Privacy policy
Last updated: 27 September 2026
This page explains which data we process when you use Moverba, for what, for how long and who sees it. We collect as little as possible: no tracking in the browser, no advertising, no training of AI models with your texts.
In short
- We store your answers and your speech encrypted on our server in Germany and only pass them to the AI providers that write your speech.
- Payment is handled by Paddle. We do not see your payment details.
- We only set cookies that the site needs. We collect statistics without a cookie and without your IP address.
- You can download your data and delete your account yourself at any time.
1. Controller
Manuel Massini, Individual Entrepreneur, Bakhtrioni Street 22, apt. 75, Saburtalo District, 0160 Tbilisi, Georgia. Email: support@moverba.com
We have no establishment in the EU. Our representative in the EU under Article 27 GDPR is S. Massini, Godmanchesterring 23, 97877 Wertheim, Germany. You can also contact our representative with any question about data protection.
2. Visiting the website
When you open moverba.com, our server processes the technically necessary data: IP address, time, page requested, browser information. The connection is encrypted and ends on our own server in Germany; there is no third-party network (CDN) in between.
- The access log of our web server contains no IP address, no browser and no link parameters, only time, page and status.
- To fend off overload and abuse, the server briefly counts requests per IP address in memory.
- We keep application logs for 14 days. They never contain your answers or speech texts.
The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in running the site securely and reliably.
3. Protection against abuse and the country for prices
- Security check in forms: Before a preview, a sign-in, a withdrawal and similar actions, your browser quietly solves a small computing task that our server checks. This slows down automated requests. No third party is involved and no cookie is set. For request limits we store your IP address only as an encrypted short value (hash) for at most one day.
- Country for prices: So that you see prices in your currency, we determine the country from your IP address using a database by DB-IP that lies on our server. Your IP address does not leave the server for this and is not stored for it. You can change the country in the price selection.
The legal basis is Art. 6(1)(f) GDPR: protecting our service and the cost of AI generation against abuse, and showing suitable prices.
4. Cookies
We only set cookies that are strictly necessary for the service or that you trigger yourself. We do not need consent for them.
| Cookie | Purpose | Duration |
|---|---|---|
moverba-session |
keeps your session and sign-in | 2 hours after your last visit |
XSRF-TOKEN |
protects forms against forgery | like the session |
mv_guest |
links your projects without an account to this device | 30 days |
lang_banner_dismissed |
remembers that you closed the language notice | 12 months |
mv_optout |
remembers your objection to statistics | 12 months |
We set no cookies at all on the information pages (home, guides, pricing).
5. Account and sign-in
You sign in with your email address and receive a link that is valid for 15 minutes. There is no password. If you started without an account, we move your project into your account after signing in. We store your email address, name (if given), language and the time of your last use. The legal basis is Art. 6(1)(b) GDPR (contract).
6. Creating your speech
For your speech we process your answers from the interview, the outline created from them and the texts of your speech with all versions. We store them encrypted.
The texts are created by AI language models of Anthropic PBC (USA) and OpenAI (USA). We send them your answers and drafts, but no email address and no payment data. Both providers process the data on our behalf, do not use it to train their models and delete it after their short technical periods. Transfers to the USA are covered by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified.
We delete the complete requests to the AI (raw data) after 30 days, cost and token values without content after 24 months. The legal basis is Art. 6(1)(b) GDPR (contract).
7. Information about other people and sensitive information
A speech is about people. Your answers therefore often contain information about other people, such as the couple or someone who has died, sometimes also sensitive information such as illness or faith. We only process this information to create your speech, store it encrypted, do not look at it (exception: a documented support case) and delete it with the project.
Please only enter what belongs in the speech about others and leave out sensitive information if it is not important for the speech. We do not inform the people mentioned individually, because that would be disproportionate and the speech is usually a surprise (Art. 14(5)(b) GDPR). The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in giving a personal speech about these people.
8. Purchase through Paddle
Purchases are handled by our reseller Paddle.com Market Limited (London, United Kingdom; in the USA Paddle.com Inc.). Paddle acts as an independent controller and processes your payment and invoice data under its own privacy notice. There is an adequacy decision of the European Commission for the United Kingdom. On the checkout pages and /pay your browser loads Paddle's script, on all other pages it does not.
Paddle sends us your email address, country, customer ID, product purchased, amount and tax. We keep the order and your consent to the immediate start for 6 years from the end of the calendar year (proof and retention obligations, Art. 6(1)(c) and (f) GDPR).
