Thank you for using the VurboTalk software (hereinafter referred to as "the Product") provided by our company ("we", "our", "the Company").
We value your privacy and protect your personal data in accordance with:
- Taiwan Personal Data Protection Act
- EU General Data Protection Regulation (GDPR)
- Applicable U.S. state privacy laws (e.g., CCPA/CPRA, where relevant)
This Privacy Policy explains what data we collect, how we use it, how it is protected, and the rights you may exercise.
Scope of Data Processing: Two Independent Data Streams
The Product operates under two distinct data streams, each with its own rules and processing purposes.
Licensing & Account Data (Personal Data | GDPR Applies)
To provide licensing, subscription, and authentication services, we collect only the minimum data required:
- Email address
- License key or subscription ID
- License activation and usage status
- Google / Apple login identifiers
※ We do not collect your passwords.
GDPR Role
For this data stream, the Company acts as the Data Controller, determining how and why the data is processed.
Legal Basis (GDPR Article 6 – Contract Necessity)
Your data is used solely for:
- License activation
- Subscription validation
- Customer support and service delivery
Your data is not used for:
- Advertising
- Behavioral tracking
- AI model training
- Any undisclosed purposes
Live Translation Content (The Company Does Not Access It)
When you use live translation, all speech and conversation content:
- Is not routed through the Company's servers
- Is not stored on the Company's servers
We do not collect and do not access:
- Audio recordings
- Transcriptions
- Translation text
Processing Workflow (Device → Third-Party Service)
Your device sends content directly to:
- Microsoft Azure AI Speech – Speech to text
- OpenAI API – Translation
- Microsoft Azure AI Speech (text to speech) – Reading the translation aloud
The translated text is additionally sent directly over your local network to the paired device (Apple Bonjour/mDNS). It does not pass through the internet or any cloud service.
The Company does not receive or access this content at any stage.
GDPR Role Clarification
Since content is not stored on our servers, but we determine the processing path (e.g., choice of processors), the Company is considered a Data Controller, and Microsoft and OpenAI act as Data Processors for these operations.
Encryption & Transmission Security
During transmission between your device and third-party providers, content is protected using:
- TLS 1.2 or higher secure transport protocols
- Encryption suites offering AES-256 (or higher) equivalent security strength
These measures protect content against unauthorized access, interception, or tampering.
Issue Reports (User-Initiated)
Only if you choose to submit an issue report from within the Product do we collect:
- App version, device model, iOS version, device language setting
- The problem category you select and the description you write
- Your signed-in account email (if you are signed in)
- A connection diagnostic log
Issue reports do not include audio content, the content of any conversation message, or your network name (SSID), IP address, or MAC address.
Data Flow
Licensing & Account Data (GDPR Applies)
- User (Email)
- Google / Apple Authentication
- Company Authorization Server
Live Translation Content (The Company Does Not Access It)
- User Device
- (Direct Transmission)
- Microsoft Azure AI Speech / OpenAI API
- User Device (Result Displayed)
Device-to-Device Transfer (No Cloud)
- Counter Device
- (Direct Local-Network Transmission)
- Guest Device
Personal Data Protection Commitments
Before enabling any third-party service, we assess whether that provider affords your data protection that is the same as or equivalent to the protection described in this policy.
For each of the third-party services above, we confirm and commit that:
- Each third party processes your data as our Data Processor, under a written data processing agreement
- It is contractually bound to process your data only on our instructions, and only to provide the functions described above
- It is bound by confidentiality and information-security obligations no less protective than those we apply ourselves
- It does not use your content to train or improve AI models. We have not enabled, and will not enable, any data-sharing or model-improvement option these providers offer
- We do not perform behavioral analysis, advertising, or promotional targeting
- We do not build user behavioral profiles
- We do not conduct cross-platform tracking
Based on each provider's current published terms:
- Microsoft states that for real-time speech to text, audio input is processed only in server memory and no data is stored at rest, and that it does not retain or store the text submitted to the real-time text-to-speech API.
- OpenAI states that data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in to share data; we have not opted in. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days, used only to detect misuse of the service, after which they are deleted.
We review these commitments periodically and will update this policy if a provider's terms change in a way that affects you.
Disclosure of Data to Third Parties
We will never provide, sell, rent, or exchange your data with third parties unless:
- You have given explicit consent
- Required by law
- Necessary to prevent harm to life, health, or safety
- Necessary for public safety
- Necessary to protect your lawful rights
GDPR Rights (For Residents of the EU)
You may exercise the following rights:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object to specific processing activities
Please contact us at: euasales@ipevo.com
Policy Updates
This Privacy Policy may be updated due to regulatory or technical changes. Updates will be posted on:
- The official Vurbo.ai website
- In-product interface or user manuals
- Release notes when applicable
Privacy Summary
- Only licensing and account data are stored by the Company and covered by GDPR.
- All speech and conversation content is neither routed through nor stored on the Company's servers; we never access it.
- Live translation runs as a direct connection between your device and Microsoft Azure AI Speech / OpenAI API.
- Translated text is transferred directly between the two devices over your local network, never through the cloud.
- None of these third parties use your content to train or improve AI models.
- Our system follows a strict "data minimization" design for maximum privacy and security.