Palabra Live privacy policy
Version 0.7 (draft), 8 September 2026.
1. Data controller
DawidWeb, [full company name, address, NIP — to be completed]. Contact on data matters: kontakt@dawidweb.com. We do not appoint a data protection officer — at this scale of processing, Article 37 GDPR does not require one.
Territorial scope: the Service is offered to users present in Poland and in Germany. The German, English and Ukrainian versions serve people living in those countries and do not constitute directing the Service to any other country. The Polish version of this document is the binding one.
2. How the App works and what that means for your data — in three sentences
- The audio of what you say and what the other party says is sent live to our server (Cloudflare, EU location) and on to the translation service. We have four translation services (OpenAI, Palabra.ai, DeepL Voice, Google Gemini Live) and it is our server that chooses which one handles a given conversation — details in point 4a. A telephone conversation goes through the operator Twilio.
- We do not record conversations and we do not save their content. The translated text exists only in memory for the duration of the conversation.
- We do not record conversation content. Creating your own voice is a separate, voluntary operation that sends a sample to ElevenLabs (points 3–6).
3. What data, what for and on what basis
| Data | Purpose | Legal basis (GDPR) | Source |
|---|---|---|---|
| Random device identifier, installation digest, app version, dates of first and last use, licence status | Providing the service, protection against abuse, updates | Article 6(1)(b) (contract), (f) (security) | The App |
| E-mail address and user name linked to the access code (pilot phase) | Identifying the pilot participant, accounting for the minutes limit | Article 6(1)(b) | You |
| The audio of what you say and what the other party says (audio stream) | Live translation | Article 6(1)(b) (you); for the other party: (f) (legitimate interest — carrying out a conversation they are knowingly having) | Microphone or telephone line |
| The translated text shown during the conversation. Hallucination filter: a fragment of the model’s output written in a script outside the language of the conversation is rejected — it goes neither to the audio nor to the screen, and is not stored anywhere | Showing what was said; discarding fragments nobody said | Article 6(1)(b) | The translation output |
| The telephone number you dial (the other party’s number). The number goes into the conversation session memory on our server and is needed there to set up and run the call; it does not go into the conversation database | Setting up the call | Article 6(1)(b) | You |
| The other party’s number in the call log of the operator Twilio (the “to” number, the “from” number, the time and length of the call). The number does not go into our database, but it does go to Twilio and is visible in the operator’s console for 13 months | Setting up and billing the call, the operator’s regulatory duties | Article 6(1)(b); on Twilio’s side also the operator’s own legal obligation | You (the number dialled) and the operator |
| The calling number the other party sees — in the pilot phase this is the verified private number of the service owner, not a Palabra number (point 4b) | Setting up the outgoing call; there is no Palabra number of our own in the pilot phase | Article 6(1)(b) and (f) | Service configuration |
| Checking for app updates: the current version code, the update channel (“stable” or “beta”), the device credential (from which the server reads the device identifier) and — as with any internet connection — the IP address visible to the server. With this the App does not send the phone model, the IMEI number, the list of apps or any conversation data | Delivering updates and security fixes | Article 6(1)(b), (f) | The App |
| Conversation metadata: mode (telephone or live), direction, languages, engine, start and end time, billed seconds, estimated cost, number of reconnections, error code | Accounting for Minutes, service quality, statistics | Article 6(1)(b), (f) | The server |
| Problem report: category, your description, technical diagnostics, last error code | Handling complaints, fixing errors | Article 6(1)(b), (f) | You |
| App events: start-up, crash (without conversation content) | App stability | Article 6(1)(f) | The App |
| Conversation flow markers (the “conversation timeline”): start and end times of speech, gaps in the conversation, changes of audio route, reconnections, the fact that a touch-tone digit was sent (without the digit itself) — without conversation content and without numbers. Collection is on by default; the “Conversation flow markers” switch in Settings → Privacy stops it | Diagnosing call quality | Article 6(1)(f) | The App |
