Your words. Your choices.

Who is responsible

Vera is provided by Nestor Code Crafters UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany, registered at Amtsgericht Charlottenburg under HRB 266329 B. We are the controller of personal information processed to provide Vera. Contact us about privacy at contact@nestorcodecrafters.com. Our legal notice contains the full company details.

Information you provide and Vera creates

We process your telephone number for sign-in codes, calls, and messages; your name and contact email; and your profile, reflection questions, habits, preferences, and schedules. Your account identifier connects this information to your account.

During a call, your voice passes through communications and AI services for the conversation and transcription. We store transcripts, messages, answers, generated journals, saved memories, and related reflection information. Vera also generates mood labels, scores, trends, and other interpretations. These can be inaccurate and are not medical assessments.

Your reflections may reveal health information or other sensitive details, including beliefs, relationships, or sexuality. Share only what is needed. Keep medical records, passwords, sign-in codes, financial account and payment-card numbers, government identifiers, and other people’s private information out of conversations. These precautions do not change our responsibilities for information we receive.

We receive subscription, transaction, purchase-history, and entitlement information to manage membership. Apple handles payment details; Vera does not receive your full payment-card number. Our services also process IP addresses, device and app information, request timestamps, call and message delivery records, usage and cost information, and technical errors.

Saving Vera’s number uses Apple’s contacts interface and permission system. Vera does not upload your address book. Product analytics with PostHog and new AI-content exports to Langfuse are disabled in this release. Subscription reporting and operational records remain active. Historical troubleshooting traces may contain prompts, outputs, and account or session identifiers.

Purposes and legal bases

We use account, schedule, and membership information to provide the service you request, under Article 6(1)(b) GDPR. AI conversations, transcription, personalization from past context, journals, memories, and mood interpretations rely on your consent under Article 6(1)(a). Where this involves health or other special-category information, we request explicit consent under Article 9(2)(a).

We process information for applicable legal obligations under Article 6(1)(c), and for proportionate security, fraud prevention, reliability, and support under Article 6(1)(f). Our legitimate interests are protecting accounts and operating a reliable service. We use only information appropriate to those purposes.

Your telephone number and account information are needed to sign in and receive calls. Conversation processing requires your AI consent. You choose what to discuss and which optional profile information to supply. Without consent, AI features cannot operate. Consent is separate from your subscription contract.

Services that receive information

Vera uses the following services to operate the app:

• Supabase: authentication and storage of account, journal, message, schedule, and related application data.
• Twilio: telephone calls, SMS, and audio streaming, including telephone numbers, audio, message content, and delivery records.
• Vercel AI Gateway: routing AI requests containing audio, transcripts, messages, relevant journal context, and request attribution.
• OpenAI, xAI, Anthropic, and Google: AI responses, transcription, journals, memories, and insights through the configured routes and fallbacks. Only providers handling a request receive its content.
• Langfuse: historical AI troubleshooting traces. New trace exports are disabled.
• RevenueCat: purchase validation, membership entitlements, and subscription reporting associated with your Vera account identifier.
• Apple: app distribution, payments, and subscription management under Apple’s own terms and privacy information.
• Hetzner Online GmbH: backend hosting, application processes, and operational logs.

Service providers may use subprocessors to supply these functions. Their role depends on the service and applicable terms; Apple and some providers also process service, security, or transaction records for their own purposes. Authorized personnel may access information when needed for support, operations, or a legal obligation. We may disclose information where legally required or necessary to protect legal rights.

Vera uses cloud processing. Your journal is not protected by end-to-end encryption that prevents these services from processing its contents. We do not sell your personal information, use your private journal for targeted advertisements, or track you across other companies’ apps and websites for advertising. We do not use your journal to train our own general-purpose AI model. Provider processing and retention depend on the service and route; we do not promise universal zero retention.

International processing

Our application database is hosted in Frankfurt and our backend in Falkenstein, Germany. This does not mean all processing remains in Germany or the European Economic Area. Communications, AI, purchase, support, and infrastructure services can process information in the United States and other countries where they or their subprocessors operate.

Applicable provider data-processing terms provide for international transfer safeguards, including European Commission standard contractual clauses and, where applicable, adequacy decisions or binding corporate rules. These are described in the Supabase, Twilio, Vercel, and RevenueCat data-processing terms. Contact us for information about the safeguards applicable to your information or to request a copy, with confidential business information redacted where necessary.

Retention and deletion

We keep account and journal information to provide your account until you delete it using an available control, request erasure, or delete your account, subject to necessary legal exceptions. This also applies to accounts where onboarding was not completed. Vera does not currently apply an automatic inactivity expiry to accounts.

Vera buffers live audio for AI processing and transcription; our application does not persistently record calls. Communications and AI providers may separately retain request, audio, message, security, billing, or abuse-monitoring records under their applicable service terms. Those records do not all share the same retention period or disappear immediately when a Vera account is deleted.

Application and worker logs rotate by size, up to three 10 MB files per container, so their retention varies with activity. Historical Langfuse traces have no automatic expiry configured by Vera; account deletion requests erasure of traces attributed to that account. We keep support correspondence while handling the request and for relevant legal claims or obligations. Required accounting and transaction records are retained for their applicable statutory periods, with access restricted to those purposes.

Account deletion pauses AI processing and ends active Vera sessions. It removes the Vera account and related database data, deletes the RevenueCat customer, requests deletion of historical traces attributed to the account, and deletes linked Twilio call and message records that Vera holds identifiers for. Provider deletion may be asynchronous. If a required cleanup request fails, your account stays paused and the app asks you to retry.

This process does not erase every independent provider record. For example, authentication SMS records are not linked to Vera’s message cleanup, and providers may retain legally required or security records. Contact us for an erasure request covering information outside the app’s controls. Our application database has no managed backup recovery service configured; do not rely on account deletion being reversible.

Your controls and rights

You can review your journal and manage memories, questions, schedules, and preferences in the app. Open AI consent from Profile, onboarding, or the membership screen to withdraw consent. Withdrawal pauses future AI calls, messages, journal generation, and memory processing and ends active Vera sessions. Requests already sent to a provider may finish. Saved information remains until you delete it. Accepting the current disclosure again resumes AI features and enabled schedules. Withdrawal does not affect earlier lawful processing.

Permanent account deletion is available in Profile and on the membership screen. Withdrawing consent or deleting your account does not cancel your Apple subscription. Manage renewal separately in your Apple Account settings.

Depending on applicable law, you can request access, correction, erasure, portability, restriction, or objection, including objection to processing based on legitimate interests. Contact contact@nestorcodecrafters.com. We may need proportionate information to verify your identity. Please do not send passwords or sign-in codes. You may complain to your local data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

Age, automated features, and policy changes

Vera is for adults aged 18 or older. The app asks you to confirm your age before the onboarding call. AI-generated journals, memories, mood interpretations, and check-ins support personal reflection. Vera does not use them to make decisions about employment, credit, insurance, or other similarly significant matters. Vera is not a therapist, medical service, or emergency service.

We will update this dated policy when processing changes and obtain new consent before starting processing that requires it. The public website provides product and support information and does not connect to your journal. Its hosting provider, Vercel, processes technical request information to deliver and secure the website. Emailing us creates support correspondence as described above.