Privacy Policy
Important: The German version of this document is legally binding under Austrian law, irrespective of the reader's jurisdiction (Versa Training GmbH is an Austrian company). This English version is an informational translation provided for convenience only. EU consumer protections of your country of residence apply regardless of this binding-language clause (Rome I Regulation, Art. 6(2)). In case of conflict between the German and English texts, the German text governs.
This Privacy Policy applies to all users of the platform. Sections marked "Direct users only" apply solely to users who have registered directly with Versa (Scenario A). If your organisation provides the platform (Scenario B), your organisation will inform you about the processing of your data within the framework of that contractual relationship.
Where personal designations are used in one grammatical gender only, they refer to all genders.
1. Who We Are
Versa Training GmbH ("Versa", "we", "us") operates the Versa speech training platform (the "Platform").
Versa Training GmbH Steinberg 204, 8151 Hitzendorf, Austria FN 669696 (company register number) E-mail: privacy@versa.training
Data Protection Officer: Not currently required (Art. 37 GDPR). For all data protection enquiries: privacy@versa.training.
2. Scope
If you have registered directly (Scenario A): Versa is the controller for all your data. This Privacy Policy is your complete data protection notice.
If your organisation provides the platform (Scenario B): Your organisation will inform you about the processing of your data within the framework of that contractual relationship. This Privacy Policy additionally governs Versa's independent activities and your rights vis-à-vis Versa. All sections not marked "Direct users only" are relevant to you. You may exercise your rights against Versa directly at privacy@versa.training. The processing carried out on behalf of your organisation is additionally governed by the Data Processing Agreement (DPA) concluded between Versa and your organisation.
3. What Data Versa Collects
Direct users only (Scenario A). If your organisation provides the platform, your organisation will inform you.
| Category | Examples | Legal basis |
|---|---|---|
| Account data | Name, e-mail, role | Performance of a contract (Art. 6(1)(b)) |
| Training data | Audio recordings (optional), transcripts, AI assessments, scenario configurations | Performance of a contract (Art. 6(1)(b)) |
| Camera data (self-view) | Webcam stream, where you enable the self-view — stays local in your browser; not transmitted to Versa, not recorded (see Section 11) | Not applicable: no processing by Versa |
| Performance data | Completion status, results, session metadata | Performance of a contract (Art. 6(1)(b)) |
| Usage and technical data | Feature usage (product analytics, see Section 4), IP address, device type, error logs | Legitimate interest: platform operation and troubleshooting (Art. 6(1)(f)) |
4. Versa's Independent Activities
Applies to all users.
Versa acts as an independent controller for the following activities. These processing operations serve to provide and improve the platform — more accurate assessments, more realistic conversations, faster coaching feedback for everyone.
| Activity | What happens | Legal basis |
|---|---|---|
| Account management | Account data, billing | Performance of a contract (Art. 6(1)(b)) |
| Platform security | Abuse detection; pseudonymised data for up to 90 days | Legitimate interest: protecting the platform and its users (Art. 6(1)(f)) |
| Anonymised analytics | Aggregated usage statistics | — (anonymised data are not personal data) |
| Product analytics | Pseudonymous usage events in the app — which features are used, never conversation content (details below) | Legitimate interest: product improvement (Art. 6(1)(f)) |
| Cross-customer analytics | Pseudonymised performance statistics, assessment accuracy | Legitimate interest: improving assessment quality for all users (Art. 6(1)(f)) |
| Feedback-based AI quality improvement | Your feedback is used, after pseudonymisation, to improve AI models (see Section 5 for details) | Legitimate interest: more accurate AI assessments and coaching (Art. 6(1)(f)) |
| Moderation and safety | Flagged content for safety systems after pseudonymisation | Legitimate interest: protection against misuse and harmful content (Art. 6(1)(f)) |
Legitimate interest (Art. 6(1)(f) GDPR) means: Versa has a legitimate reason for this processing and has verified, in a documented balancing exercise, that the interests, rights, and freedoms of the data subjects do not override it. This documentation is available on request.
Versa uses your data exclusively to provide the services and to improve and further develop the services. Versa does not use your data for marketing, profiling, sale, or disclosure to third parties for their own purposes.
Product analytics
To understand which features are used and where users get stuck, Versa collects pseudonymous usage events in the app (e.g. "scenario opened", "conversation started") via PostHog, hosted in the EU (Frankfurt; see the sub-processor list). What this means:
- Pseudonymous: events are linked to an internal user ID — never to your name or e-mail address.
- No content: events never contain what you or the AI said, your scores, feedback texts, notes, file names, or web addresses — only which functions are used.
