Who we are and scope
Sansa Group AB, acting through its responsible subdivision Sansavision, is the controller for personal data processed through the VocalMax website and account service. We are based in Gothenburg, Sweden. This policy applies to the VocalMax iOS app, this website, account sign-in, purchase verification, support, and related services.
VocalMax is built so core voice analysis can work without sending your voice recording to us. On-device processing is a product boundary, not just a policy promise.
Data we process
On your device
The app may process microphone audio, speech recognition results, acoustic measurements, calibration mode, course progress, and session history locally. Calibration recordings and derived voice results stay on your device unless you deliberately export or share a result using the operating system share sheet.
Account and website data
- Email address, account identifier, email verification status, session tokens, sign-in timestamps, and basic security metadata such as IP address and user agent.
- Cookie consent preference and essential session cookies.
- Support messages and the contact details you include.
- App Store transaction identifiers, product identifier, subscription status, expiration date, environment, and verification timestamps. We do not receive your full payment card details.
- Technical request logs used to secure and operate the service. Optional analytics are disabled unless you consent and we enable a disclosed analytics provider.
Data we do not intentionally collect
We do not intentionally upload voice recordings for analysis, sell personal data, create advertising profiles, or infer medical conditions, race, ethnicity, sexual orientation, political views, or other sensitive traits from your voice.
Why and how we use data
| Purpose | Data | GDPR basis |
|---|---|---|
| Secure passwordless sign-in and account continuity | Email, verification token or code, session and security metadata | Contract and legitimate interests in account security |
| Verify Premium entitlement | App Store transaction and product metadata | Contract and legitimate interests in fraud prevention |
| Support, safety, and troubleshooting | Messages, request logs, device and app details you provide | Contract and legitimate interests |
| Optional measurement of website use | Limited analytics events if enabled | Consent |
| Comply with tax, consumer, accounting, and legal duties | Relevant transaction and correspondence records | Legal obligation |
Retention and deletion
- On-device calibration data remains until you remove it in Settings, delete the app, or erase your device.
- Account records remain while the account is active and are normally deleted or anonymised within 30 days after a verified deletion request, subject to security backups and legal duties.
- Short-lived sign-in tokens expire within 10 minutes. Sessions normally expire after 30 days and may refresh while used.
- Security logs are normally retained for up to 30 days unless a longer period is needed to investigate abuse or an incident.
- Entitlement and transaction metadata is retained while needed to provide access, resolve billing disputes, prevent fraud, and meet accounting or legal requirements.
- Cookie consent is retained for up to 180 days.
We may keep a minimal suppression record where necessary to respect an opt-out or deletion request.
Your GDPR and privacy rights
Depending on where you live, you may ask to access, correct, delete, restrict, object to, or receive a portable copy of personal data. You may withdraw consent at any time without affecting earlier processing. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.
Email privacy@sansavision.com. We may verify your identity and authority before completing a request. We normally respond within one month under the GDPR, subject to lawful extensions.
California notice
This section supplements the policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act. In the preceding 12 months, we may have collected identifiers, internet or network activity, commercial information related to an App Store subscription, and correspondence. Sources include you, your device, Apple, and our service providers. We use these categories for the business purposes described above.
You may request to know, access, correct, delete, or receive a portable copy of covered personal information, and may not be discriminated against for exercising a right. You may use an authorised agent, subject to verification of the agent and your authority.
We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics. Therefore, we do not provide a “Do Not Sell or Share” link. If these practices change, we will update this notice and provide the required choices before the change.
Submit a request at privacy@sansavision.com. We will verify requests in proportion to their sensitivity and respond within the period required by California law.
Security and children
We use encryption in transit, hashed sign-in tokens, short token lifetimes, rate limits, restricted production secrets, and access controls. No service can guarantee absolute security, so please report concerns promptly.
VocalMax is not directed to children under 13, and we do not knowingly collect their personal data. In the European Economic Area, users below the local age of digital consent should use the service only with valid parent or guardian authorisation. Contact us if you believe a child provided data improperly.
Contact and changes
Privacy contact: privacy@sansavision.com
Controller: Sansa Group AB, Sansavision subdivision
Location: Gothenburg, Sweden
We may update this policy as VocalMax changes. Material changes will be highlighted in the app or website and, where required, we will ask for consent again.