The legal detail behind the Privacy Policy: who is responsible, on what legal basis each piece of data is processed, who processes it for us, and how to exercise your rights. Written to satisfy the information duties of Articles 13–14 of Regulation (EU) 2016/679.
The controller — the party that decides what happens to your data — is the team that runs HolosAccent (holosaccent.com, api.holosaccent.com), reachable at support@holosaccent.com, and it covers the client apps: the Android app, the Chrome extension, and the Telegram bot. One account and one API cover all three.
We have not appointed a Data Protection Officer — we are not required to (no large-scale processing, no special categories of data, no systematic monitoring at scale). Privacy requests go to the address above and are handled by the same small team that runs the service.
GDPR Article 6 requires a lawful basis for every processing activity. Ours are listed here; where the basis is your contract with us, the data is what the service cannot run without.
| Data | Why we process it | Legal basis |
|---|---|---|
| Username / email, password hash, Google account ID | Creating and running your account, syncing progress across the app, extension, and bot | Contract — Art. 6(1)(b) |
| Scores, transcripts, flagged sounds, per-sound statistics | Scoring your takes and targeting practice at your weaker sounds | Contract — Art. 6(1)(b) |
| Saved recordings (only if you save a take) | Keeping the takes you chose to keep in your history | Contract — Art. 6(1)(b) |
| Settings (accent, playback speed, auto-stop, noise suppression, theme) | Honouring your preferences on every device | Contract — Art. 6(1)(b) |
| Daily-limit counter (date, takes used) | Applying the free-tier quota you agreed to | Contract — Art. 6(1)(b) |
| Subscription status and Google purchase token | Recognising your subscription and removing the daily limit | Contract — Art. 6(1)(b) |
| Billing notifications from Google | Keeping tax and payment records; preventing fraud | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Push notification tokens (Firebase) | Delivering the daily-challenge notifications you enabled | Contract — Art. 6(1)(b); disable them in the app at any time (Art. 21 objection) |
| Server logs (timestamps, request metadata) | Operating the service and defending it against abuse | Legitimate interests — Art. 6(1)(f); kept short and never used to profile you |
We process no special categories of personal data (Article 9): we never ask for health, biometric, or political data, and we do not identify anyone by their voice. Your recording is scored against a target phrase and then discarded unless you choose to save it — it is training material, not a voiceprint.
Everything that makes the service work — scoring, transcription, text-to-speech, spelling checks, storage — runs on our own servers. Only these third parties process any of your data, each under a written data-processing agreement as Article 28 requires, and only on our instructions:
| Processor | What they process | Why |
|---|---|---|
| Google (Identity, Play Billing, Firebase Cloud Messaging) | Sign-in ID token, purchase token and subscription status, push notification token | The only third party in the path — sign-in, payment processing, and delivering notifications |
| Hetzner Online GmbH (EU — Finland region) | Everything at rest: database and object storage, on servers we configure and administer | Hosting the service itself |
Scoring, reference-audio synthesis, and spell-checking never leave this set: there is no third-party AI API in the path of your voice or your typed text.
Your account, history, statistics, and saved recordings are stored with our hosting provider in the EU (Hetzner, Finland region). Saved recordings sit in object storage there and are reachable only through links that expire after one hour.
Google — sign-in, Play billing, and push notifications — may process the identifiers described above in the United States. Those transfers rely on the EU–US Data Privacy Framework (Google LLC is a certified participant) and, as a backstop, the Commission's Standard Contractual Clauses. Nothing else leaves the EEA: your recordings, scores, and history are stored and processed only on our EU servers.
We do not sell your data, share it with advertisers, or run analytics or ad networks inside the app. Transfers, where they happen, are the two purposes above and nothing else.
Email support@holosaccent.com from your registered address (we verify identity before acting — never asking for more than the account already holds). We answer within one month, extendable by two for complex requests (Article 12(3)), free of charge. You can also complain to your national supervisory authority (Article 77) — that is the authority of the member state where you live, work, or where the problem happened (Article 77(1)); the list is published by the European Data Protection Board at edpb.europa.eu.
Your take is scored by a machine, with no human in the loop. That is not a decision with legal or similarly significant effect: the result is a training aid you see and act on (or ignore), not a grade, certificate, or gate on any service beyond the daily limit you agreed to. Article 22 therefore does not restrict it, and no human review is needed.
Your per-sound statistics exist to target your own practice suggestions — inside your account, visible to you. They are never used to group you with others, price you differently, or train anyone's models.
TLS on every connection; passwords stored only as hashes; recordings reachable only through short-lived signed links; production access limited to the people who run the service. We keep records of what we process and why (Article 30) — the tables on this page are the short version of them.
If a breach is likely to risk your rights, we notify the competent supervisory authority within 72 hours (Article 33) and tell you directly, in the app and by email, without undue delay (Article 34).
HolosAccent is not intended for children under 16, the default age for information-society services under Article 8(1), and we do not knowingly collect their data. For ages between that limit and the national one, information-society services require parental consent — we rely on Google Play's account handling for that where it applies. If you believe a child uses the service, write to support@holosaccent.com and we will remove the account.
support@holosaccent.com, from your registered address where you have one — that alone is enough for us to verify identity. We never ask for a passport scan or a recording of your voice.
Which right you are exercising is enough ("send me my data", "delete my account"). No legal formality is required, in any EU language we can reasonably handle.
An acknowledgement within days, a full answer within one month (extendable by two for genuinely complex requests), and no charge for the first reasonable copy. If we refuse part of a request, we say why and how to appeal.
You don't need a formal request for the most common ones: Settings → Clear my history erases takes, statistics, and saved recordings immediately, and account deletion by email removes everything within 30 days — see the Privacy Policy for both.