Privacy Policy
This Privacy Policy explains what personal data Shovia collects, why, how it is processed, who it is shared with, how long it is kept, and what rights you have. It covers the Shovia website (shovia.io) and the Shovia mobile app.
1. Who we are
Shovia is operated by Dvasha SIA, a company registered in Latvia (registration number 44103061353), legal address: Valmieras nov., Vecates pag., Vecate, "Zemdegas" - 13, LV-4211, Latvia ("Shovia," "we," "us"). Contact for all privacy matters: shovia@shovia.io.
Shovia is a business product. Companies buy team subscriptions and give their employees access. Accordingly:
- For account, team and billing data, Dvasha SIA is the data controller.
- For call recordings, transcripts and prospect research that employees create while using Shovia, the customer company decides what is recorded and researched, and Dvasha SIA processes that content on the customer's behalf to provide the service. A data processing agreement is available on request at shovia@shovia.io.
2. Data we collect
2.1 Account and team data
Your email address and a password (stored only as a one-way cryptographic hash, never in readable form). For team accounts: the team name, the members' email addresses, each member's role (administrator or member), whether their seat is active, and pending invitations.
2.2 Billing data
Subscriptions are paid on shovia.io through Stripe. Your card details are entered on Stripe's pages and are never seen or stored by Shovia. We store a Stripe customer reference, the number of paid seats, the subscription status and period dates. Invoices and payment records are kept by Stripe and by us as required by accounting and tax law.
2.2a Free trial record
To enforce one free trial per team, when a team starts a trial we store a one-way hash of the administrators' email addresses (a scrambled value from which the address cannot be read back). It is kept for up to 24 months, including after an account is deleted, and is used only to detect repeated trials.
2.3 Microphone audio, transcripts and analysis (mobile app)
When you start a session, the app records audio from your device's microphone until you stop it. It does not record in the background or without you starting a session. From the audio we create a text transcript split by speaker, a speaker breakdown, a sentiment read (overall and per segment), and a list of action items. You may add a label (for example who the call was with).
2.4 Prospect research and saved items (website)
When you use Prepare, Find Companies or Find Personas, the company names, person names, job titles, notes and other text you enter are processed to produce research and conversation plans, and the results can be saved as prospects, drafts and next steps tied to your account.
2.5 Technical data
Our servers log technical information such as IP address, request time and the type of request, for security, abuse prevention and troubleshooting. The website uses Cloudflare Web Analytics, which does not use cookies, to measure how pages are used (pages visited, approximate location, device and browser type). Google Analytics, which sets cookies and measures the same kind of usage, is loaded only if you click Accept in the cookie banner. You can change your choice at any time with Cookie settings; declining removes the Google Analytics cookies. The website stores a sign-in token in your browser's local storage so you stay signed in.
2.6 What we do not collect
We do not access your contacts, photos, location or other apps. We do not sell personal data and do not use your data for advertising.
3. How we use your data and legal bases (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service: accounts, teams, recording, transcription, analysis, prospect research | Account, team, audio, transcripts, research inputs | Performance of a contract (Art. 6(1)(b)) |
| Take payment and keep accounting records | Billing data | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Security, abuse prevention, rate limiting, fixing errors | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Preventing repeated free trials | One-way hash of administrator email addresses | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (Cloudflare, cookieless) | Technical and usage data | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (Google Analytics, cookies) | Usage data and cookie identifiers | Consent (Art. 6(1)(a)), given through the cookie banner |
| Respond to your enquiries | Email and message content | Legitimate interests / contract |
4. How a recorded session is processed
| Step | What happens | Where |
|---|---|---|
| Live listening | Audio is streamed to Shovia's server in real time to tell speakers apart as the conversation happens. | Shovia's servers (Frankfurt, Germany) |
| Session recording | The full audio is saved as a file so it can be transcribed and reviewed. | Shovia's servers (Frankfurt, Germany) |
| Transcription | The saved audio is sent to OpenAI's Whisper API to produce a text transcript. | OpenAI (sub-processor) |
| Sentiment analysis and action items | The text transcript (not the raw audio) is sent to OpenAI's API. | OpenAI (sub-processor) |
Speaker identification runs on Shovia's own servers with an open-source model and is not sent to any third party.
