Privacy Policy

1. Data Controller

This Privacy Policy (hereinafter "Policy") explains how we collect, use, store, and protect your personal data when using the Recavio service available at recavio.com.

Processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on personal data protection.

2. What Personal Data We Collect

2.1 Data Provided by the User

2.2 Automatically Collected Data

2.3 Audio Recordings

When using a recording room, audio data is recorded and stored on our servers. These recordings are User Content owned by the User. We process them solely for the purpose of providing the service (storage, processing, making available for download).

2.4 Payment Data

Payment card data is processed exclusively by Stripe, Inc. We do not store any payment card data on our servers. We only receive a customer identifier and subscription status information from Stripe. Stripe's privacy policy is available at stripe.com/privacy.

3. Legal Basis for Processing

We process personal data based on the following legal grounds under Article 6(1) GDPR:

• Performance of a contract (Art. 6(1)(b)) — account registration, service provision, payment processing
• Legitimate interest (Art. 6(1)(f)) — service security, abuse prevention, technical diagnostics, service improvement
• Legal obligation (Art. 6(1)(c)) — accounting, tax obligations
• Consent (Art. 6(1)(a)) — marketing communications (only if you have opted in)

4. Cookies

4.1 Essential Cookies

The service uses the following essential cookies required for its basic operation:

• Session cookie — maintains your login; automatically deleted upon closing the browser or session expiry
• Language (lang) — stores your language preference (SK/EN)
• CSRF token — protection against cross-site request forgery

These cookies do not require your consent as they are strictly necessary for providing the service.

4.2 Analytics and Marketing Cookies

The service may also use third-party cookies for traffic analysis, displaying advertisements, and measuring the effectiveness of advertising campaigns. These cookies are activated only with your explicit consent, which you can grant or refuse via a cookie banner on your first visit. You may withdraw your consent at any time through the cookie settings.

5. Sharing Data with Third Parties

We do not sell, rent, or trade your personal data with third parties. We share data only in the following cases:

• Stripe, Inc. — payment processing (Stripe acts as an independent data controller for payment data)
• Hosting providers — servers on which the service operates (data processor under contract)
• Email service (SMTP) — delivery of system emails (verification, password recovery)
• Public authorities — if required by law or a valid court order

6. Data Transfers Outside the EU/EEA

Stripe, Inc. is headquartered in the USA. Data transfers to the USA are based on Standard Contractual Clauses (SCC) or other appropriate safeguards under Chapter V of the GDPR. Details are available in Stripe's documentation.

We preferentially select other third-party services with infrastructure located within the EU/EEA.

7. Data Retention

• Account data (email, nickname, password) — for the duration of the account + 30 days after closure
• Audio recordings — for the duration of the podcast's existence in the User's account; within 30 days after podcast or account deletion
• Billing data — for the period required by Slovak law (typically 10 years)
• Security logs (IP, User-Agent) — maximum 90 days
• Cookies — session: until browser close; language: 1 year

8. Your Rights

Under the GDPR and Slovak Act No. 18/2018 Coll., you have the following rights:

• Right of access — request a copy of the personal data we process about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restriction of processing — request temporary restriction of processing
• Right to data portability — obtain your data in a structured format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — if processing is based on consent, you may withdraw it at any time

To exercise your rights, contact us at info@recavio.com. We will respond without undue delay, no later than 30 days.

You also have the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Data transfer encryption (HTTPS/TLS)
• Hashed password storage (bcrypt)
• CSRF form protection
• Regular server software updates
• Access to personal data limited to authorized personnel only

However, no system is 100% secure. We cannot guarantee the absolute security of your data.

10. Children and Minors

The service is not intended for persons under 16 years of age. We do not knowingly collect personal data from persons under 16. If we discover that we have collected data from a person under 16 without parental consent, we will promptly delete it.

11. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes via email or an in-app notification at least 30 days before they take effect. The current version is always available on this page.

12. Contact

For questions regarding the processing of personal data, please contact us at: