FANVELA Processor and International Transfer Notice

Last updated: 31 July 2026

Document version: 2026-08-17-v15

This notice supplements the FANVELA Privacy Policy. It identifies the principal cloud recipients used when a user deliberately enables an online feature. Provider terms and infrastructure change; the current official links below form part of this notice.

To meet transparency, third-party sharing, and international-transfer duties, this notice retains recipient names and rights channels. It intentionally omits API addresses, access keys, specific models, prompts, routing thresholds, failover rules, commercial rates, and internal system architecture that are not needed to exercise user rights. Those security and commercial configurations are kept only in controlled internal records.

Internal access governance

FANVELA is operated individually by Zhang Yubo, independent developer and account owner. Internally authorised personnel are not third-party processors, co-owners, or joint controllers. They may handle only the minimum support, diagnostic, operational, or rights-request information where the account owner has expressly instructed the work, the task requires it, and access has been granted separately. Confidentiality, purpose limitation, attributable individual accounts, and prompt revocation apply. Production provider keys are not distributed in the App and must not be shared with staff.

Soniox

• Provider and role: Soniox, speech AI processor/service provider.
• Feature: realtime conversation, meeting transcription and translation, and optional async recording refinement.
• Data: microphone audio or uploaded recording, language choices, terminology, glossary pairs, usage context, pseudonymous session or job reference, transcript/translation output, timestamps, duration and usage metadata.
• Transfer/region: Soniox has enabled EU, United States, and Japan regions for FANVELA. European networks use only the EU speech region. Other regions choose and fail over only between the United States and Japan regions and cannot consume European speech capacity. No cloud-speech credential is issued inside mainland China.
• Retention: Soniox states that realtime audio is processed in memory and is not retained after the session. Async transcriptions remain until deletion; FANVELA requests deletion after completion, cancellation, or cleanup.
• Training: Soniox states that it does not use customer data to train models.
• Contract materials: the Soniox DPA, subprocessor list, security, retention, and compliance downloads are available to the account owner in Soniox Console > Security & Compliance. These account-specific materials must be downloaded and retained by FANVELA before public launch.
• Official resources: https://soniox.com/docs/security-and-privacy ; https://soniox.com/docs/data-residency ; https://soniox.com/policies

OpenAI

• Provider and role: for EEA users, the contracting OpenAI entity identified in the applicable agreement/DPA; processor/service provider for requested text generation.
• Feature: precise text translation, quick study, deep study, AI vocabulary extraction, and photo extraction in supported access regions outside mainland China and Russia.
• Data: selected text or transcript, existing translation, language pair, glossary, translation-memory examples, course or usage context, instructions, output and token metadata. No raw audio is sent by FANVELA.
• Transfer/region: processing may occur in the EEA, United States, and subprocessor locations. Any data-residency or stricter retention control applies only if our project is eligible and the control is actually enabled.
• Retention/training: OpenAI states API data is not used for training unless the customer opts in. Default abuse-monitoring retention may apply as described in OpenAI's current API data-control documentation.
• Safeguards: OpenAI DPA, applicable Standard Contractual Clauses/adequacy mechanisms, security measures, and published subprocessor list.
• Official resources: https://openai.com/policies/data-processing-addendum/ ; https://openai.com/policies/sub-processor-list/ ; https://developers.openai.com/api/docs/guides/your-data

Google Cloud

• Provider and role: Google Cloud, text-translation, hosting, and infrastructure processor/service provider.
• Feature: normal online text translation in supported access regions, the FANVELA API, account and billing database, service logs, networking, and temporary recording uploads for cloud refinement. Online text translation is not offered to network environments inside mainland China.
• Data: for online translation, typed text, source/target languages, and glossary entries matched for that request; also account identifiers and email made available by Apple, balances and purchase references, service usage, jobs and outputs, optional diagnostics, temporary recordings, and operational/security metadata. The FANVELA server does not retain normal-translation source text or output.
• Region: the application backend and temporary recording storage are primarily configured in Milan, Italy. Online text translation is not represented as processing content only in Milan or the EU. Some account, support, security, and service metadata may also be processed from other locations under Google's terms and subprocessor arrangements.
• Retention: temporary recording objects are deleted after processing/cancellation and operational cleanup. Other data follows the periods in the Privacy Policy.
• Safeguards: Google Cloud Data Processing Addendum, regional controls, encryption, and Google's published subprocessors and transfer mechanisms.
• Official resources: https://cloud.google.com/terms/data-processing-addendum/ ; https://cloud.google.com/terms/subprocessors ; https://cloud.google.com/about/locations/ ; https://cloud.google.com/translate/data-usage

Optional Google/YouTube embedded playback (2026-09-09 supplement)

• Update dated 2026-09-16: after the notice and selection of Add link, Load or Retrieve captions, the App connects directly to the official YouTube player and public-caption endpoints. Google/YouTube receives IP, device/browser information, video identifier and playback interactions. On-device translation may require language-pack downloads. This service is separate from Google Cloud hosting and is not represented as EU-only processing.
• YouTube Terms of Service and Google's Privacy Policy apply; the Cloud CDPA is not a substitute. See privacy policy section 3.9. Haofanyi does not send local recordings, vocabulary or AI study content to this player and does not proxy media downloads.

Cloudflare network-region detection

• Provider and role: Cloudflare, operator of the network-diagnostic endpoint and global network.
• Feature: before a user-requested cloud feature, returns a two-letter country/region code based on the current Internet egress for the mainland-China restriction and selection between the European speech pool and the United States/Japan speech pools.
• Data: public IP address, TLS/HTTP connection metadata, and ordinary client-network information. The App extracts only the country/region code, does not request GPS, sends no translation text or audio to Cloudflare, and does not retain the IP from the response.
• Region and retention: Cloudflare's global network may process the request at edge locations or through approved subprocessors outside the user's country. Retention and security follow Cloudflare's applicable policies and agreements.
• Official resources: https://www.cloudflare.com/privacypolicy/ ; https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://www.cloudflare.com/gdpr/subprocessors/

Apple

• Role: independent controller for Apple ID, Sign in with Apple, App Store distribution, purchases, subscriptions, taxes, and refunds; service provider to FANVELA for limited developer services where applicable.
• Data: Apple user identifier, relay or account email and name if disclosed, App Account Token, product and transaction data, refund/revocation status, device/App Store metadata governed by Apple's terms.
• Official resources: https://www.apple.com/legal/privacy/ ; https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

Mainland China notice

Since July 20, 2026, FANVELA offers no AI cloud feature (live conversations, meetings, cloud refinement, AI study, precise translation, or photo extraction) to network environments inside mainland China: such requests are rejected before processing, with no transfer of audio, text, images, or task metadata, and no processor disclosure occurs. On-device offline translation, recording, and local study data stays on the device. Users located abroad — including customers using a China-region App Store account — are unaffected and are routed by their actual access region.

That recorded confirmation does not replace any mandatory Chinese security assessment, standard-contract filing, certification, impact assessment, localization obligation, or requirement to establish a representative or entity. Until those requirements are assessed and completed, mainland-China public distribution of cloud features remains a release blocker.

Russia notice

Text-AI features, including precise translation, AI study, AI vocabulary extraction, and photo extraction, are currently unavailable from Russian network access. Requests are rejected before content is sent or quota is reserved. Realtime speech and on-device features continue under the corresponding rules in this notice.

Questions and rights

To withdraw a consent, use Settings > Privacy and Data. For access, export, correction, deletion, or questions about a recipient, contact yubo.zhang.bb@gmail.com.