Operating entity
The hosted OpenVerbatim service is operated by WordLimit AI LLC("we", "us", "our"), a limited liability company registered in Colorado, USA.
1. Scope: two forms, two very different answers
OpenVerbatim exists in two forms, and the privacy answer depends entirely on which one you use:
- Self-hosted software (Apache-2.0). You run the software on your own infrastructure. Your Research Data — audio, transcripts, codes, and analysis — stays on the machines you control. We do not receive it, store it, or have access to it. This policy's sections about how we process data do not apply to a self-hosted instance; the privacy practices of that instance are yours to define.
- Hosted service. You create an account and we run the software for you. Here we do process data, and the rest of this policy explains what we process and why.
2. Our roles on the hosted service
On the Hosted Service we act in two capacities:
- For your account data, we are the controller. We decide how account and billing information is handled in order to run the service and bill you.
- For your Research Data, we are a processor acting on your behalf. You decide what enters your projects; we process that material only to provide the service to you and under your instructions.
3. What we process
Account and billing data (as controller):
- Contact and account information such as name and email address.
- Authentication data needed to secure your account.
- Billing and usage records, including audio-hours metered for billing. Payment card details are handled by our payment processor, Stripe, and are not stored by us.
- Technical logs generated when you use the service.
Research Data (as processor):
- Audio recordings you import.
- Transcripts produced from that audio.
- Codes, annotations, and analysis you and your team create, including AI coding suggestions and the human decisions that confirm or reject them.
4. How we use research data
On the Hosted Service, Research Data is used only to provide the service to you: transcription, AI-assisted coding, storage, collaboration, sharing you initiate, and the features you interact with. We do not use your Research Data for advertising, we do not sell it, and we do not use it to train AI models.
5. AI processing
Transcription and AI-assisted coding involve automated processing. Some of this processing is performed through third-party AI processing providers under their data processing agreements, so that the material is processed only to deliver the service.
AI coding output is stored as a suggestion. It is not treated as a confirmed result until a human reviewer explicitly confirms or rejects it, and each decision is recorded in an append-only audit trail.
6. Subprocessors
We rely on a small set of third-party providers to operate the Hosted Service. The current subprocessors and their roles are:
- ClearStack B.V. (Netherlands) — server hosting and infrastructure.
- Deepgram, Inc. (USA) — speech-to-text transcription.
- Anthropic, PBC (USA) — AI processing for coding suggestions and analysis.
- Stripe, Inc. (USA) — payment processing.
- Cloudflare, Inc. (USA) — DNS, content delivery, and security.
This list is kept current on this page; we may add or replace providers as the service evolves.
7. Participant consent withdrawal and deletion
Research involves people who may withdraw their consent. OpenVerbatim treats a withdrawal as an interview-level event. When an interview is withdrawn, it is deleted through cascade deletion — the audio file, transcript, codes, embeddings, and any shared excerpts drawn from it are removed. A shared link that loses all of its excerpts is revoked automatically.
Because deletions must be honored without erasing the fact that they happened, the audit record is handled by tombstoning: the audit event skeleton (what type of thing happened, and when) is preserved, while withdrawn participant content is replaced with a marker indicating it was cleared on withdrawal. The deletion action itself is recorded as a new audit event. Deletion is irreversible.
8. Sharing
Nothing is shared by default. Full transcripts and original audio are never placed on a public sharing surface. Only the specific excerpts you explicitly review and approve, one at a time, can appear in a shared view, and you can revoke a shared link at any time. Where you choose to publish an item on your own responsibility, that confirmation is recorded.
9. Retention and deletion
We retain Research Data for as long as you keep it in your account, and you can delete interviews and projects yourself. Account and billing records may be retained as long as needed to operate the service and to meet legal and accounting obligations.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, export, or object to the processing of your personal data, including rights under the GDPR and the CCPA. To exercise these rights, contact us atlegal@openverbatim.com.
Note that for Research Data we act as a processor: requests from a participant about their data are usually directed to you, the researcher who controls that data, and we support you in responding.
11. International data transfers
The Hosted Service stores Research Data on infrastructure located in the Netherlands (European Union). Some subprocessors — transcription, AI processing, and payments — are located in the United States; where personal data is transferred to them, we rely on the contractual safeguards in their data processing agreements.
12. Security
We use technical and organizational measures to protect data on the Hosted Service, including encrypted transport, access controls, and an append-only audit trail for analysis decisions. No system is perfectly secure, and self-hosting shifts responsibility for security to the operator of that instance.
13. Children
The Hosted Service is not directed to children, and accounts are intended for adults.
14. Changes to this policy
We may update this policy. When we make material changes we will take reasonable steps to notify account holders.
15. Contact
Privacy questions can be sent to legal@openverbatim.com. The data controller for account and billing data is WordLimit AI LLC.
You can inspect how the software handles review state, audit events, deletion, and sharing in the public repository.