Privacy Policy

1. Controller

The data controller responsible for the processing of your personal data under the EU General Data Protection Regulation (GDPR) is:

Baran Karadag
Germany
Email: barankara0808@gmail.com

2. Data we collect

We only collect data that is necessary to provide the PremiumSession service:

• Email address — used to create and access your account and to send essential transactional emails (e.g. password reset, payment receipts).
• Audio recordings — voice memos you record in the app for the purpose of generating a session note. Audio is processed in-memory only and is never stored on our servers. Once the AI has produced the note, the recording is automatically discarded. Only the generated text note (and, if applicable, the text transcript) is retained.
• Session notes — the AI-generated and user-edited notes stored in your account.
• Payment data — handled entirely by Stripe. We never see or store your card details.
• Technical data — IP address, browser type and basic request logs, used for security and reliability.

3. Purposes & legal basis

• Providing the service (account, recording, AI note generation, storage) — Art. 6(1)(b) GDPR (performance of a contract).
• Processing payments and managing subscriptions — Art. 6(1)(b) GDPR.
• Securing the service, preventing abuse, and maintaining logs — Art. 6(1)(f) GDPR (legitimate interest).
• Sending transactional emails about your account — Art. 6(1)(b) GDPR.

We do not use your recordings or notes to train our own AI models. AI processing is performed via a third-party AI provider; we are confirming their data-handling and training terms and will update this policy accordingly. We do not sell your data.

4. Processors & international transfers

To deliver the service we rely on the following processors, acting on our behalf under Art. 28 GDPR:

• Supabase — database and authentication (hosting of email and generated notes). Audio recordings are not stored in Supabase.
• Stripe — payment processing and subscription management.
• Lovable AI Gateway (Google Gemini) — transcription and AI structuring of session recordings. Audio is transmitted for processing and is not retained by us afterwards.

Some of these processors may transfer data outside the EU/EEA. Where this is the case, transfers are protected by the European Commission's Standard Contractual Clauses and additional safeguards as required under Art. 46 GDPR.

5. Retention

Audio recordings are not retained — they are discarded immediately after the AI has generated the note. We keep your account and generated notes for as long as your account exists. You can delete individual notes at any time from the app. When you delete your account, we delete the associated email and notes without undue delay, except where we are required by law to retain certain billing data (typically up to 10 years under German tax law).

6. Your rights

Under GDPR you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data (Art. 17) — you can delete your account and content at any time from the settings page.
• Restrict or object to processing (Art. 18, 21).
• Receive your data in a portable format (Art. 20).
• Lodge a complaint with a supervisory authority (Art. 77), typically the data protection authority of the German federal state in which you reside.

To exercise any of these rights, email barankara0808@gmail.com.

7. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), encrypted storage at rest, scoped database access through row-level security, and authentication via secure tokens.

8. Professional confidentiality

PremiumSession is designed for counsellors, psychotherapists and similar practitioners working in private practice. You remain the data controller for any client information contained in your recordings and notes, and you are responsible for obtaining all necessary consents from your clients before processing such information through the service.

9. Changes

We may update this policy. Material changes will be communicated by email or in-app notice before they take effect.

10. Contact

Questions about this policy or your data? Contact Baran Karadag at barankara0808@gmail.com.