Español

Privacy

Last updated: 22 October 2026.

Accounts and Versos Plus are not open yet. Until they open, Versos keeps nothing about you on our servers beyond the anonymous counts described under "What the server counts". Sections marked "(when accounts open)" describe how accounts, subscriptions, the launch offer and referrals will work once they do.

Versos is built to need as little of your data as possible. This page says, plainly, what stays on your device, what the server counts, and for how long.

Data controller

Versos is operated by DSL4 Digital, S.L.U., NIF B93958742, registered at Calle Armiño 6, BB P2 12, Arona, S/C Tenerife, 38632. Mercantile Registry of Santa Cruz de Tenerife, Section 8, Sheet 78183, entry 1/2026/7004. Contact: [email protected].

Accounts are optional (when accounts open)

You can read, listen and review without one. An account is an email address and nothing more: it lets your progress follow you between your devices and, if you subscribe, lets Versos know it's you. We keep your email, when you signed in, and the progress you choose to sync. You can download all of it or delete the account yourself at any time from the Account page. Deleting is immediate; copies in our database backups are gone within 30 days. Accounts are for people aged 14 and over. Apart from the premium-poem counters described below, reading, listening and reviewing stay anonymous.

One cookie, only if you sign in (when accounts open)

If you sign in, Versos sets one cookie, and its only job is to keep you signed in (it lasts 90 days from the last time you use Versos, and signing out removes it). If you don't sign in, Versos sets no cookies. Two other small items are stored in your browser for the same strictly necessary purpose: a sign-in token in local storage, used as a fallback when the browser does not send the cookie, and, in session storage, the plan you picked before signing in, so we can take you back to it (it is deleted as soon as it is used, or when you close the tab). None of these needs consent. Page-view statistics come from Cloudflare Web Analytics, which is cookieless and does not track you across sites. There is no advertising, no profiling and no third-party tracker on these pages.

What stays on your device

Your study progress, review scheduling and voice/reading preferences live in your browser's local storage. If you don't sign in, they never leave it. If you do, they are copied to your account so your other devices can pick them up. Your browser also remembers the last day you used Versos, so we can count daily readers without identifying anyone; that day stamp is never synced. Clearing your browser data clears what is on this device; the Returns page can save a backup file that you keep.

What the server counts

Daily totals, with no name, no identifier and no history of what you read: poems opened (also counted per poem: which poem, how often it was opened and how long it was listened to), glosses and words tapped, which reader was played (the poet, the translation or the lesson) and for how many seconds, reviews done, demo starts, whether the next poem started by itself or by a tap, how far the welcome tour got (which step, skipped or finished), poems shared (only the channel: WhatsApp, copy link and so on) and shared links opened, errors, and the language. One row per day per combination of those — nothing per person. Feedback you type on a poem is stored as you sent it, with the poem and language, and nothing else about you. These daily totals are never joined to accounts.

Your IP address is used only for limits: an abuse limit on the counting, feedback and sign-in endpoints, kept for 24 hours and then deleted; the monthly limit on new audio renders — a poem played from the cache, which is almost every play, records nothing; and, if you have no account, the weekly count of premium poems described below. None of these is joined to anything else, shared or sold.

Premium poems and on-demand readings (when accounts open)

Outside the beta, free users may open a limited number of premium poems per week and paid plans a limited number of on-demand readings per month. To count these we keep one row per week (or month) per account or, without an account, per IP address, holding only a number, plus a one-way mark per poem so replays are not counted twice; the marks hold no readable history and are deleted after 40 days. For paid plans we also keep the euro cost of your on-demand readings per month. These counters are tied to your account; nothing else about your reading is.

If you subscribe to Versos Plus (when accounts open)

Payment is handled by Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA), which act as an independent controller for the payment itself: they receive your email, name, billing country or address (used to apply the right VAT/IGIC rate and kept as tax evidence), and your card details, which never reach us. We keep: which plan you have, its status and renewal date, your Stripe customer and subscription ids, invoices as required by Spanish tax and commercial law (kept for six years after the year of the invoice), and a one-way "fingerprint" that Stripe derives from your card, which we use only to detect self-referrals and refund abuse (never to identify the card).

