Privacy Policy

Last updated: October 5, 2026

This is a translation; in case of discrepancy, the French version prevails.

Who is responsible for your data

Verba is published by Kamel Laïmène EI, a sole proprietor doing business as Coffee Beans, 4 rue de Cambo, 75019 Paris, France (SIREN 521 998 120). This is the data controller within the meaning of the General Data Protection Regulation (GDPR).

For any question about your data: kamel@coffee-beans.fr.

What this policy covers

This policy applies to the Verba app on iPhone, iPad, Apple Watch and Mac, to the Verba API that writes summaries, and to the verba-notes.com website.

The website sets no cookies and uses no audience measurement tools. It only remembers, in your browser, the language you chose. Its host processes technical logs (IP address, date, page requested) needed to deliver the pages and keep them secure.

Data the app processes

Verba does not ask for an account, a name or an email address. The app processes:

Your audio recordings, captured by the microphone of your iPhone, iPad, Apple Watch or Mac.
Your transcripts, summaries, tasks, marked moments, notes, labels, folders and Ask conversations.
Photos and files you attach to a conversation, taken with the camera or chosen from your photo library. Verba may suggest photos taken during the conversation.
Your calendar (event titles, times and attendees), to link a recording to a meeting and show your schedule.
Reminders, only when you send tasks to it.
Your heart rate, only if you turn on the option (off by default): read from Apple Health, or measured by Apple Watch during a recording. The measurement session is not saved to the Activity app.
Your API keys, if you enter any: they stay in the device’s keychain and are not synced.
An installation ID: a random code created by the app and kept in the device’s keychain. It says nothing about you; it is used to count summary usage.
Apple’s signed proof of purchase if you subscribe (product, dates, transaction ID). We receive no payment data.

Each permission (microphone, speech recognition, camera, photos, calendar, reminders, Health) is requested only when it is needed, and you can revoke it at any time in the device’s Settings.

Transcription

By default, Verba transcribes with Apple’s speech recognition on device: the audio never leaves your iPhone, iPad or Mac. Apple may download the language models required.

In Verba’s Settings, you can choose an online transcription engine (Mistral Voxtral, OpenAI Whisper, Groq or a compatible server of your choice) with your own key. The audio file is then sent directly from your device to that provider, under its own terms. Coffee Beans does not receive it.

Dictating questions in Ask uses Apple’s speech recognition, on device when the language supports it; otherwise, Apple may process it on its servers, under its own privacy policy.

Summaries, tasks and Ask

To write a summary, Verba sends the AI model: the transcript, the title and attendees of the linked calendar event, your prep notes, marked moments, your custom instructions and, if the option is on, heart rate peaks (time and beats per minute). For Ask, Verba sends your question along with the transcripts and summaries of the conversations relevant to answering it.

There are two possible routes:

The Verba API (free plan, Premium and Diamond). It is hosted by Amazon Web Services in the Paris region. It forwards the request to the chosen model through OpenRouter (United States), which routes it only to that model’s provider, with OpenRouter’s data-collection option disabled; it returns the result to the app and does not keep the content. Free plan: Mistral Small; Premium: Mistral Large, models by Mistral AI (France). Diamond: you can also choose OpenAI (United States), Anthropic (United States) or DeepSeek (China).
Your own key: OpenRouter, OpenAI, Anthropic, Google Gemini, Groq, Mistral or a compatible server of your choice, including a local model. Data then goes directly from your device to that provider, without passing through the Verba API or our OpenRouter account; Coffee Beans receives nothing. With a Mistral key, processing stays in the European Union.

Verba’s Settings always show who your transcripts are sent to. Each provider processes data under its API terms of use and its privacy policy, which we encourage you to read. Coffee Beans does not use your content to train models.

What the Verba API keeps

With each request, in addition to the content to process, the API receives: the installation ID, your plan, Apple’s signed proof of purchase, the request type, the language and region (country) set on the device, and an Apple DeviceCheck token.

It keeps only:

usage counters (number of summaries and processing cost), per installation ID for the free plan, and per subscription and per month for paid plans, along with the device country (code of the region set on the device, for example FR) and the dates of first and last activity (to the day);
very short-lived anti-abuse counters, erased automatically after about 30 minutes;
through Apple DeviceCheck, a flag stored by Apple for this device, so that free summaries are offered only once per device;
technical error logs, limited to unexpected errors; in rare cases they may contain a short excerpt of the model’s response.

The API stores no transcripts, no summaries and no audio recordings.