9. Withdrawal and guarantee
If you withdraw from a purchase or use the guarantee, we process the information from the form (name, email address, order reference, optionally a reason) and send you a confirmation of receipt. So that the guarantee is used only once per person, we compare encrypted short values (hashes) of email and IP address, the customer ID at Paddle and the browser information. We keep these features for 3 years from the end of the calendar year. A refusal is always decided by a person. The legal basis is Art. 6(1)(b), (c) and (f) GDPR (contract, legal obligation, protection against abuse).
10. Emails
We send transactional emails (sign-in link, order confirmation, confirmation of receipt) through Brevo (Sendinblue SAS, Paris, France) as processor. We do not track opens or clicks. The legal basis is Art. 6(1)(b) GDPR.
11. Newsletter
You only receive the newsletter if you sign up and confirm your sign-up via the link in a confirmation email (double opt-in). We store the time of your sign-up and confirmation as proof. You can unsubscribe at any time via the link in every newsletter. We keep the proof for 3 years from the end of the calendar year after your consent ends. The legal basis is your consent (Art. 6(1)(a) GDPR), for the proof Art. 6(1)(f) GDPR. The newsletter is for people aged 18 and over.
12. Statistics with Matomo
We analyse how our service is used, for example how often a preview is created, the checkout is opened or a speech is bought. We use the software Matomo for this, which we run ourselves on our server in Germany (stats.moverba.com). We do not pass the data on.
Measurement takes place only on our server. We do not set a cookie for it, do not read any information from your device and do not load a statistics script of a third party. Our server only sends Matomo the event (such as “preview viewed”) with the occasion, the role or the plan and the time. We do not send your IP address, your browser data, your email address, names or content of your speech. We do not create user profiles and cannot link single events to you or to each other.
The purpose is to check that our service works, to improve it and to understand the key figures of the purchase process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in this analysis.
We delete the single events (raw data) after 180 days. After that only aggregated reports remain, without reference to single visits.
You can object to the statistics at any time: Turn off statistics for this browser. There, at your request, we set the cookie mv_optout, which remembers your objection for 12 months. If your browser sends the Global Privacy Control (GPC) or Do Not Track signal, we do not record anything either.
13. Error monitoring
If a technical error occurs, we send an error report to Sentry (Functional Software, Inc., USA) with storage in the EU. The report contains technical information (type of error, code location, page address without parameters), but no IP address, no account, no answers and no speech texts. The legal basis is Art. 6(1)(f) GDPR (reliable operation).
14. Hosting and backups
Our server is operated by netcup GmbH in Germany (processor). We back up the database daily, encrypted, with a provider in the EU.
15. Access from Georgia
Your data is stored in Germany. The operator is based in Georgia and accesses the data from there (and from other countries when travelling) as far as needed for support, refunds and operation. There is no adequacy decision of the European Commission for Georgia. To protect your data, it is stored encrypted, we only look at content with a documented reason, access is secured with a second factor and we keep no permanent copies outside the EU. The Georgian Law on Personal Data Protection applies in addition.
16. Downloading and deleting your data
In your account you can download all your data as a ZIP file and delete your account with all projects. We keep exports of your speeches for 7 days for download.
17. Storage periods
| Data | How long |
|---|---|
| Projects without purchase | 30 days after the last change |
| Account and paid projects | until you delete them; after 24 months without use we delete them after a reminder |
| Projects after a refund | 30 days |
| AI raw data | 30 days |
| Orders, withdrawals, consents | 6 years from the end of the calendar year |
| Guarantee features | 3 years from the end of the calendar year |
| Application logs | 14 days |
| Statistics raw data | 180 days |
18. Recipients
| Recipient | Purpose | Location |
|---|---|---|
| netcup GmbH | server | Germany |
| Anthropic PBC | creating the speech | USA (standard contractual clauses) |
| OpenAI | checking and analysing the answers | USA (standard contractual clauses or Data Privacy Framework) |
| Brevo (Sendinblue SAS) | emails | France |
| Sentry (Functional Software, Inc.) | error reports | storage in the EU |
| Backup provider | encrypted backups | EU |
| Paddle.com Market Limited | purchase, payment, invoice (independent controller) | United Kingdom |
19. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to the statistics without giving reasons.
Write to support@moverba.com or to our representative in the EU. You can also lodge a complaint with any data protection authority in the EU, in particular where you live, and in the United Kingdom with the Information Commissioner's Office (ICO).
20. Obligation to provide data and automated decisions
Without an email address we cannot provide an account or an order, without answers no speech. We do not make automated decisions with legal effect (Art. 22 GDPR). You can have the automatic content check before a preview reviewed by a person.
21. Changes
When our service or the law changes, we adapt this policy. The version published here applies.
Last updated: 27 September 2026