Privacy policy

Who is responsible for your information

Verbago is operated by Third Phase Labs Ltd, registered in England and Wales under company number 14502121. In this policy, “Verbago”, “we”, and “us” refer to Third Phase Labs Ltd.

Privacy questions can be sent to support@verbago.app.

Who the service is for

Verbago v1 is a caregiver-managed AAC and visual-routine service. A caregiver creates the account, configures content, controls optional features, and supervises child-facing use. Children do not create their own accounts in v1.

Information we collect

• Caregiver account information, including email, sign-in identifiers, and role details.
• Caregiver-entered speaker profiles, such as a first name, avatar, selected voice, and optional condition or developmental information.
• Boards, schedules, templates, labels, prompts, uploaded images, and generated images.
• Voice-training recordings, training-session metadata, generated audio, and hosted custom-voice identifiers when voice cloning is used.
• Subscription, product, transaction, entitlement, and restore information.
• Device, app-version, security, reliability, sync, and support diagnostics.

How we use information

• Provide authentication, subscription access, synchronisation, AAC boards, visual routines, images, audio, and caregiver controls.
• Process optional AI image generation or voice cloning only when a caregiver chooses the feature and completes its disclosure or consent step.
• Protect accounts, rate-limit abuse, investigate incidents, recover failed jobs, and keep the service reliable.
• Send authentication, support, deletion-status, and other service messages.
• Collect optional anonymous mobile diagnostics only after the caregiver enables “Share Anonymous Diagnostics”.

We rely on performance of the service contract, legitimate interests in security and reliability, consent for optional diagnostics and sensitive media features, and legal obligations where applicable.

Service providers

We do not sell personal information and do not use child data for advertising.

• Cloudflare hosts the API, database, queues, cache, and media storage.
• Resend delivers sign-in, support, invite, and deletion emails.
• OpenAI processes prompts and optional reference images for caregiver-requested image generation.
• ElevenLabs processes recordings, voice metadata, and audio for caregiver-requested voice cloning and speech.
• PostHog EU receives approved anonymous product and crash diagnostics only after opt-in.
• Axiom receives redacted API reliability, security, and incident logs.
• RevenueCat and Superwall support subscription entitlement, restore, and paywall operation using an opaque caregiver account identifier.
• Apple and, when selected, Google provide sign-in or store services.

Diagnostics and tracking

Verbago does not include advertising or cross-app tracking. Optional PostHog diagnostics are off by default. When enabled, approved events use a memory-only anonymous identifier and exclude account IDs, emails, names, speaker data, AAC content, prompts, media, device IDs, exact device models, and IP-derived location. Turning the setting off stops new collection.

Retention and deletion

Account and caregiver-created content is retained while the account is active. Raw optional PostHog analytics is configured for 90-day retention. Operational logs follow the approved infrastructure retention settings and exclude prohibited direct identifiers and content.

A caregiver can request account deletion in the app or through support. Verbago records an audited deletion request, removes or anonymises first-party information, revokes applicable identity credentials, and requests deletion from applicable providers. Requests are completed within 7 business days; actionable provider retries remain visible until completion. See the account deletion page for the process and subscription guidance.

Security

Verbago uses authenticated account-scoped media delivery, encrypted transport, access controls, rate limits, redacted logging, environment separation, and release security checks. No internet service can guarantee absolute security; report a suspected issue to support@verbago.app.

Your choices and rights

Depending on where you live, you may ask to access, correct, export, restrict, object to, or delete personal information, and may withdraw consent for optional processing. Contact support@verbago.app. UK users may also complain to the Information Commissioner’s Office.

International processing and changes

Providers may process information outside the United Kingdom. We use the provider contracts and transfer safeguards applicable to that processing. Material policy changes will be dated here and communicated in the app when required.