These counters are also used for anonymous usage statistics for the publisher, viewed on a private, password-protected admin page: number of users per plan and per country, summaries and AI cost, with pseudonymous identifiers (truncated hash). No IP address and no name is recorded.

iCloud sync

If sync is on (it is by default, and can be turned off in Verba’s Settings), your conversations are copied to your own iCloud Drive, in a folder reserved for Verba: audio, transcripts, summaries, attached photos and files, Ask conversations, notes and, where applicable, heart rate readings.

This data is stored by Apple, under iCloud’s terms. Coffee Beans has no access to it. If you turn on Apple’s Advanced Data Protection, iCloud Drive is end-to-end encrypted.

Purchases and subscriptions

Subscriptions are sold and billed by Apple through the App Store. We receive neither your payment data nor the identity of your Apple Account. The app sends Apple’s signed proof of purchase to the Verba API to verify your subscription, and associates the installation ID with the purchase.

No ads, no tracking

Verba shows no ads, includes no analytics, audience measurement or crash reporting tools, and does not track you across other apps or websites. We do not sell or rent any data, and we do no profiling.

Widgets, Live Activities and Siri Shortcuts run locally, on your device.

Legal bases

Performance of a contract (GDPR Article 6(1)(b)): providing the app, writing summaries and answering Ask when you request it, managing your subscription and its quotas.
Legitimate interest (Article 6(1)(f)): preventing abuse, securing the service, limiting the free plan to one use per device and producing anonymous usage statistics (country, plan, volume) to run the service.
Explicit consent (Articles 6(1)(a) and 9(2)(a)): heart rate, which is health data, is processed only if you turn on the option; you can turn it off at any time.

Recipients and processors

Depending on your choices, your data may be processed by:

Amazon Web Services EMEA SARL (Luxembourg): hosting of the Verba API, Paris region;
OpenRouter, Inc. (United States): intermediary that routes requests from the Verba API to the chosen model’s provider, with no fallback to another provider and with the data-collection option disabled;
Mistral AI (France): provider of the default model (Mistral Small, Mistral Large);
OpenAI (United States), Anthropic (United States) or DeepSeek (China): only if you choose these models with the Diamond plan;
Apple: iCloud, App Store, DeviceCheck and speech recognition.

Providers you connect to with your own key are chosen by you and process data on your behalf, under their own terms.

Transfers outside the European Union

Requests sent by the Verba API pass through OpenRouter, in the United States, before reaching the model provider: Mistral AI (France) by default. They are sent with OpenRouter’s data-collection option disabled. If you choose an OpenAI or Anthropic model, the request content is processed in the United States. These transfers rely on the EU–US Data Privacy Framework where the recipient participates in it, or on the European Commission’s standard contractual clauses. If you choose DeepSeek, it is transferred to China, a country not covered by an adequacy decision: only choose this model if you accept that.

With your own Mistral key, your requests go directly from your device to Mistral AI and stay in the European Union.

Apple may process data outside the European Union with its own safeguards.

Retention periods

On your devices and in your iCloud: until you delete it. Kept indefinitely by default. You can enable automatic deletion after 7, 30 or 90 days, or 1 year in settings. A deletion is carried over to your other devices.
On the Verba API: no content. Anti-abuse counters: about 30 minutes. Monthly subscription counters, with country and activity dates: 13 months. Free plan counter, with country and activity dates: as long as the installation uses it, then at most 3 years without activity. Error logs: 30 days.
Installation ID: in the device’s keychain, until it is reset.

Your rights

You have the right to access, rectify, erase, restrict and port your data and to object to its processing, the right to withdraw your consent at any time and, in France, the right to set instructions for what happens to your data after your death.

Most of your data is in your hands: you can export a conversation (text, audio, attachments), delete one, or erase everything in Settings › Privacy › “Erase All Data”.

For the counters kept by the Verba API, or for any other request, write to kamel@coffee-beans.fr. Since we do not know your identity, we may ask you for information that lets us find the data tied to your installation or subscription. We respond within one month.

You may also file a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the data protection authority in your country.

Recording other people

The voices and words of the people you record are personal data too. Tell participants before you record, and get their consent where the law requires it: the rules vary from country to country. You are responsible for how you use your recordings.

Children

Verba is not intended for children under 15, and we do not knowingly collect any data about them.

Security

All exchanges go through encrypted connections (HTTPS). API keys and the installation ID are protected by the device’s keychain. The app’s files benefit from iOS and macOS data protection, and the Verba API stores no content.

Changes

We may update this policy, for example when the app changes. The date at the top of the page shows the latest version; if there is a significant change, we will let you know in the app or on this website.

Contact

Kamel Laïmène EI (Coffee Beans), 4 rue de Cambo, 75019 Paris, France. Email: kamel@coffee-beans.fr.