Privacy policy. What we hold, and why.

Who we are

Podviva is operated by the company named in our legal notice. This policy covers podviva.com and the Podviva product.

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of the other places our customers operate.

Two roles

When a show uses Podviva to record guests, publish episodes and measure listeners, the account that runs the show decides how that information is used. We handle it on the account's behalf and on its instructions, as its processor under GDPR and its service provider under the CCPA. Questions about that information are best sent to the show first, and we will help them answer.

For people who visit our site or hold an account, we decide how the information is used and this policy applies to us directly.

What we collect

From account holders and their team: name, work email, phone number, role, billing details and what they do in the product. Card payments are handled by our payment provider, and we never see full card numbers.

From the shows Podviva records and hosts: the audio and video of each participant, transcripts, guests' names and email addresses, and whatever was said.

From listeners: downloads measured to the IAB standard, the app, the episode and approximate location from the IP address, and for subscribers, their email address and subscription. From the systems an account connects, only what the work needs, such as the sources for an episode.

From our site: pages visited, device and browser type, approximate location from your IP address. We do not use advertising trackers.

We do not ask for sensitive information such as health details. If someone shares it in a recording, it is handled with extra care and only for that show.

How we use it

To provide the service: recording, producing, hosting and distributing shows, measuring listening, running ads, sponsorships and subscriptions, and showing the account what happened.

To keep it safe and working: preventing abuse and fraud, securing accounts, fixing faults and supporting you.

To run our business: billing, keeping records the law requires.

To improve Podviva, using service measurements such as upload volumes and processing times, never the content of recordings.

AI and your data

We never use your data, your listeners' data or any recording to train AI models, ours or anyone else's.

The AI providers that read a transcript or produce a voice process it only to give Podviva an answer. They are bound by terms that do not allow them to train on it, and where a provider offers a training opt out, such as our speech recognition provider, we turn it on.

Podviva's agents do not make decisions that have legal or similarly significant effects on a person, and a voice is cloned only with its owner's consent on record.

Our legal bases

Under GDPR and UK GDPR we rely on: performing our contract with a business; our legitimate interests in securing, supporting and improving the service, understanding how our site is used and replying to enquiries, balanced against your rights; and legal obligations such as tax records.

Who we share it with

Only providers that make Podviva work, each bound by contract to use it only to provide their service to us and to protect it: hosting and databases (Neon, Railway, Cloudflare, Upstash), AI models (OpenAI through Vercel AI Gateway), sign in (Clerk), payments (Stripe) and site analytics (Google Analytics). The current list is available at [email protected].

We do not sell personal information, we do not share it for cross context behavioural advertising, and we have not done either in the past twelve months.

We disclose information when the law requires it, to protect people from harm, or as part of a sale or merger of our business, where the buyer must keep this policy's promises.

Where it is stored

The Podviva product's databases are in Sydney, Australia. Some of the providers above process information in other countries, including the United States and the European Union, to provide their service.

Before information leaves Australia, we take reasonable steps under Australian Privacy Principle 8 to make sure it is protected to the same standard. For information from the EU, EEA or UK, we rely on adequacy decisions or the Standard Contractual Clauses and UK Addendum.

How long we keep it

Recordings, episodes, transcripts and listener data: while the account is open, then deleted within thirty days of closing unless exported.

Account and billing records: seven years after the account closes, because tax law requires it.

Backups roll off on a regular schedule, and deleted information leaves them as they expire.

How we protect it

Encryption in transit and at rest, access limited to the people and services that need it, an audit trail of access to customer data, and bot protection on the public parts of our site.

No system is perfectly secure, so we also plan for things going wrong, as set out below.

Your rights, wherever you are

You can ask what we hold about you, ask for a copy, ask us to correct it or delete it, and object to how we use it. Send requests to [email protected]. We reply within thirty days, and we will ask you to confirm who you are before handing anything over.

If we hold your information for a show, we pass your request to that show or act on its instructions, and let you know.

Using your rights is free, and you will not be treated differently for using them.

If you are in Australia

You have the rights set out in the Australian Privacy Principles, including accessing and correcting your information. You can browse our site without identifying yourself.

If you are unhappy with how we handled a privacy concern, contact us first. If we do not resolve it within thirty days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If you are in the EU, EEA or UK

You have the right to access, correct, erase, restrict and move your information, to object to processing based on legitimate interests, to withdraw consent, and not to be subject to decisions made solely by automated means that significantly affect you.

You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

If you are in California or another US state

In the past twelve months we have collected identifiers such as name, email and phone number; commercial information such as subscriptions and billing; internet activity on our site; approximate location; audio recordings and transcripts; and professional details such as your business and role. We collect them from you, from the shows that use Podviva, and from the systems they connect, for the purposes described in this policy.

You have the right to know what we collect and why, to delete it, to correct it, and not to be discriminated against for asking. We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you. We honour Global Privacy Control signals. An authorised agent can make a request for you with your written permission.

Residents of other states with privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas and Oregon, have similar rights, which you can use the same way. If we decline a request, you can appeal by replying to our answer.

Other places

We also apply the protections of the New Zealand Privacy Act 2020 and Canada's Personal Information Protection and Electronic Documents Act to people in those countries, and the same rights described above apply.

Cookies and analytics

We use Google Analytics to understand which pages are useful. It is not used for advertising.

You can block or delete cookies in your browser settings, or install Google's Analytics opt out browser add on to stop Google Analytics collecting your visits.

Children

Podviva is for creators and businesses and is not directed at children. We do not knowingly collect information from anyone under sixteen. If you think we have, tell us and we will delete it.

If something goes wrong

If a data breach is likely to cause serious harm, we notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Where GDPR applies, we notify the relevant authority within seventy two hours of becoming aware, where required. We tell account holders without undue delay when a breach affects their guests or listeners, and meet the breach notice laws of US states and other places.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters, we tell account holders before it takes effect.

Contact us

Privacy questions and requests: [email protected]. A person reads every one. Our company details and registered address are in our legal notice.