Launch offer and referrals (when accounts open)

When you create an account during the launch offer we record your place in the queue and until when your free months run. If you share your referral link and someone creates an account with it, we store that they were referred by you and, when they first pay, that a credit is due to you. The other person only ever sees that "a referral" paid, never your email, and you never see theirs. The conditions are in the promotion terms.

How long we keep it

• Daily usage totals: kept, as totals, to see how Versos is used over time.
• Raw usage events (Cloudflare Analytics Engine): 3 months, then gone.
• Per-poem daily counts (opens, listening seconds): about 13 months.
• Abuse-limit rows (IP + minute or hour): 24 hours.
• Monthly render-limit rows (IP + month): the month they apply to; past months are cleared in database housekeeping.
• Premium-poem counters: the week or month they cover (per-IP rows deleted after 40 days); one-way poem marks: 40 days.
• Feedback text: up to 12 months.
• Accounts (email, sign-in times, synced progress): until you delete the account. After 24 months without sign-in we may delete the account, and we email you 30 days before.
• Sign-in codes: valid 15 minutes; the record is deleted after 24 hours.
• Signed-in sessions: 90 days after you last use Versos, or when you sign out.
• Subscription and invoice records: six years after the invoice year (Código de Comercio art. 30).
• Referral records: while the referrer's account exists.
• Card fingerprint: until the account is deleted.
• Stripe's own payment records: per Stripe's own retention.
• Cloudflare Web Analytics: per Cloudflare's own retention.

Legal basis

An account, and syncing your progress to it, is a service you ask for, so we process your email and synced progress to provide it (GDPR art. 6(1)(b)). The sign-in cookie, the fallback sign-in token and the remembered plan choice are strictly necessary for that service, so they need no consent.

If you subscribe, we process your plan and billing data to perform the contract with you (GDPR art. 6(1)(b)) and to meet tax and accounting obligations (art. 6(1)(c)). The card fingerprint and referral checks rely on our legitimate interest in running the referral programme fairly and preventing abuse (art. 6(1)(f)).

Counting aggregate use and limiting abuse is our legitimate interest in running and protecting a free service (GDPR art. 6(1)(f)); so is counting premium poems, so the free tier can stay free. Nothing on your device is used for measurement beyond the day stamp above, and no daily total is tied to a person, so no consent banner is needed. Feedback you choose to send is processed because you asked us to read it.

Who processes data for us

Cloudflare, Inc. (USA; hosting, database, file storage, analytics) under its Data Processing Addendum, with the EU-US Data Privacy Framework and EU Standard Contractual Clauses for transfers; our database is stored in Cloudflare's network. Resend, Inc. (USA) sends sign-in and account emails; it receives only your email address and the message, processes mail in its EU region, and is covered by the EU Standard Contractual Clauses for anything transferred to the US. Stripe (Ireland/USA) handles payments, under the Data Privacy Framework and Standard Contractual Clauses. New audio is generated by a self-hosted speech model on Modal Labs, Inc. (USA), by the ElevenLabs, Inc. (USA) text-to-speech API, or, when a premium reading is made on demand, by Google LLC's (USA) Gemini text-to-speech API. Modal, ElevenLabs and Google receive only the public-domain poem text being read — never anything about you as a visitor.

What we email you (when accounts open)

Sign-in codes, a confirmation when you subscribe, invoices and receipts (from Stripe), notices that a plan is about to change, and one warning before an account unused for 24 months is deleted. We send no marketing email.

Your rights

You can ask for access to, correction or deletion of your data, ask us to restrict its processing (GDPR art. 18), object to processing based on our legitimate interests, and receive the data you gave us in a portable format (art. 20). If you have an account, the Account page lets you download everything and delete the account yourself. Otherwise write to [email protected]; we answer within one month and never charge. Because the daily usage totals hold no identifier there is nothing in them to find; feedback can be deleted on request. You can also complain to the Spanish data protection authority, the AEPD (aepd.es).

Changes

If this page changes, the date at the top changes with it.