Política de privacidad y cookies

1. Who is responsible for your data?

Verbasync Inc., operating under the Amigo brand ("Verbasync", "Amigo", "we", "us"), is the controller of personal data processed through this website and the Amigo service unless a customer agreement identifies a care provider, research sponsor, or other organization as controller. In that case, Verbasync may act as its processor.

Privacy contact and requests: hello@tryamigo.io. Privacy Officer: Alain Briez. You may also use contact@verbasync.com for general questions.

2. Scope and nature of the service

Amigo is a conversational companion designed to support social connection, cognitive engagement, wellbeing monitoring, and non-clinical summaries. It is not an emergency service, medical device, diagnosis, treatment, or substitute for professional judgment.

This policy covers website visitors, older adults using Amigo, family members, caregivers, customer personnel, research participants, and other authorized users.

3. Data we collect

• Account and identity data: name, contact details, role, organization, authentication and account settings.
• Service data: phone number, declared interests, call schedules, preferences, instructions, and authorized relationships.
• Conversation data: audio where enabled, transcripts, interaction metadata, and content shared during conversations.
• Derived data: conversational memory, summaries, wellbeing signals, alerts, linguistic or acoustic measures, and service-quality outputs.
• Website and device data: IP address, browser, device, approximate location, pages viewed, referral source, and consent choices.
• Enquiry and commercial data: form submissions, correspondence, demo requests, order, billing, and contract information.
• Research data: study identifiers, protocol data, and irreversibly anonymized datasets where applicable.

4. Why we process data and our legal bases

• Provide the service and perform a contract, including accounts, calls, authorized sharing, support, billing, and security.
• Comply with legal obligations, respond to lawful requests, maintain records, and protect users.
• Pursue legitimate interests such as service security, fraud prevention, product improvement, and responding to business enquiries, where those interests are not overridden by your rights.
• Use consent for optional recordings, optional research participation, non-essential cookies, marketing, and other activities where consent is required. Consent can be withdrawn at any time.
• Where conversation data reveals health information or other special-category data, we rely on explicit consent or another applicable legal condition under Article 9 GDPR and relevant local law.

5. Cookies, local storage, and tracking tools

We do not activate optional tools before your choice. Necessary technologies support security, login, core features, and storage of your consent preference. Optional categories can be accepted or refused separately and changed at any time using “Cookie settings” at the lower-left of the page.

• Necessary: authentication, security, language or interface settings, and the local record of your consent choice. These cannot be switched off through the banner.
• Functionality: Crisp live support, when enabled. Provider: Crisp IM SAS. Purpose: optional support chat and related preferences.
• Analytics: Google Tag Manager, Google Analytics, Vercel Analytics, and Vercel Speed Insights, when configured. Purpose: audience measurement, performance, and product improvement.
• Marketing: Meta Pixel, when configured. Purpose: campaign attribution, conversion measurement, and audience reporting.

6. Consent and withdrawal

Rejecting optional technologies does not reduce access to the public site. We record your categories, policy version, and choice date in your browser for up to six months, then ask again. Withdrawing consent stops future loading after the page refresh and removes accessible Google, Meta, and Crisp cookies where technically possible. You may also delete browser storage and cookies.

Google and Meta tags must also be configured in their respective dashboards and, for Tag Manager, assigned the appropriate consent requirements before production use.

7. Who receives data

Access is limited to authorized personnel and vendors that need data to provide contracted services. Categories may include hosting and infrastructure, communications, voice and AI processing, customer support, analytics, payment, security, and professional advisers. Vendors are bound by confidentiality, security, and data-processing terms. Personal data is not sold.

Data may also be shared with an authorized care provider, family member, representative, research sponsor, or public authority when the applicable agreement, your authorization, or law permits it.

8. Research and anonymized information

Research participation and research use requiring consent are optional and separately explained. Refusal does not affect ordinary access to the service. We may create irreversibly anonymized datasets that can no longer identify a person. Properly anonymized information is not personal data and may be retained, licensed, shared, or used for research and service development.

9. International transfers

Data may be processed in countries outside your residence, including the United States. For restricted transfers from the EEA, United Kingdom, or Switzerland, we use an applicable adequacy decision, approved standard contractual clauses, the UK addendum, or another lawful safeguard, with supplementary measures where appropriate. You may request information about the relevant safeguard.

10. Retention

• Core account, conversation, audio, transcript, summary, and alert data: generally until one year after the applicable service or contract ends, unless the agreement, consent, or law requires a different period.
• Contact and business enquiries: generally up to 24 months after the last meaningful interaction.
• Billing, tax, legal, security, and audit records: for the period required by applicable law or necessary to establish, exercise, or defend legal claims.
• Analytics and marketing data: according to the configured provider period, generally no longer than 14 months for event-level analytics unless a shorter period is selected.
• Anonymized data: may be retained indefinitely because it no longer identifies an individual.

11. Security

We use proportionate technical and organizational measures, including access control, encryption in transit and at rest where appropriate, logging, monitoring, vendor review, backups, and incident response. No system is completely secure; please contact us promptly if you suspect unauthorized access.

12. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent without affecting earlier lawful processing; and receive information about applicable automated processing. We normally respond to verified GDPR requests within one month, subject to lawful extensions.

Send requests to hello@tryamigo.io. We may need to verify your identity or route a request to the organization acting as controller. You may lodge a complaint with the data-protection authority where you live or work, or where an alleged infringement occurred.

13. Automated processing and children

Amigo uses automated systems to create non-clinical summaries, signals, and alerts. These outputs do not make decisions producing legal or similarly significant effects and must not replace human review.

The service is not directed to children. It may be used for an adult who needs support only with valid consent or authorization from the person or a legally authorized representative, as applicable.

14. Changes and contact

We may update this policy to reflect service, legal, or vendor changes. We will post the new date and provide additional notice when required. Materially new consent-based uses will require a new choice.

Questions or requests: Alain Briez, Privacy Officer — Verbasync Inc. — hello@tryamigo.io.