| The answer to the after-call question: once a conversation has ended, the app asks whether the matter was dealt with. We save the answer chosen, the reason from a closed list and a reference digest for the conversation — without conversation content, without numbers and without a free-text field. Collection is on by default; the “Ask whether the matter was dealt with” switch in Settings → Privacy turns off both the question and the record | Assessing whether the translation actually dealt with the matter | Article 6(1)(f) | You (the answer in the app) |
| Digits dialled during the conversation (the touch-tone keypad, for example choosing an option in a helpline menu). The digits go to the operator Twilio as a command controlling the call and are visible in its call log (13 months). The app does not save them in the transcript, the logs or the reports. Do not enter PIN codes or card numbers — beyond the operator we have no control over them | Working with automated telephone menus | Article 6(1)(b) | You (the keypad in the app) |
| Evidence from conversation tests: quality metrics of a test run — engine, language direction, response times, the scenario and its result, the test device identifier, a short note without conversation content and without numbers. DawidWeb test devices are exempt from the conversation limit set in the pilot — this applies only to internal tests, not to user accounts | Checking service quality before and after release | Article 6(1)(f) | The owner’s test tool |
| Telephone numbers from the “allowed / blocked” lists for incoming calls — only if you turn incoming calls on and grant the permission. The App sends these numbers to the server in plain form; the server stores only their cryptographic digests (HMAC-SHA256 with a secret key) and does not keep the numbers themselves. The digest cannot be reversed without that key | Filtering incoming calls | Article 6(1)(a) (consent — system permission); towards the people on your lists: Article 6(1)(f) together with the duty under Article 14 (point 9) | You (from your phone’s contact book) |
| Firebase notification token (encrypted on the server) — only with incoming calls | Signalling an incoming call | Article 6(1)(b) | Google Firebase |
| Installation identifier issued by the Firebase Cloud Messaging library | Delivering notifications about an incoming call | Article 6(1)(b) | The Google library in the App |
| Call history on your phone (the “Recents” tab): for each call the number in international format — or, for a face-to-face conversation, the entry “Live conversation” instead of a number — the direction (outgoing, incoming, missed, face-to-face), the language pair, the date and time it started, the length and the amount, if the call had one. No conversation content: the data structure has no field for a transcript, the original sentence or the translation. Up to 50 entries, none older than 30 days (point 5). The history is not sent to our server — it stays in the App’s private storage on your phone, and cloud backup and transfer to a new phone are switched off for it. The file is encrypted — AES-256-GCM under a key from the Android Keystore, just like the incoming-call number lists. You delete a single entry with “Remove from history” (long-press the row), and the whole list with “Clear history” above the list or “Clear call history” under Settings → Privacy | Redialling a number and reviewing your own calls | Towards you: Article 6(1)(b) (contract). Towards the people whose numbers appear in it — including those who called you — Article 6(1)(f); the information duty is discharged by point 9 | On your phone only |
| Recently dialled numbers (up to 8, a store separate from the call history — suggesting the country code and quick redial), settings (languages, voice, audio route, appearance) | Convenience | Article 6(1)(b) | On your phone only |
| Downloads from our site: country and browser family (without the IP address), timestamp, link source (page, QR code, e-mail message) | Distribution statistics | Article 6(1)(f) | The download page |
| Digest of the device identifier passed to OpenAI as a safety identifier | Protection against abuse on OpenAI’s side (supplier requirement) | Article 6(1)(f) | The server |
We do not create profiles for advertising, show adverts or use third-party tracking or analytics tools. Basic translation does not identify people by their voice. The optional own voice feature creates a voice profile with ElevenLabs and requires separate consent. Under the protective approach adopted in this information, we process it on the basis of explicit consent, including for biometric characteristics (Article 9(2)(a) GDPR).
Your own voice. The sample passes through our server’s working memory to ElevenLabs to create a voice profile. Our server does not store the sample file permanently. It keeps profile data: name, identifiers and status, device association, consent record, and a cryptographic hash of the sample to handle repeated requests. When you use your own voice, ElevenLabs receives the translated text for speech synthesis. The provider keeps the voice profile until it is deleted.
Incoming calls are currently unavailable. The description of their data and number lists applies to that feature after it is made available. It does not mean that calls can currently be received in or forwarded to the App.
