Updated: 20 August 2026 · version 2026-08-20
1. Controller
Peter Valašik, Obrancov mieru 2005/10, 953 01 Zlaté Moravce, Slovakia, company ID 50058045, is controller for EMSYO. Privacy requests: drakderos@gmail.com, +421 948 616 012.
2. Data categories and sources
Depending on your choices, EMSYO processes account/email/settings; subscription and payment references (not the full card); messages, optional transcripts and explicit memories; audio for recognition, interpreting, realtime voice or synthesis; transient camera frames and a frame explicitly submitted for generation; uploaded documents/attachments; permitted or manually chosen location; journal, notes, calendar, tasks and lists, saved media and history; security, errors and limits; optional minimal analytics; and the name, email, contract identifier, content and time of a complaint or withdrawal.
Data comes from you, your device and providers used for your request (such as payment, map or weather results). EMSYO does not require special-category data; do not submit it unless necessary and you have a valid legal basis.
3. Purposes and legal bases
- Contract (GDPR 6(1)(b)): account, sign-in, subscription and requested AI, voice, camera, document, map, weather, media, organisation and support functions.
- Consent (6(1)(a)): optional product analytics and any feature explicitly labelled as consent-based. Withdraw it in Settings without affecting prior lawful processing.
- Legitimate interests (6(1)(f)): security, fraud/abuse prevention, protective limits, basic diagnostics and legal claims after balancing user rights. You may object.
- Legal obligation (6(1)(c)): accounting, tax, consumer requests, authority orders and other statutory records.
Browser permission for microphone, camera, location or notifications is a technical control; a function starts only at your request. Account email and payment data are required to create an account/paid contract. Other inputs are optional, but the chosen feature cannot work without them.
4. Feature processing
Audio may go to a configured provider for recognition, translation or a spoken response. A realtime session starts explicitly, is time-limited and stops browser microphone tracks on exit. Disabling voice output blocks paid ElevenLabs/OpenAI speech generation server-side. Ordinary camera frames are not intentionally stored as history. An explicit generative edit or video sends one current frame and instruction, then stores the result privately. Vision is not used for identity, biometrics, emotion or sensitive-trait inference. Source documents are transient for the requested analysis and are not added to gallery, memory or history.
Permitted location is used only for a requested place, route, weather or context; EMSYO does not create continuous movement history. Google can receive the query/coordinates needed for maps, and weather providers receive place coordinates. EMSYO first shows a preview for a call, SMS, email or WhatsApp message and neither sends nor opens anything without user confirmation. After confirmation, the destination app processes the hand-off and the user completes sending. Navigation likewise opens only after a user action.
Journal, notes, events, tasks, lists, optional transcripts/memories and explicitly saved/generated media are private account content. Access is account-controlled and media uses time-limited URLs. Saved media can contain EMSYO visual grading, signature and rendered description. Calendar push uses a browser subscription only for a requested reminder.
5. Recipients
As required by the feature and current configuration, recipients/processors can include:
- Supabase — authentication, database and private storage;
- OpenAI — AI, analysis, web tools, realtime voice, speech and media;
- ElevenLabs — paid voice output and optional recorder voice;
- Perplexity — current web search and deep research;
- Google Maps Platform — places/photos/routes; Open-Meteo — weather;
- Stripe — payments, subscription and billing portal;
- AudD — music recognition; PostHog — analytics only after opt-in;
- Resend — transactional email, including withdrawal confirmation;
- Lovable connector/AI gateway and hosting infrastructure where configured in deployment.
EMSYO does not disclose personal data for targeted advertising or create an advertising profile from private content. Providers may retain limited security/legal records under their business terms.
6. International transfers
Some providers can process outside the EEA. A valid safeguard is used where required, such as an EU adequacy decision or Standard Contractual Clauses with appropriate supplementary measures. Request available safeguard information from the controller contact.
7. Retention
- Account/settings: while the account exists, then the necessary backup cycle.
- Account content, transcripts and memories: until you delete the record or account.
- Ordinary camera frames, live audio and source documents: not intentionally retained by EMSYO as history after the request.
- Completed provider video job: deletion is requested after copying to private gallery; provider security retention can remain.
- Payment/accounting/tax records: statutory period, generally 10 years.
- Complaints, withdrawals and claims: through handling and the period needed to evidence compliance, generally the relevant limitation period; accounting records can last longer.
- Security/technical logs: only as needed to investigate incidents, protect the service and meet legal duties.
- Opt-in analytics: the shortest configured period needed for aggregate product statistics, without person profiling.
8. Your rights
Subject to GDPR conditions, you can request access, rectification, erasure, restriction, portability and object to legitimate-interest processing, or withdraw consent. EMSYO does not make solely automated decisions about you with legal or similarly significant effects. Email the controller; identity can be reasonably verified and a response is normally due within one month. Account deletion is available in Settings.
You may complain to the Slovak Data Protection Authority, Galvaniho 7/B, 821 04 Bratislava, Slovakia, statny.dozor@pdp.gov.sk, dataprotection.gov.sk, or the authority where you habitually reside.
9. Children, security and changes
EMSYO is not directed specifically at young children. A user needs legal capacity or required guardian consent. Security measures include access control, private storage, server-side secrets, per-user limits and short-lived realtime credentials; no online service is absolutely secure. Material changes to this Notice are communicated appropriately before taking effect.
See Cookies and local storage for browser storage and optional analytics details.