Vavus AI

GDPR overview

Vavus addresses the GDPR explicitly, but claims readiness rather than certified compliance. A GDPR badge sits in every page footer, and the security page describes a GDPR-ready by default pillar: authenticated data export, an account deletion endpoint, granular cookie consent on the web, consent state tracked per user, and first-touch attribution captured only after marketing consent. The privacy policy lists rights of access, correction, export, deletion, restriction and objection, exercisable by email or through in-product tools, and a dedicated data deletion page sets a thirty-day target. The Impressum links the EU ODR platform. Two gaps stand out: no Article 27 EU representative is designated anywhere, and no data protection officer is named. A DPA template exists but is supplied on request rather than published.

Who owns the data?

Under the terms of service, users retain ownership of the content they submit, and Vavus receives only the limited rights needed to process, transmit, store, secure and display it so the service can work. Vavus owns the service itself: software, interfaces, documentation and branding. DCI Brands LLC acts as data controller for account, billing, support, website and product usage data, unless a signed enterprise or healthcare agreement says otherwise. Messaging is end-to-end encrypted, so Vavus holds only ciphertext; the single stated exception is translating a voice message, which requires server-side decryption, is done only after explicit consent, and is recorded and audited.

Reuse rights

Users keep their own content and nothing in the terms restricts what they do with it afterwards: translations, transcripts, documents and messages are theirs to reuse without asking permission, and an authenticated export returns the profile, history, messaging metadata, billing records and consent state on request. On the vendor side, data is used to deliver translation, speech-to-text, text-to-speech, keyboard, messaging, calls, documents, AI chat, account management, billing, fraud prevention, support and security. Marketing and analytics use follows cookie and consent settings only. Translation, message, document and audio content is not sold to advertising networks, and Vavus states it does not sell or share personal information for cross-context behavioural advertising. Providers that handle content are configured to keep it out of model training and never receive the account identity.

Data retention & training

Hosting summary

The standard Vavus cloud runs across US (primary), EU (edge) and Asia (edge) regions behind a global load balancer. DNS resolution places the site's server in the United States, on Google infrastructure with an anycast address. The publisher, DCI Brands LLC, is registered in Wyoming and the terms of service are governed by Wyoming law, so the primary jurisdiction is American. Enterprise buyers can review a dedicated managed cloud deployment or a fully on-premises install with no outbound network calls, and regional data residency is listed among the enterprise controls. Encryption is layered: TLS 1.2+ at the load balancer, AES-256 at rest, and client-side encryption for new history, documents and audio, so the server stores only ciphertext for that content. Audit logs run on Cloud Logging with a storage lifecycle and are retained for six years. No named subprocessor list is published; it is shared with enterprise and healthcare customers under a data processing agreement.