1. Introduction
Handby LTD ("we", "us", "our"), a company registered in England and Wales, operates VerseAir, an AI-powered Bible verse projection application for churches and religious organisations, and the website getverseair.com (the "Website").
This Privacy Policy explains what personal data we collect, why we collect it, how we process it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using VerseAir or visiting our Website, you acknowledge that you have read and understood this policy.
Data Controller: Handby LTD
Contact: letsupport@getverseair.com
2. Data We Collect
2.1 Information you provide
- Purchase information: When you subscribe to a paid plan, we collect your email address to associate with your license key and send transactional emails (purchase confirmation, license key delivery). Payment card details are collected and processed directly by our payment processor, Stripe, Inc. — we never receive, see, or store your card number.
- Contact form submissions: When you contact us through our Website, we collect your name, email address, subject category, and message. These are stored in our database and forwarded to our support email via Resend (our email delivery service).
- Support correspondence: If you email us directly, we retain the content of your communications to provide support and maintain records.
2.2 Information collected automatically
- License activation data: When you activate a license, we record a device identifier (a hash of your machine's characteristics), activation timestamp, and license status. This is used to enforce per-device licensing and prevent abuse.
- Usage analytics: We collect anonymised, aggregated data about feature usage, session duration, and application performance. This data contains no personally identifiable information, no sermon content, and no verse selections. It is used solely to understand which features are most valuable and to guide product development.
- Website analytics: Our Website may use analytics services to understand visitor behaviour (pages visited, referral sources, device type). No cookies are used for advertising or cross-site tracking.
- IP addresses: We log IP addresses for rate limiting (e.g., on the contact form) and security purposes. IP addresses are not associated with user accounts and are not used for tracking or profiling.
2.3 Speech audio processing
VerseAir's speech-to-verse feature streams microphone audio to a third-party speech recognition service for real-time transcription. This audio is:
- Processed in real time and not stored, recorded, or retained by VerseAir or Handby LTD
- Used exclusively for detecting Bible verse references — no sermon transcripts are generated, stored, or transmitted
- Sent over encrypted (TLS) connections
You can disable speech recognition at any time by clicking the microphone button. When the microphone is off, no audio data leaves your device.
2.4 AI features
When you use AI-powered features (sermon summaries, outlines, cross-references, contextual search), text data is sent to a third-party AI service for processing. This data is:
- Processed in real time for the specific request
- Not used to train AI models
- Not stored by us beyond what is displayed in your current session
3. Data We Do Not Collect
We are committed to minimal data collection. The following is never collected, transmitted, or stored by Handby LTD:
- Sermon content or transcripts: Speech processing is used exclusively for verse detection. No transcription is saved.
- Congregation data: The companion web app operates entirely over your local network. Companion sessions, verse views, notes, and bookmarks remain within your local network and are never sent to our servers.
- Verse browsing history: Your search history, recently viewed verses, and bookmarks are stored locally on your device only.
- Companion user personal notes: Notes and bookmarks made by congregation members exist only in their browser session and are not transmitted externally.
- Worship song selections or service schedules: All service planning data remains on your device.
4. Legal Basis for Processing (UK GDPR)
We process personal data under the following lawful bases:
| Processing Activity | Legal Basis |
|---|---|
| License activation and management | Performance of a contract (Art. 6(1)(b)) |
| Payment processing via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails (license keys, receipts) | Performance of a contract (Art. 6(1)(b)) |
| Contact form and support correspondence | Legitimate interest (Art. 6(1)(f)) — responding to enquiries |
| Product update communications | Legitimate interest (Art. 6(1)(f)) — you can opt out at any time |
| Anonymised usage analytics | Legitimate interest (Art. 6(1)(f)) — product improvement |
| Rate limiting and security | Legitimate interest (Art. 6(1)(f)) — protecting the service |
| Speech audio processing | Consent (Art. 6(1)(a)) — you choose to enable the microphone |
5. How We Use Your Information
- License activation and management: Your email and license key are used to activate VerseAir, verify your subscription tier, and manage your account.
- Customer support: If you contact us, we use your information to respond and resolve issues.
- Product improvement: Anonymised usage analytics help us understand how VerseAir is used and prioritise features. No personally identifiable information is included.
- Product communications: We may send important product updates, security notices, or service announcements. You can opt out of non-essential communications at any time.
- Fraud prevention and abuse mitigation: We monitor for licence key abuse, rate-limit API usage, and log IP addresses on the contact form to prevent spam.
6. Local Processing and the Companion App
VerseAir is designed to run locally on your computer. The desktop application operates independently and does not require a persistent internet connection for core functionality once Bible translations have been cached.
