Privacy Policy

The data controller responsible for the processing of your personal data is:

OCplan ApS CVR no.: 42665797 Odinsgade 6, st. 7400 Herning, Denmark Email: info@ocplan.dk

We process the following information depending on how you use OCvoice:

Listeners: - You do not need an account. Your language choice is stored in your browser and used to deliver the requested translation. - Technical connection information is processed to deliver audio and subtitles.

Church administrators: - Name, email address, organization details and settings.

Live sessions: - Source audio, transcriptions, translations and generated speech. - Usage and billing records, credit transactions and aggregated listener counts. - Selected audio and text excerpts for quality assurance (see section 3). - Session data is kept for up to 12 months (see section 6).

Website visitors: - Our hosting provider processes IP addresses and technical request information. - Our own page-view statistics contain only the page and referring website, aggregated per day, without cookies or visitor identifiers. These statistics do not store IP addresses.

Error reporting: - Technical error details and masked session recordings from the signed-in dashboard and administration pages (see section 4).

Delivery of the service (GDPR Art. 6(1)(b) — performance of contract): We process information to administer accounts and deliver live translated audio and subtitles.

Operation and improvement (GDPR Art. 6(1)(f) — legitimate interest): We retain source audio, transcriptions and translations to investigate errors, verify quality and improve the service for your church and other churches. Capture is an integral part of the service under our terms. Recordings are kept for up to 12 months. Contact us if capture causes technical problems.

Quality assurance (GDPR Art. 6(1)(f) — legitimate interest): Selected source-audio excerpts and their associated text are used for quality assurance. They are not published or used to train AI models. Internally, access is limited to OCplan staff; relevant processors are listed in section 4. Development tools are used under terms that prohibit training on this data. Excerpts are stored in the EU for no more than 12 months from the service date and reviewed at least quarterly.

The church is responsible for its recording of the service. We retain excerpts under our agreement with the church and our legitimate interest. A church may opt out of keeping quality-assurance excerpts.

Recordings can reveal religious beliefs (Art. 9). Excerpts concern the person speaking or leading from the front, rather than congregation members, and names are not attached. For preachers and leaders who have manifestly made the information public, we also rely on Art. 9(2)(e).

You may object to processing based on legitimate interest at any time. Write to info@ocplan.dk with the church and service date. We respond within one month and delete the relevant excerpts unless we demonstrate compelling legitimate grounds that override your interests. See section 7 for your rights.

We use the following recipients to deliver and operate OCvoice. Countries below identify the providers' establishment; storage locations are stated separately where relevant.

• (USA): speech and language processing of audio and text.
• (USA): quality assurance and development involving audio or text.
• (USA): administrator login and account management.
• (USA): storage of account, session and usage information; database storage in Ireland (EU).
• (USA): delivery of audio and text, and storage of quality-assurance excerpts in the EU.
• (USA): website and dashboard hosting; IP addresses and technical request information. Server-side processing takes place in the USA.
• (USA): technical error reporting and masked session recordings from the signed-in dashboard and administration pages. Error reporting is configured not to send IP addresses, cookies or request contents. Data is stored in Germany (EU).
• Stripe Payments Europe, Ltd. (Ireland): payments, including billing details, payer email and amounts. Card details are entered directly with Stripe. Stripe also processes data in the USA and acts as an independent controller for its own legal obligations.

We have data processing agreements with our processors under GDPR Art. 28. See section 5 for international transfers. To request information about the recipients of your personal data, contact info@ocplan.dk.

Some of our data processors are established in the United States. Transfers are made on the basis of:

• The European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, or
• EU Standard Contractual Clauses (SCC) pursuant to GDPR Art. 46(2)(c)

We conduct Transfer Impact Assessments (TIA) to ensure adequate protection of your data.

We keep personal data no longer than its purpose requires.

• Session data (audio recordings, transcriptions, translations, generated audio and usage events): kept for up to 12 months after the service, then deleted.
• Logs and backups: kept for up to 12 months, then deleted.
• Quality test recordings: selected excerpts, kept at most 12 months from the date of the service (see section 3).
• Credit transactions: Stored permanently as financial records required for accounting.
• Account information (name, email): Retained until you request deletion or the account is closed.
• Local browser data (language preference, etc.): Controlled by you and can be deleted via browser settings.

Why up to 12 months. Session data, logs and backups are kept for three purposes only: quality assurance (checking that a change to the service does not make translation worse), improving the service, and traceability (being able to investigate an error, a complaint or a billing question after the service). These purposes need data from real services over time; 12 months after the service is the limit, and much of it is deleted sooner. We use the data to improve the service; we do not use it to train AI models (see section 3).

Session deletion and archive: When you delete a session, it is immediately hidden and excluded from session and listener statistics. You can restore it from the trash within 30 days. After that, the session and its content are permanently erased; invoice and usage records are retained for accounting and anonymized. Archiving hides the session from ordinary lists and analysis while retaining it in statistics. Archived session content follows the ordinary retention periods above.

Under the GDPR, you have the following rights:

• Access (Art. 15): The right to obtain confirmation of whether we process your personal data and to access it.
• Rectification (Art. 16): The right to have inaccurate data corrected.
• Erasure (Art. 17): The right to have your personal data deleted under certain conditions.
• Restriction (Art. 18): The right to request restriction of processing.
• Data portability (Art. 20): The right to receive your data in a structured, machine-readable format.
• Objection (Art. 21): The right to object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7): If processing is based on consent, it may be withdrawn at any time.

To exercise your rights, contact us at info@ocplan.dk. We respond to requests within one month.

If you are dissatisfied with our processing of your personal data, you have the right to lodge a complaint with:

Datatilsynet (Danish Data Protection Agency) Carl Jacobsens Vej 35 2500 Valby, Denmark Phone: +45 33 19 32 00 Email: dt@datatilsynet.dk www.datatilsynet.dk

We reserve the right to update this privacy policy. In the event of material changes, we will notify account holders by email. The latest version is always available on this page.

Organization members can export recorded transcripts and available source recordings. Generated translation audio requires a released archive service and administrator opt-in for new sessions; it is unavailable until those gates are met. Archives may contain gaps. Customer archives and teaching drafts are available for up to 90 days; recipients control their exported files.

Teaching AI is unavailable until its provider and data processing setup have been approved and activated. It also requires organization opt-in and an explicit user request. Once activated, selected transcript text is sent to a teaching-draft service in the United States for topic proposals and source selection. Audio and login email are not sent through this path. Processing and retention follow its data processing terms. Drafts are not automatically published. Administrators can disable new requests in session defaults.

Separate receipt email is unavailable until its delivery policy and data processing setup have been verified and activated. Once activated, an email delivery service in the United States handles delivery of billing email, organization name, amount/currency and receipt link. Login email and historical invoice details are unchanged.

Named recipients and data processing terms must be disclosed before activation. Contact info@ocplan.dk for the current recipient list.