4. Data recipients — processors
| Entity | Role | Data | Transfer outside the EEA |
|---|---|---|---|
| Cloudflare, Inc. (USA) | application servers, database, distribution | all technical data; audio and text pass through the server during the conversation | standard contractual clauses and the EU-U.S. Data Privacy Framework. All the personal data we store sits in EU jurisdiction. Exception: technical logs — the row below |
| Cloudflare — technical logs (a separate stream) | server logs, 10% sampling | diagnostic entries: conversation identifier, device identifier, error codes — without conversation content, without numbers, without the e-mail address | Cloudflare stores the logs outside any assurance of EU jurisdiction; retention period in the order of a few days |
| OpenAI (USA) | translation engine — speech recognition, translation, voice synthesis; recording of the AI announcement for the other party | audio stream, translated text, digest of the device identifier | USA; the basis for the transfer is standard contractual clauses — OpenAI does not appear on the EU-U.S. Data Privacy Framework list (checked on 5 September 2026). Abuse logs up to 30 days, no use of the data to train models. We do not promise zero retention — that needs a separate addendum |
| DeepL SE (Cologne, Germany — EU) | speech-to-speech translation engine (DeepL Voice API, Pro plan) | audio stream and translated text during the conversation | No transfer outside the EEA: according to the supplier’s privacy policy, the content of Pro plan customers is processed in EU infrastructure and is not used to improve models. The Pro licence terms nevertheless reserve the supplier’s right to determine the processing location — we are confirming this in the data processing agreement before routing conversations to this engine. Content stored temporarily, in the event of errors for up to 72 hours |
| Google LLC (USA) — Gemini Live API | speech-to-speech translation engine | audio stream and translated text during the conversation | USA; EU-U.S. Data Privacy Framework (Google LLC is an active participant) and standard contractual clauses. Google does not use prompts and responses to improve its products — for users in the European Economic Area these rules cover all Gemini API services. Prompts and responses are stored “for a limited time” solely to detect abuse; the supplier does not state a specific period |
| Twilio Inc. (USA) | telephone calls; for traffic data (numbers, times) Twilio also acts as an independent controller | number dialled, calling number, call time, audio during the call (without recording) | standard contractual clauses and the EU-U.S. Data Privacy Framework. The call log (numbers and times) is available in the Twilio console for 13 months |
| Google Ireland Ltd / Google LLC | push notifications (Firebase Cloud Messaging), the Google Play store and payments | notification token; for purchases — transaction data (Google as the seller) | standard contractual clauses and the Data Privacy Framework |
| ElevenLabs (Eleven Labs Inc., USA) | creating your own voice and synthesizing translations when selected | voice sample, voice profile, translated text for speech synthesis | USA; processing terms in the ElevenLabs DPA. We do not guarantee EU-only storage or zero retention. |
| Palabra.ai | translation engine used according to mode and language pair | audio stream and translated text | Processing locations, retention and transfer terms are not confirmed here. We do not guarantee EU-only processing or zero retention. |
We also share data with the authorities where the law requires it.
4a. Which supplier translates your conversation — the system chooses, not you
The App has four translation engines: OpenAI, Palabra.ai, DeepL Voice and Google Gemini Live. Each of them receives an audio stream, not just text — this also applies to DeepL (the DeepL Voice product) and Google (Gemini Live). Our server makes the choice for a given translation direction (for example German → Polish) on the basis of quality and latency measurements. You do not choose the supplier in the app, so the audio of what you say and what the other party says may go to any of the suppliers listed in the table above — depending on the language pair.
Two things follow directly from how the code works: a conversation is never moved to another supplier while it is running (the engine chosen at the start runs it to the end, or the conversation is rejected with an error message), and an engine with no key configured receives no data at all — the request ends with an error before the number is dialled. In the conversation metadata we record which engine handled it, so on request we can say which supplier the audio of a particular conversation went to.
Face-to-face conversation mode in its automatic variant uses two Google Gemini Live sessions at the same time — one for each translation direction. The audio of both speakers therefore goes to Google in both directions of the conversation, not just one. The double API usage is borne in costs by DawidWeb, not by the pilot user.
4b. The number the other party sees (the calling number)
In the pilot phase we do not yet have a telephone number of our own for Palabra Live. Outgoing calls are placed from a verified private number belonging to the service owner. The consequences you need to know:
- the other party sees the owner’s private number on their display, not a Palabra number;
- if the other party calls back, the call will reach the owner, not you — the owner may in this way learn the other party’s number outside the app;
- the “to” number and the “from” number of every conversation are stored in the call log of the operator Twilio for 13 months.
Once a German or Polish number has been bought for Palabra Live, calls will be placed from that number, and this point will be updated before the app is published in the store.
