Privacy Policy for Rubber Ducky

Introduction

Rubber Ducky is a service provided by Valteria LLC (“we,” “our,” or “us”). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our voice logging application and services (the “Service”).

Rubber Ducky operates as part of our broader consulting and technology services portfolio.

Information We Collect

1. Audio Data

• Voice recordings you upload or record through our Service
• Audio transcriptions generated from your voice recordings
• Audio metadata including file size, duration, format, and upload timestamp

2. AI-Generated Content

• Summaries and insights generated by our AI systems from your voice recordings
• Extracted entities such as project names, JIRA ticket numbers, and people mentions
• Work status information derived from your voice logs

3. Account Information

• Email address for account creation and communication
• Password (encrypted and never stored in plain text)
• Profile information you choose to provide
• Subscription and billing information for paid plans

4. Usage Data

• Service usage statistics including number of voice logs, processing time, and feature usage
• Device information including browser type, operating system, and device identifiers
• Log data including IP addresses, access times, and pages viewed

5. Integration Data

• JIRA integration data when you connect your JIRA account (ticket numbers, project information)
• Calendar information if you enable calendar integrations
• Third-party service tokens for authorized integrations (stored securely)

How We Use Your Information

Primary Uses

• Process voice recordings into transcriptions and AI-generated summaries
• Provide core features including search, organization, and reporting
• Generate insights about your work patterns and productivity
• Enable integrations with third-party services you authorize

Service Improvement and Business Operations

• Improve AI accuracy through analysis of anonymized transcription and summary quality
• Enhance user experience based on usage patterns and feedback
• Develop new features that better serve user needs
• Inform our consulting services (only with anonymized, aggregated data that cannot identify individual users)
• Business operations related to our consulting practice (financial reporting, business planning)

Communication

• Send service updates and important account information
• Provide customer support when you contact us
• Send marketing communications (with your consent, where required)

Legal and Security

• Comply with legal obligations and respond to legal requests
• Protect against fraud and unauthorized access
• Enforce our Terms of Service and other policies

How We Process Audio Data

Voice Recording Processing

• Upload/Recording: Audio is temporarily stored for processing
• Transcription: We use OpenAI’s Whisper API for speech-to-text conversion
• AI Analysis: Transcriptions are processed by Google’s Gemini AI for summarization
• Storage: Only transcriptions and summaries are permanently stored; raw audio files are deleted within 24 hours
• Encryption: All data is encrypted in transit and at rest

Third-Party AI Services

• OpenAI Whisper: Used for audio transcription (subject to OpenAI’s privacy policy)
• Google Gemini: Used for content analysis and summarization (subject to Google’s privacy policy)
• We have data processing agreements with these providers that restrict their use of your data

Data Sharing and Disclosure

We Do Not Sell Your Data

We never sell, rent, or trade your personal information to third parties for commercial purposes. Rubber Ducky data is kept completely separate from our other consulting services and clients.

Limited Sharing Scenarios

We may share your information only in these circumstances:

With Your Consent

• Integrations you authorize (e.g., JIRA, calendar services)
• Sharing features you use within your team or organization

Within Our Organization

• Internal business operations (anonymized, aggregated data only for business reporting)
• No sharing with consulting clients - Rubber Ducky data is never shared with or accessible to our consulting clients

Service Providers

• AI processing services (OpenAI, Google) under strict data processing agreements
• Infrastructure providers (AWS) for hosting and storage
• Payment processors for billing (they only receive necessary payment information)

Legal Requirements

• Legal obligations including court orders and government requests
• Safety and security to protect users and prevent fraud
• Business transfers in case of sale of Rubber Ducky service or our consulting company (with advance notice and user consent for any material changes to data handling)

Data Security

Technical Safeguards

• Encryption in transit using TLS 1.3 for all data transmission
• Encryption at rest using AES-256 for stored data
• Access controls limiting employee access to user data
• Regular security audits and vulnerability assessments

