information about these safeguards is available on request from privacy@vehsaapp.com.

6.3 Other Disclosures

We may also disclose personal information: to comply with a legal obligation, regulatory request, or court order; to protect the rights, property, or safety of Vehsa, our users, or others; or in connection with a merger, acquisition, or sale of business assets (subject to equivalent privacy protections being maintained).

6.4 No Sale of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If this changes, we will update this Privacy Policy and, where required by law, obtain your prior consent and provide an opt-out mechanism.

7. Data security

We implement technical and organisational measures appropriate to the sensitivity of the personal information we hold, including encryption in transit and at rest, access controls that limit each user to their own data, and contractual security obligations on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data retention

We retain personal information for as long as necessary to provide the Service and for legitimate business, legal, or regulatory purposes. Indicative retention periods:

When you delete your Account within the App, most of your personal information is deleted immediately, including your Account details, Journal Entries, Vision Board content, generated content, saved recordings, and transcripts. We keep billing, credit, usage, and referral records in de-identified form, raw copies of Stripe and RevenueCat webhook records, and backup copies for up to 7 (seven) days.

9. Cookies and tracking

We use only essential cookies and similar technologies, which are necessary for the Service to function (for example, to keep you signed in and to maintain security). We do not use analytics tools, advertising pixels, or other tracking technologies. If this changes, we will update this Privacy Policy and, where required by applicable law (including for users in the United Kingdom), seek your consent before setting any non-essential cookies.

10. Your privacy rights

10.1 All Users

You may request access to, correction of, or deletion of your personal information by contacting privacy@vehsaapp.com. You may also delete your Account at any time within the App. We will respond within a reasonable time and in accordance with applicable law.

10.2 United Kingdom Users

If you are located in the UK, you have the right, subject to applicable exceptions, to: access your personal data; rectify inaccurate data; erase your data; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). To exercise these rights, contact privacy@vehsaapp.com or our UK representative (see Clause 2). We will respond within one month, which we may extend where permitted by law, and we do not charge a fee for ordinary requests. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, and we do not make such decisions.

10.3 California Users — CCPA/CPRA Rights

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we have collected about you; delete your personal information (subject to exceptions); correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not currently sell or share personal information); and limit the use of your sensitive personal information to purposes necessary to provide the Service.

Categories of personal information collected in the preceding 12 months: identifiers (name, email); internet/network activity; commercial information (subscription/billing status); audio/voice recordings; and user-generated content (journal entries, photos). Categories of sensitive personal information: voice recordings and journal entries that may reveal health, mental health, or belief-related information. Sources: directly from you, and from your device/app usage. Purposes: as described in Clause 5. Recipients: the service providers listed in Clause 6.1.

To exercise your California rights, contact privacy@vehsaapp.com. We will verify your identity before responding and will respond within 45 (forty-five) days, subject to any permitted extension.

10.4 Australian Users

You have rights under the Privacy Act 1988 (Cth) to access and seek correction of your personal information, and to complain about a suspected breach of the Australian Privacy Principles, in the first instance to privacy@vehsaapp.com, and if unresolved, to the Office of the Australian Information Commissioner (OAIC).

11. Children’s privacy

The Service is not directed at, and we do not knowingly collect personal information from, individuals under 18 (eighteen) years of age. If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete it. Vehsa will monitor the development of Australia’s forthcoming Children’s Online Privacy Code and update this Policy as required once that code takes effect.

12. Data breach notification

If we experience an eligible data breach that is likely to result in serious harm to affected individuals, we will notify affected individuals and, where required, the Office of the Australian Information Commissioner, as soon as practicable, in accordance with Part IIIC of the Privacy Act 1988 (Cth). We will also comply with equivalent breach notification obligations under UK GDPR, and applicable US state law where relevant.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (such as email or in-app notification).

14. Complaints

If you have a concern about how we handle your personal information, please contact us first at privacy@vehsaapp.com. If you are not satisfied with our response, you may lodge a complaint with:

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• United Kingdom: the Information Commissioner’s Office (ICO) — ico.org.uk
• California: the California Privacy Protection Agency (CPPA) — cppa.ca.gov

15. Governing law

This Privacy Policy is governed by the laws of New South Wales, Australia, without limiting any mandatory data protection right available to you under the law of your place of residence.

16. Contact us

Vehsa Pty Ltd
Unit 2, 35 Birriga Road, Bellevue Hill NSW 2023, Australia
Email: privacy@vehsaapp.com