5. How long we keep data
| Data | Period | Notes |
|---|---|---|
| Conversation audio | 0 — it is not saved | at the suppliers, depending on which engine handled the conversation (point 4a): OpenAI — up to 30 days in abuse logs; DeepL — temporary storage, in the event of errors up to 72 hours; Google (Gemini) — a “limited time” solely to detect abuse, period not stated by the supplier. Twilio does not record audio, but it keeps the call log (numbers and times) for 13 months |
| Translated text | until the end of the conversation (session memory) | it does not go into the database |
| The number dialled | for the duration of the conversation — in the conversation session memory on our server | it does not go into the conversation database. From backend 0.14.1 it is erased from session memory as soon as the conversation ends; Twilio has it in the call log for 13 months |
| Conversation metadata | no longer than 396 days (13 months), then only monthly totals | automatic deletion has worked since panel 0.9.3 (6 September 2026); a nightly alarm triggers it, and the panel shows a preview of the last run |
| Problem reports | no longer than 365 days from the closing of the report | |
| App events (start-up, crash) and conversation flow markers | no longer than 30 days | the switch in Settings → Privacy stops the collection |
| The answer to the after-call question | no longer than 30 days | the switch in Settings → Privacy turns off both the question and the record |
| Evidence from conversation tests | no longer than 396 days — as with conversation metadata | applies to the owner’s test runs, not to users’ conversations; deleted automatically in the same way as conversation metadata (panel 0.9.3) |
| Device identifier, licence | no longer than 730 days (24 months) without activity, or until the data is deleted | |
| Digests of numbers from the incoming call lists, notification token | until incoming calls are turned off or the data is deleted | the plain numbers live only in the server’s memory while the request is being handled — only the digests go into the database |
| Download events | no longer than 396 days (13 months) | without the IP address |
| Call history on your phone (the “Recents” tab) | 30 days, at most 50 entries | it does not sit on our server — the App enforces the period itself, recalculating it every time the list is opened and every time an entry is added. you clear the history yourself — a single entry with “Remove from history”, the whole list with “Clear history” or “Clear call history” under Settings → Privacy; a confirmed “Delete my data now” clears it too, as a separate step |
| Tombstone left after device data is deleted: a digest of the device credential and two timestamps, with no device identifier | 30 days | written in the same operation that erases the data; it serves to confirm the erasure and to reject credentials issued before it. It expires on its own (point 6) |
| Billing data (call costs, monthly totals) | 5 years from the end of the tax year | legal obligation. After the data is deleted, only an aggregate without the device identifier remains |
| Technical server logs (Cloudflare) | in the order of a few days | outside EU jurisdiction; deleting your data at your request does not cover them |
| Sample for creating your own voice | On our server only in working memory while handling the request | Sent to ElevenLabs. No permanent copy on our server does not mean the provider has deleted the data. |
| Own voice profile and its management data | Until confirmed deletion of the profile or account data | The model stays with ElevenLabs until deletion. See point 6 for deletion details and limitations. |
The periods given are maximums — they are the limits we do not exceed. Automatic deletion once those periods pass has worked since panel 0.9.3 (6 September 2026); if the nightly run fails, we still delete data older than the periods given by hand on request (point 6).
6. Your rights
You have the right to: access your data, have it corrected, have it erased, have processing restricted, data portability (data from the contract), object to processing based on legitimate interest, and withdraw consent at any time (without affecting earlier processing).
How to exercise them today — there are two routes. First, the “Delete my data now” button in Settings → Privacy, which has worked since App version 0.10.0 and starts the erasure at once, without waiting for anything to be handled by hand; the same screen lets you view and copy the device identifier. Second, an e-mail to kontakt@dawidweb.com — for every other request (access, correction, restriction, portability, objection) and for people who no longer have the App. To find the data linked to your phone, we need the device identifier or the e-mail address you received the pilot access code at; the date and approximate time of your last conversation also helps. We act on an e-mail request within 14 days (the rules allow a month for this). The “Download my data” button and the /usun-dane page are still being prepared and do not work today, so we do not promise a route here that does not yet exist.
What the deletion endpoint does (6 September 2026). DELETE /api/mobile/v1/device invalidates the device credential, erases its data, and the panel deletes the related conversations, events, device test evidence and audit entries that point to it; the monthly billing record stays, but without the device identifier. Once the server confirms, the App also erases what the phone holds: the device credential, the call history, the recently dialled numbers and the local call settings. The call history is a separate step of that erasure. You do not have to delete the account to get rid of the history alone — “Clear call history” under Settings → Privacy is enough.
Device credential tombstone after erasure. In the same operation that erases the data, the server writes a digest of the device credential and two timestamps — and nothing else, no device identifier. It is needed for two things: so that the service can confirm the data really was erased instead of answering “I do not know that device”, and so that credentials issued before the erasure are rejected if anyone tries to use them later. This record expires after 30 days and disappears on its own. Basis: Article 6(1)(f) (legitimate interest — demonstrating that the request was carried out, and access security).
