Privacy Policy

The data controller responsible for the processing of your personal data is:

OCplan ApS CVR no.: 42665797 Odinsgade 6, st. 7400 Herning, Denmark Email: info@ocplan.dk

We process the following categories of personal data depending on how you use the service:

Listeners (the congregation): - Language preference (stored locally in your browser only) - No personal data is collected or sent to our servers

Church administrators (account holders): - Name and email address (when creating an account) - Organization name and settings

During live sessions: - Audio recordings of speech (stored for up to 90 days, then automatically deleted) - Transcriptions of the speech (stored for up to 90 days) - Translations of the speech (stored for up to 90 days) - Generated audio files (text-to-speech, stored for up to 90 days) - Usage events per API call (provider, cost, token counts — stored for up to 90 days) - Credit transactions (top-ups, usage charges — stored permanently as financial records) - Anonymized statistics (number of listeners per session)

We process your personal data for the following purposes:

Delivery of the service (GDPR Art. 6(1)(b) — performance of contract): - Real-time speech recognition and translation - Administration of your account and organization settings - Displaying subtitles and playing audio for listeners

Improvement of the service (GDPR Art. 6(1)(f) — legitimate interest): - Retention of transcriptions and translations to improve translation accuracy - You may object to this processing at any time (see section 7)

To deliver the service, we use the following third-party data processors:

• Soniox, Inc. (USA) — real-time speech recognition. Audio is streamed for transcription.
• Anthropic, PBC (USA) — translation via Claude AI models. Source text is sent for translation.
• Google Cloud (Google LLC) (USA) — text-to-speech. Translated text is sent for audio generation.
• WorkOS, Inc. (USA) — authentication and user management for administrators.
• Convex, Inc. (USA) — database and real-time backend. All data is stored on servers in Ireland (EU).

We have entered into Data Processing Agreements (DPA) with all processors in accordance with GDPR Art. 28.

Some of our data processors are established in the United States. Transfers are made on the basis of:

• The European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, or
• EU Standard Contractual Clauses (SCC) pursuant to GDPR Art. 46(2)(c)

We conduct Transfer Impact Assessments (TIA) to ensure adequate protection of your data.

• Audio recordings: Stored for up to 90 days after the session ends, then automatically deleted.
• Transcriptions and translations: Stored for up to 90 days after the session ends, then automatically deleted.
• Generated audio (text-to-speech): Stored for up to 90 days after the session ends, then automatically deleted.
• Usage events: Stored for up to 90 days, then automatically deleted.
• Credit transactions: Stored permanently as financial records required for accounting.
• Account information (name, email): Retained until you request deletion or the account is closed.
• Local browser data (language preference, etc.): Controlled by you and can be deleted via browser settings.

Under the GDPR, you have the following rights:

• Access (Art. 15): The right to obtain confirmation of whether we process your personal data and to access it.
• Rectification (Art. 16): The right to have inaccurate data corrected.
• Erasure (Art. 17): The right to have your personal data deleted under certain conditions.
• Restriction (Art. 18): The right to request restriction of processing.
• Data portability (Art. 20): The right to receive your data in a structured, machine-readable format.
• Objection (Art. 21): The right to object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7): If processing is based on consent, it may be withdrawn at any time.

To exercise your rights, contact us at info@ocplan.dk. We respond to requests within 30 days.

If you are dissatisfied with our processing of your personal data, you have the right to lodge a complaint with:

Datatilsynet (Danish Data Protection Agency) Carl Jacobsens Vej 35 2500 Valby, Denmark Phone: +45 33 19 32 00 Email: dt@datatilsynet.dk www.datatilsynet.dk

We reserve the right to update this privacy policy. In the event of material changes, we will notify account holders by email. The latest version is always available on this page.