Operational Security

• Employee training on data privacy and security
• Incident response procedures for potential security breaches
• Data minimization - we only collect and retain necessary data
• Secure deletion of data when no longer needed

Infrastructure Security

• AWS security - we use enterprise-grade cloud infrastructure
• Backup and recovery systems with encryption
• Network security including firewalls and intrusion detection

Data Retention

Voice Recordings

• Raw audio files are deleted within 24 hours of processing
• Transcriptions and summaries are retained while your account is active
• Backup copies may exist for up to 90 days for disaster recovery

Account Data

• Active accounts: Data retained while account is active and for service operation
• Deleted accounts: Most data deleted within 30 days; some data may be retained for legal/safety reasons
• Billing records: Retained for 7 years for tax and accounting purposes

Usage Data

• Analytics data may be retained in anonymized form for service improvement
• Security logs retained for 2 years for security and fraud prevention

Your Rights and Choices

Account Control

• Access your data through your account dashboard
• Download your data in standard formats
• Delete your account and associated data at any time
• Modify privacy settings and integration preferences

Communication Preferences

• Opt out of marketing emails while keeping service communications
• Notification settings for various app features and updates

Regional Rights

If you’re in the EU/UK (GDPR) or California (CCPA), you have additional rights:

GDPR Rights (EU/UK)

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing in certain circumstances
• Right to data portability in machine-readable format
• Right to object to processing based on legitimate interests
• Right to withdraw consent where processing is based on consent

CCPA Rights (California)

• Right to know what personal information is collected and how it’s used
• Right to delete personal information
• Right to opt-out of sale of personal information (note: we don’t sell data)
• Right to non-discrimination for exercising these rights

Exercising Your Rights

To exercise any of these rights, contact us at privacy@voicelog.com or through your account settings.

International Data Transfers

Data Location

• Primary servers located in the United States (AWS US regions)
• AI processing may occur in various regions where our AI providers operate
• Backup storage in multiple geographic regions for reliability

Transfer Safeguards

• Standard Contractual Clauses for transfers outside your region
• Adequacy decisions where applicable
• Strong encryption for all international data transfers

Children’s Privacy

Rubber Ducky is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected information from a child under 16, we will delete it promptly.

Third-Party Services

Integrations

When you connect third-party services (JIRA, calendars, etc.), those services have their own privacy policies. We recommend reviewing their policies.

Analytics

We may use privacy-focused analytics services to understand how our Service is used. These services may collect anonymized usage data.

Business Structure and Data Separation

Rubber Ducky operates as a distinct service within our consulting company’s portfolio. We maintain strict data separation between Rubber Ducky and our consulting services:

• Separate databases and infrastructure for Rubber Ducky
• No cross-service data sharing - your Rubber Ducky data is never accessible to or shared with our consulting clients
• Independent privacy practices - this privacy policy applies specifically to Rubber Ducky
• Distinct user accounts - Rubber Ducky accounts are separate from any consulting service relationships

If you are also a consulting client, your Rubber Ducky data and consulting relationship data are kept completely separate and governed by different privacy practices.

Changes to This Privacy Policy

We may update this Privacy Policy periodically. When we do:

• Notice of changes will be provided via email and/or prominent notice in the Service
• Effective date will be updated at the top of this policy
• Material changes will include a more prominent notice period

Contact Information

Privacy Questions

For privacy-related questions or concerns about Rubber Ducky:

General Business Inquiries

For questions about our consulting services or other business matters:

Rights Requests

To exercise your privacy rights regarding Rubber Ducky:

Definitions

• Personal Information: Information that identifies, relates to, or could reasonably be linked with you
• Processing: Any operation performed on personal data, including collection, use, storage, and deletion
• Service: The Rubber Ducky application, website, and related services
• We/Us/Our: Valteria LLC in relation to the Rubber Ducky service
• Consulting Services: Our separate consulting and professional services business (governed by separate privacy practices)