What “deleting the data” means exactly. We erase your device record, problem reports and app events. Entries required by tax law (call costs, monthly totals), and evidence of administrative actions, stay, but in anonymised form: in place of the device and user identifier we write an irreversible marker, we replace the e-mail address, and the account gets the status “deleted”. After this operation those records can no longer be linked to you.
What deletion does not cover (we have no technical way of erasing there):
- the call log at the operator Twilio — call numbers and times, 13 months;
- abuse logs at OpenAI — up to 30 days;
- temporary copies of content at DeepL in the event of a processing error — up to 72 hours;
- logs of prompts and responses at Google (Gemini) kept to detect abuse — a “limited time”, period not stated by the supplier;
- technical server logs at Cloudflare — in the order of a few days.
This data expires by itself after the periods given.
You can lodge a complaint with the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl) or — if you live in Germany — with the competent state data protection authority (list: bfdi.bund.de).
Deleting your own voice. In Settings → Voice → My voice, select “Delete my voice”. The App requests profile deletion from ElevenLabs and confirms completion only after the provider responds. An operation in progress or without confirmation is not presented as completed. Deleting account data also includes the profile. We do not promise zero retention or a specific deadline for deleting all samples, backups or logs held by ElevenLabs; these depend on the provider’s processing terms.
After own voice data is deleted, a technical marker also remains to prevent previously started requests from creating the profile again. It contains no sample, voice model, name, device identifier or consent record and has no automatic expiry.
7. Is providing data compulsory
Without a device identifier and access to the microphone the app cannot translate. Contacts permission is voluntary — without it, only the incoming call filter stops working.
The own voice feature uses ElevenLabs and requires separate, explicit consent. You can record or import a sample of your own voice only. The Other Party hears a generated voice similar to yours. You can use the standard voice without creating a voice clone.
8. Security
Transmission is encrypted (TLS). Device credentials are stored in the Android Keystore. The data that stays on the phone — the incoming-call number lists and the call history — is encrypted with AES-256-GCM under a key from the Android Keystore. Service keys are in the owner’s vault and in Cloudflare secret variables, never in the app. The admin panel requires sign-in through Cloudflare Access with a second factor.
9. Data of the other party and of people on your number lists (Article 14 GDPR)
People in the call history on your phone. The numbers of the people you have spoken to — including those who called you — go into the “Recents” list on your phone and stay there for up to 30 days (points 3 and 5). Those entries never reach us: the history is not sent to the server and we have no access to it. Those people do not know their number is on your list; informing each of them separately would take disproportionate effort (Article 14(5)(b) GDPR), so this policy takes the place of that information — exactly as with the incoming-call number lists.
People on the “allowed / blocked” lists. If you turn incoming calls on, the numbers on those lists go to our server in plain form and are turned into digests there — we do not save the numbers themselves, and the digest cannot be reversed without our secret key. Those people do not know their number has ended up on a list; informing each of them separately would take disproportionate effort (Article 14(5)(b) GDPR), so this policy takes the place of that information.
The other party does not use the app, but their voice is processed live in order to translate a conversation they are knowingly having. We do not save their voice or the content of the conversation in the database; their number does not go into our database, but it does go into the call log of the operator Twilio for 13 months. The other party sees the calling number described in point 4b — in the pilot phase, the service owner’s private number. They are told about the translation by artificial intelligence by an announcement played at the start of the conversation in their language when enabled and by the User. The other party has the same rights as the User (point 6).
The wording and length of the announcement. On outgoing calls the shorter of the two approved wordings is played: 4.7 s in Polish, 5.1 s in German, 4.5 s in English and 5.3 s in Ukrainian. The content is the same — the other party is told that the conversation is being translated by artificial intelligence and that they are hearing a synthetic voice. The seconds of the announcement are not billed. While the other party’s number is ringing, the server plays you a ringing tone so that the silence does not look like a fault; the tone is generated by us, is not part of the conversation, and is not stored anywhere.
The AI announcement is on by default. The App provides a switch to turn it off before the conversation. Turning off the spoken announcement does not turn off speech processing by providers or the information about synthetic speech. The duty to tell the Other Party that they are speaking with an artificial intelligence system remains with the Provider of that system (Article 50(1) of the AI Act). Turning off the announcement does not transfer that duty to a User who is a consumer.
10. Children
The app is intended for adults. We do not knowingly collect children’s data.
11. Changes to the policy
We announce significant changes in the App. The current version is always at this address. Version 0.7 (draft), 8 September 2026.