5. Who we share data with (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting of the website, application servers and database | Frankfurt, Germany (EU) |
| OpenAI | Transcription, sentiment analysis, action items, research and conversation plans | United States |
| Stripe | Subscription billing and payments | EU / United States |
| Lusha | Company and business-contact search for Find Companies and Find Personas (search terms are sent; results are business information) | See Lusha's privacy policy |
| Resend | Sending account emails (email confirmation, password reset, team invitations) | See Resend's privacy policy |
| Sentry | Error monitoring: technical error reports (no call content, no request bodies) | Frankfurt, Germany (EU) |
| Backblaze | Encrypted off-site backups of our databases (the backup files are encrypted by us before upload) | Amsterdam, Netherlands (EU) |
| Google (Analytics, only with your consent) | Website usage statistics | United States / EU |
| Cloudflare (Web Analytics) | Privacy-friendly website usage statistics | Global |
OpenAI processes the data we send it under its API terms, which state that API data is not used to train its models; OpenAI may retain API data for a limited period for abuse monitoring. See openai.com/policies/privacy-policy and stripe.com/privacy.
We do not sell your data and do not share it with data brokers or advertisers. We may disclose data if required by law or to protect our rights.
6. Transfers outside the EU/EEA
Our servers are in Germany. Some sub-processors (for example OpenAI and Google) process data in the United States. Where this happens we rely on safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
7. How long we keep data
| Data | Retention |
|---|---|
| Call audio files | Automatically deleted 90 days after the call, or earlier when you delete the call |
| Transcripts, sentiment and action items | Until you delete the call or your account is deleted |
| Saved prospects, drafts and next steps | Until you delete them or your account is deleted |
| Account and team data | Until the account is deleted |
| Free trial record (one-way hash of admin email) | Up to 24 months, also after account deletion |
| Billing and invoice records | As long as accounting and tax law requires |
| Encrypted backups of our databases | Rolling 30 days, then deleted automatically. Hosting snapshots are kept 7 days |
| Server logs | A limited period, normally no more than a few weeks |
8. Your rights and choices
- Delete calls: in the app, open Past calls and delete one call, several calls or all of them. Deleting a call removes its audio, transcript, sentiment and action items.
- Delete your account and data: in the app (menu, Delete account) or on shovia.io (My Team, Delete my account), after re-entering your password. This permanently deletes your login, recordings, transcripts, action items and saved prospects. A regular member is removed from the team and the team continues. A team administrator must first remove the other members; if the administrator is the team's last member, the team and its subscription are deleted too. You can also email shovia@shovia.io from the registered address. Deletion from our live systems is immediate; encrypted backups are overwritten or expire within 30 days.
- Your GDPR rights: you can ask us for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Email shovia@shovia.io; we reply within one month.
- Complaints: you may complain to the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), or to the authority in your country.
- Microphone permission: you can revoke it any time in your device settings; the app cannot record without it.
If you use Shovia through your employer's team account, requests about content your employer controls may need to go through your employer first; we will tell you if so.
9. Recording other people
10. Security
Data is sent over encrypted connections (HTTPS/TLS). Passwords are stored as one-way hashes. Access to team data is limited to the members of that team. No online service can be guaranteed to be completely secure, but we work to protect your data and will notify affected users and authorities of a breach as the law requires.
11. Children
Shovia is a business product and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has been collected, contact us and we will delete it.
12. Changes to this policy
We may update this policy as Shovia changes. The effective date above shows the latest version. For significant changes we will make reasonable efforts to notify users, for example in the app or by email.
13. Contact
Dvasha SIA, registration number 44103061353
Valmieras nov., Vecates pag., Vecate, "Zemdegas" - 13, LV-4211, Latvia
shovia@shovia.io