Prepared under Articles 13 and 14 of the General Data Protection Regulation. The full explanation is in the Privacy Policy; this notice summarises the headings the regulation requires.
1. Controller and roles
For your account data (name, email, phone) the controller is PsychSupervisor AI.
For your client's data you are the controller. You upload it; we process it on your instructions and only for the function of the tool, acting as your processor. Obtaining the client's explicit consent and meeting your own information duty is yours.
2. Categories of data
- Identity and contact: name, email, phone, country
- Account and security: verification state, sign-in records, rate limit counters (phone number masked), administrative action logs
- Commercial: membership plan, usage counters, document codes
- Health data (special category under Article 9): session recording, transcript, report and notes. This belongs to the client and enters the system only when you upload it
- Local assistant (only if you use it): access status (including purchase), pilot status and the daily number of model downloads. Questions to the assistant, its answers, the chat history and the report copies are processed and stored only on the phone, encrypted, and do not reach us
- Website usage (only if you consent): page visited, time, browser and device type, approximate location, cookie identifier
3. Purposes
- Transcribing the session and preparing the structured report
- Opening the account, verifying identity, session security
- Preventing abuse and unauthorised access
- Measuring, in aggregate, how the website is used (only if you consent)
- Meeting legal obligations
No data is processed for advertising, profiling, marketing or resale.
4. Legal bases
- Performance of a contract, Article 6(1)(b): the function of the tool
- Legitimate interests, Article 6(1)(f): security and abuse prevention
- Legal obligation, Article 6(1)(c)
- Explicit consent, Article 9(2)(a): session content as health data. The party obtaining that consent from the client is the professional
- Consent, Article 6(1)(a): the website analytics cookies (Google Analytics). Without your consent, analytics does not run
5. Recipients and transfers
Data is shared only with the processors needed to run the tool:
- Google Cloud / Firebase — hosting, database, storage, authentication, notification delivery. European Union region (Belgium)
- Twilio — SMS verification code; the data transferred is the phone number
- Brevo — email delivery
- Stripe — card payments on the website
- Google Play / Apple App Store — subscriptions bought in the mobile app
- Sentry (Functional Software, Inc.) — app error and crash reports, without session content. European Union region (Germany)
- A transcript uploaded as a document is sent to the artificial intelligence provider as uploaded, without automatic masking
- Artificial intelligence provider — the masked transcript, for producing the report. NVIDIA is currently used; alternatives are OpenRouter and Alibaba Cloud (Qwen)
- Cloudflare, Inc. (R2) — download of the optional local assistant's model file; only the IP address and technical request details are seen, no client data
- Google Analytics (Google Ireland Limited) — website analytics, only with your consent. Google may also process this data in the United States, on the basis of the EU-US Data Privacy Framework and standard contractual clauses
Where a transfer outside the European Economic Area is required, it relies on standard contractual clauses under Article 46. The audio recording is not transferred to a third party for transcription; conversion runs on our own infrastructure.
6. Retention
- Raw audio recording: deleted when the transcript is approved, within seven days at the latest
- Transcript, report, notes: according to the retention setting in the account (2, 5 or 10 years)
- Deletion requests: completed, including backups, within seven days at the latest
- Security and audit records: for as long as product safety requires
- Promo code lock (a keyed hash of the phone number): kept after account deletion so the same number cannot use a code twice
- Website analytics data: up to 14 months at visit level; analytics cookies up to 13 months
7. Your rights
Access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent at any time. You also have the right to lodge a complaint with your supervisory authority.
Access, export, suspension and deletion are available to you inside the app under Settings > Data and privacy.
You can withdraw your consent to website analytics at any time through the "Cookie preferences" link at the bottom of the privacy page (psychsupervisor.com/privacy).
8. Contact
info@probeside.com
Requests are answered within one month.