The companion web app operates over your local Wi-Fi network. Congregation members connect by scanning a QR code and interact entirely within your local network. No companion data is routed through external servers, and no congregation information ever leaves your building.
The remote control app works the same way — entirely over your local network, PIN-secured, with no external data transmission.
7. Third-Party Services and Sub-Processors
We use the following third-party services to operate VerseAir:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing | Email, payment details (collected directly by Stripe) |
| Speech recognition provider | Real-time speech-to-verse detection | Audio stream (not stored after processing) |
| AI service provider | Sermon summaries, cross-references, contextual search | Text prompts (not stored, not used for training) |
| Resend | Transactional email delivery | Recipient email, email content |
| Railway | Server infrastructure hosting | License data, contact form submissions |
| GitHub | Application distribution (downloads) | Download requests (standard web logs) |
| Vercel | Website hosting | Standard web analytics (page views, referrers) |
We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.
8. International Data Transfers
Handby LTD is based in the United Kingdom. Some of our third-party service providers operate in the United States and other countries. When personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the ICO
- Adequacy decisions where applicable
- Providers participating in recognised data protection frameworks
Speech audio is processed in real time and not stored, minimising the impact of any cross-border transfer.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| License and account data | Duration of subscription + 12 months after cancellation |
| Payment records | As required by UK tax law (typically 6 years) |
| Contact form submissions | 24 months, then deleted |
| Support correspondence | 24 months after last communication |
| Usage analytics | Retained in anonymised, aggregated form indefinitely |
| Speech audio | Not retained — processed in real time only |
| IP addresses (rate limiting) | Cleared from memory after 1 hour |
You may request deletion of your personal data at any time (see Section 11).
10. Cookies and Local Storage
Website (getverseair.com): Our Website does not use cookies for advertising or cross-site tracking. Essential cookies or local storage may be used for basic functionality such as remembering preferences.
VerseAir desktop application: The app uses local storage technologies (IndexedDB, localStorage) to cache Bible verses, store preferences, and maintain verse history. This data is stored entirely on your device and is never transmitted to our servers.
Companion and remote apps: These use browser session storage for the duration of the connection. Data is cleared when the browser tab is closed.
11. Your Rights
Under the UK GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate personal data.
- Right to erasure (Art. 17): Request deletion of your personal data. Upon deletion, your licence will be deactivated.
- Right to restriction (Art. 18): Request that we limit how we use your data.
- Right to data portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interest, including product communications.
- Right to withdraw consent: Where processing is based on consent (e.g., speech recognition), you can withdraw consent at any time by disabling the feature.
To exercise any of these rights, contact us at letsupport@getverseair.com. We will respond within 30 days of receiving your request. If we need additional time (up to 60 further days), we will inform you and explain the reason.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
12. Automated Decision-Making
VerseAir uses automated processing in the following ways:
- Speech-to-verse detection: Automatic identification of Bible references from spoken audio. This is a core feature you activate voluntarily and does not produce legal or similarly significant effects.
- AI sermon tools: Automated generation of summaries, outlines, and cross-references based on text you submit. Outputs are suggestions for your review — no automated decisions with legal effects are made.
- Abuse detection: Automated rate limiting and idle detection for speech recognition usage. These may temporarily pause features but do not affect your account status or subscription.
None of these automated processes make decisions that produce legal effects or similarly significantly affect you as defined under UK GDPR Article 22.
13. Data Security
We implement appropriate technical and organisational measures to protect your data:
- Encryption in transit: All communications between VerseAir and our servers use TLS encryption.
- Secure credential storage: API keys and sensitive credentials are stored in the Electron app's isolated userData directory.
- Access controls: Administrative access to our servers and database is restricted and authenticated.
- Payment isolation: We never receive or store payment card details — all payment data is handled directly by Stripe's PCI DSS-compliant infrastructure.
- PIN-secured remote access: The remote control app requires a 4-digit PIN for authentication.
- Local network isolation: Companion and remote apps operate over local Wi-Fi only.
While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to maintaining robust protections and will notify affected users promptly in the event of a data breach.
14. Children's Privacy
VerseAir is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information promptly.
Congregation members (including minors) who use the companion app do not provide personal information to us — the companion operates entirely over the local network with no data transmitted to our servers.
If you believe a child under 13 has provided us with personal information, please contact us at letsupport@getverseair.com.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:
- We will update the "Last updated" date at the top of this page
- We will post the revised policy on our Website
- For significant changes, we may notify registered users by email
We encourage you to review this page periodically. Continued use of VerseAir after changes constitutes acceptance of the updated policy.
16. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: letsupport@getverseair.com
- Company: Handby LTD (registered in England and Wales)
For complaints about data protection, you may also contact the UK Information Commissioner's Office (ICO) at ico.org.uk.