Privacy policy
Farkad processes voice recordings and the health information extracted from them. This page states plainly what is collected, on what legal basis, who else processes it, and what you can require of us.
Last updated
Who is responsible
Farkad is the controller for the personal data described here. Brahim Redouane Mellah, its founder, is the person responsible for the protection of personal information, which Quebec's Law 25 requires us to name. Questions about this policy, or any request concerning your data, go to mellah.brahim.redouane@gmail.com.
What is collected
Four kinds of data: the audio you record, the entries extracted from it across the 7 pillars — water, food, sleep, exercise, medication, supplements, and recovery — the account identifiers needed to keep your data yours, and, once you subscribe, what a payment leaves behind: which Stripe customer your account is, and what that subscription currently grants. Card details are typed into Stripe's own checkout and never reach us. Entries about medication, symptoms and sleep are health data under Article 9 GDPR and are treated as such.
Why it is processed, and on what basis
Recordings are transcribed and turned into structured entries so the product can do what you installed it for — that processing is necessary to perform our contract with you, Article 6(1)(b). Health data is processed only on your explicit consent, Article 9(2)(a), asked for separately at first run and withdrawable at any time without losing access to the rest of the app.
How long it is kept
Audio recordings are deleted 30 days after capture. The entries extracted from them stay until you delete them or close your account. Withdrawing consent stops further health-data processing; it does not by itself erase what is already stored, which is what a deletion request is for.
Who else processes it
Google Cloud and Firebase host the application, the database and the audio storage, in the europe-west1 region. Google Vertex AI performs transcription and extraction, through Google's global endpoint, which may serve the call from any region Google operates. Stripe processes subscription payments: it receives the email address on your account and the billing address you give it at checkout, and no health data. Signing in with Apple or with Google tells that provider you use Farkad and gives us the address you agree to share; neither receives anything you log. No data is sold, and none is used for advertising.
Your rights
You may request access to your data, correction, erasure, a portable copy, and you may withdraw a consent you have given. Those rights are the same wherever you are: Quebec's Law 25 and Canada's PIPEDA, the state privacy laws in the United States, and Algeria's Law 18-07 all grant them, and we do not ask which one you are relying on. Send any of them to mellah.brahim.redouane@gmail.com and we will respond within 30 days. You may also complain to your own regulator — in Quebec the Commission d'accès à l'information, federally the Office of the Privacy Commissioner of Canada, in Algeria the ANPDP.
Contact
Write to mellah.brahim.redouane@gmail.com for anything on this page, including a request to exercise one of the rights above.