Waavoo delivers real-time transcription and translation for live events. This policy explains what personal data we process, why, who we share it with, and the rights you have under the EU/EEA & UK GDPR and Québec’s Law 25 (and Canada’s PIPEDA). We built Waavoo to need as little personal data as possible — live audio is never recorded.
The controller responsible for your personal data is 9379-4162 Québec inc. (“Waavoo”, “we”, “us”), a company incorporated in Québec, Canada, operating the service at waavoo.com.
Under Québec’s Law 25, our privacy contact above also acts as the person responsible for the protection of personal information within the organisation. If you are in the EU/EEA or the UK, we process your data as a controller subject to the GDPR because we offer our services to people located there.
We only collect data for the specific purposes below. We never sell your personal data, and we do not use it for advertising.
If you use the contact form on our homepage, we collect the name, email address, organisation, message and the event type and date you provide, so we can answer your enquiry. The form is handled by Formspree (see Who we share data with); the submission goes directly from your browser to Formspree and is relayed to us by email. We do not store it in our own database.
Operators (the people who run a live session) sign in to a Waavoo account. We store:
Your audio is never recorded. The microphone stream is sent from the operator’s browser to our own transcription engine, converted to text in real time, and immediately discarded. We do not create or keep any audio file.
Speech-to-text and translation run on infrastructure we self-host (no third-party AI cloud is used for the audio itself). The resulting captions and translations are shown live to the audience and are deleted at the end of the session — we do not retain a transcript afterwards.
Context documents (optional). An operator may upload documents (e.g. a glossary or briefing) to improve terminology accuracy. When this feature is used, short excerpts of the live text and the document content are sent to OpenAI to generate the semantic vectors used for lookup (see sharing and transfers). If no context document is used, nothing is sent to OpenAI. Please do not upload documents containing personal data you are not authorised to process.
Attendees who open a session link to read the captions and translation are anonymous. No sign-in is required, and we do not collect, store or profile any personal data about viewers — no accounts, no analytics identifiers. A short, random, in-memory identifier is used only to route the live stream to your screen for the duration of the connection and is not linked to your identity.
Like any web service, our servers process the technical information needed to deliver pages and keep the service secure and available (for example connection metadata in short-lived operational logs). We keep this to a minimum and do not use it to track you across sites.
Where the GDPR applies, we rely on the following legal bases (Art. 6):
Our core infrastructure is hosted in Québec, Canada. For visitors in the EU/EEA or the UK, this is a transfer outside your region. Canada benefits from a European Commission adequacy decision for organisations subject to Canada’s PIPEDA, which the Commission recognises as offering an adequate level of protection.
Two providers are located in the United States — Formspree (contact form) and OpenAI (context-document lookup only). For these transfers we rely on appropriate safeguards, namely the EU Standard Contractual Clauses and/or the providers’ certification under the EU–U.S. Data Privacy Framework, together with data-minimisation. Under Québec’s Law 25 we assess such transfers before entrusting personal information outside Québec. You may ask us for more detail on these safeguards using the contact below.
| Data | Retention |
|---|---|
| Live audio | Never stored — processed in real time and discarded immediately |
| Session captions & translations | Deleted at the end of the session |
| Account data (email, display name, role) | Kept while your account is active; deleted after closure (subject to short legal/accounting retention) |
| Usage / billing records | Retained as required for billing and accounting obligations |
| Sign-in (refresh) tokens | Up to 7 days, then expire; revoked on sign-out |
| Context documents | Kept until you delete them or close the related session |
| Contact-form messages | Kept only as long as needed to handle your enquiry (also subject to Formspree’s retention) |
| wv-locale cookie | 12 months |
No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk. If a breach affecting your rights occurs, we will notify the competent authority and, where required, affected individuals, in line with the GDPR and Law 25.
To exercise any right, email hello@waavoo.com. We will respond within 30 days (one month under the GDPR). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Waavoo is intended for organisers of professional and educational events and is not directed at children. We do not knowingly collect personal data from children below the age of digital consent applicable in their country. Audience members remain anonymous. If you believe a child has provided us with personal data, contact us and we will delete it.
We do not make decisions producing legal or similarly significant effects about you solely by automated means, and we do not use your personal data for profiling. Speech-to-text and translation are automated language tools; they do not evaluate or make decisions about individuals.
We may update this policy to reflect changes to our service or the law. When we do, we will revise the “last updated” date above and, for material changes, take reasonable steps to inform you. The current version is always available at waavoo.com/privacy.
Questions or requests about your privacy? Email hello@waavoo.com or write to 9379-4162 Québec inc., 3637 University, Montréal, Québec H3A 2B3, Canada.
You also have the right to lodge a complaint with a supervisory authority:
We would appreciate the chance to address your concern before you contact a regulator.