- No individual evaluation: Versa does not use this data to assess individual trainees.
- No cookies: product analytics works entirely without cookies or any other storage on your device.
- Retention: events are deleted after 12 months.
- Your objection (Art. 21 GDPR): you can switch product analytics off at any time under Profile → Preferences. The setting is stored in your account and applies on all your devices. You can also write to privacy@versa.training.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR), documented in a balancing assessment (Legitimate Interest Assessment), available on request.
5. AI Quality Improvement
Applies to all users.
When you rate an AI assessment (thumbs up/down and similar feedback), you help Versa understand where the AI performs well and where it does not. This signal — and the associated conversation segment — is used, after pseudonymisation, to improve AI assessments for all users of the platform.
What constitutes feedback data
The AI result you rated, the input that produced it, and your feedback itself — limited to the assessed segment. Not the entire session.
How we protect your data
- Pseudonymisation: Your direct identifiers (name, e-mail) are removed before any training use and stored separately. Currently only text transcripts are used for AI quality improvement — no audio or video recordings.
- No biometric identification: We do not extract or store voice prints or speaker recognition data.
- No merging: Your data are not merged with data of other users before pseudonymisation.
- No disclosure: We do not disclose your data to third parties for their own AI training. Sub-processors are likewise prohibited from doing so.
Your choices
You may object to the use of your data for AI quality improvement. This is your right to object under Art. 21 GDPR. You can set the objection under Settings → Privacy or send a request by e-mail to privacy@versa.training. Your coaching feedback (the AI assessments of your exercises) will continue to be displayed in the platform — this is normal service operation and is unaffected.
Once your feedback has been incorporated into the AI, this improvement cannot be reversed. AI models do not store individual data records — feedback data flow into model weights and cannot be isolated after the fact. Your future data will no longer be used following your objection.
6. Special Categories of Data
We do not intentionally collect or process special categories of personal data (Art. 9 GDPR). Do not enter real health information or other sensitive data. If you inadvertently disclose such data, please contact privacy@versa.training.
7. Data Retention
For direct users (Scenario A)
| Data | Retention period |
|---|---|
| Transcripts and AI assessments | Duration of contract; early deletion possible |
| Audio recordings | Duration of contract; early deletion possible |
| Camera self-view | Not stored (local stream, no recording) |
| Session metadata | Duration of contract + 30 days |
| Usage metadata | 12 months, then anonymised |
| Billing data | Duration of contract + 7 years (Austrian Federal Fiscal Code, § 132) |
For Versa's independent activities (all users)
| Data | Retention period |
|---|---|
| Account data | Duration of contract + 30 days |
| Security and system logs | 90 days |
| Pseudonymised performance statistics | 12 months, then anonymised |
| Product analytics events (pseudonymous) | 12 months, then deleted |
| Moderation data (pseudonymised) | 90 days |
| Anonymised data | Indefinitely (not personal data) |
| Feedback data (in the model) | Stored as part of the model |
| Feedback data (pseudonymised, not yet in the model) | End of contract + 12 months |
To request deletion of conversation histories, recordings, or assessments: privacy@versa.training.
8. Recipients of Your Data
Recipients of your data may include:
- Sub-processors: Service providers who process data on our behalf, on the basis of written data processing agreements
- Authorities: Only upon statutory order; Versa does not voluntarily disclose data to authorities
- External advisors: Legal, tax, and audit advisors in the course of their professional activities, bound by statutory duties of confidentiality
We do not sell personal data. Sub-processors may not use your data for their own purposes.
Sub-processor list: app.versa.training/legal/subprocessors. Changes are notified at least 7 days in advance.
9. Your Rights
You may exercise the following rights at any time:
| Right | Contact |
|---|---|
| Right of access (Art. 15) | privacy@versa.training |
| Right to rectification (Art. 16) | privacy@versa.training |
| Right to erasure (Art. 17) | privacy@versa.training |
| Right to restriction of processing (Art. 18) | privacy@versa.training |
| Right to data portability (Art. 20) | privacy@versa.training |
| Right to object (Art. 21) | privacy@versa.training or account settings |
Response time: Within one month. For complex or numerous requests, the period may be extended by up to two further months — we will inform you in advance (Art. 12(3) GDPR).
Free of charge: The exercise of your data protection rights is free of charge for you (Art. 12(5) GDPR).
Complaints
Austrian Data Protection Authority (Datenschutzbehörde) Barichgasse 40-42, 1030 Vienna dsb@dsb.gv.at — https://www.dsb.gv.at
10. Speech Behaviour Analysis
Direct users only (Scenario A). If your organisation provides the platform, your organisation will inform you.
The platform analyses aspects of your speech behaviour (pace, clarity, communication patterns) to provide you with coaching feedback. This analysis is used exclusively for coaching purposes.
Versa does not make automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR.
Versa does not extract or store voice prints or speaker recognition data.
11. Webcam and Self-View
Applies to all users.
The platform offers an optional self-view feature using your webcam. You can turn it on or off yourself in the settings before and during a training session — it is off by default.
When you enable the self-view:
- Your browser will ask you for permission to access the camera. Without your consent the camera will not be activated.
- The video image is displayed only locally in your browser — as a mirror for yourself.
- Nothing is transmitted to Versa, to the AI conversation partners, or to any sub-processor.
- No recording takes place — the stream exists only for the duration of the session in your device's memory.
- No AI analysis of your video image takes place (no facial-expression, gesture, or identity recognition).
You can switch off the self-view at any time via the platform interface. Camera access ends immediately (your camera's indicator light turns off).
Because Versa neither receives nor stores the video image, there is no processing within the meaning of the GDPR by Versa as a controller. Control over camera access remains entirely with you and your browser.
12. International Data Transfers
We process data within the EEA by default. By agreement, services with processing locations outside the EEA may also be used. The current list of providers and processing locations is available at app.versa.training/legal/subprocessors.
Where transfers outside the EEA are required, the following safeguards apply in accordance with Art. 46 GDPR:
- DPF-certified providers: The European Commission's adequacy decision applies
- Non-DPF-certified providers: EU Commission Standard Contractual Clauses with Transfer Impact Assessments
Provider-specific processing locations and data use practices may differ. Individual providers claim the right to use de-identified derivations for their own purposes. Details per provider are available at app.versa.training/legal/subprocessors. You choose via the platform which provider is used for your training sessions. A copy of the applicable Standard Contractual Clauses is available on request: privacy@versa.training.
13. Children and Young People
Direct users only (Scenario A). If your organisation provides the platform, your organisation will inform you.
Minimum age: 14 years (Austrian Data Protection Act, § 4(4)). Use by persons under 14 is not permitted. Versa provides age-appropriate transparency materials.
14. Cookies
The platform uses only essential cookies for authentication and session management. First-party cookies only. No tracking, no profiling, no third-party cookies. No consent required.
15. AI Transparency
The platform contains AI systems within the meaning of Regulation (EU) 2024/1689 (AI Act).
- AI interaction: Where AI systems interact directly with you (e.g. AI conversation partners), you will be informed of this.
- AI-generated content: Assessments, feedback, and coaching recommendations are identified as AI outputs.
16. Security
We protect your data through:
- Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
- Access controls: Role-Based Access Control (RBAC), Row Level Security (RLS) on all database tables, graduated access controls for administrative access
- Data separation: Tenant separation at database level
- Confidentiality: All employees are subject to confidentiality obligations
- Infrastructure: EU-hosted cloud infrastructure at ISO-27001-certified data centres
Full technical details: app.versa.training/legal/security-measures.
17. Data Protection Impact Assessment
Versa has determined that a Data Protection Impact Assessment (DPIA) is required for the AI-based assessment of training performance. The DPIA documentation is available on request.
18. Is the Provision of Your Data Required?
Account data (name, e-mail) are required to use the platform. Without providing account data, no account can be created and the platform cannot be used.
Objecting to AI quality improvement has no effect on your platform access.
Direct users only (Scenario A).
Training sessions involve the processing of conversation data as part of the service. Those who do not wish to use the training function may continue to use the other platform features; however, training is not possible without the processing of conversation data.
The webcam self-view is an optional feature with no effect on training; with the camera disabled, all other training functions remain fully usable.
19. Changes to this Privacy Policy
Versa updates this Privacy Policy when the processing of personal data changes or when legal requirements so require.
For all changes: Versa will display a persistent in-app banner the next time you open the platform, informing you that the Privacy Policy has been updated. The banner will link to the new version. You are responsible for taking note of the changes by opening the platform and reading the banner.
For material changes (change of legal basis, new categories of recipients, changed retention periods, new processing purposes, new international data transfers), the following additionally applies: the next time you log in after the changes take effect, you will be prompted to acknowledge the new Privacy Policy before you can continue to use the platform. You may either acknowledge and continue using the platform or log out. No e-mails will be sent regarding changes to the Privacy Policy.
The current version is available at any time at app.versa.training/legal/privacy-policy. The "Date" field at the top of this document shows when the current version entered into force.
20. Contact
Data protection: privacy@versa.training Support: support@versa.training Post: Versa Training GmbH, Steinberg 204, 8151 Hitzendorf, Austria
Versa Training GmbH — Austria