Privacy Policy

Last updated: 4 November 2026

1. Controller

Astral Anvil Software AB (org. no. 559603-7001), Stockholm, Sweden ("we", "us") is the controller of the personal data processed in connection with the Last We Left mobile application, the associated Discord bot and the website lastweleft.com (together, the "service"). Our contact details are set out in section 10.

2. Personal data we process

We process account data, consisting of an email address, a display name and either a hash of the password or an identifier provided by Google or Apple where their sign-in is used; recordings and other audio that users record, upload or capture with the Discord bot; and the transcripts, notes and other content generated from such recordings or entered by users. In order to attribute speech to the correct speaker, the service creates voice profiles from voice samples and recordings, which are used only within the campaign to which they belong. We further process Discord server and user identifiers where a Discord server is linked to the bot, feedback submitted through the application together with any attached screenshot and the application and device version, push notification tokens, subscription status, and server logs containing IP addresses and request data. A recording may contain the voices of persons other than the user who makes it, and that user is responsible for informing such persons and obtaining their agreement before recording. The application contains no analytics, advertising or crash reporting tools, and the website does not set cookies.

3. Purposes and legal bases

Account data, recordings, campaign content, push notification tokens and subscription status are processed in order to provide the service requested by the user, on the basis that the processing is necessary for the performance of a contract (Article 6(1)(b) GDPR). Voice profiles may constitute biometric data and are processed on the basis of consent (Articles 6(1)(a) and 9(2)(a) GDPR), which may be withdrawn at any time by deleting the relevant voice data in the application. Feedback, server logs and other technical data are processed on the basis of our legitimate interest in operating, securing and maintaining the service (Article 6(1)(f) GDPR). Account data must be provided in order to use the application; other personal data is processed only where the related feature is used.

4. Recipients and transfers

Personal data is processed on our behalf by service providers bound by data processing agreements, within the following categories: cloud hosting (Google Cloud, within the EU, except for the server operating the Discord bot, which is located in the United States); AI service providers generating text from session content (United States); email and notification services (within and outside the EU/EEA); subscription management (RevenueCat, United States, which receives a user identifier only); and website hosting (Cloudflare). The application retrieves fonts from Google Fonts, which receives the IP address of the device. Google, Apple, the app stores and Discord process personal data as independent controllers where users sign in with, purchase through or use their services. Transfers to countries outside the EU/EEA are based on the EU–US Data Privacy Framework or on standard contractual clauses adopted by the European Commission, information about which may be obtained from us. Our AI service providers are not permitted to use the data to train their models. We do not sell personal data and do not use it for advertising.

5. Retention

Campaign content, recordings and voice profiles are retained until they are deleted in the application or the campaign is deleted, and the deletion of a session includes the data derived from it. Account data is deleted when the account is deleted, which takes effect immediately; campaigns owned by the account are then transferred to their longest-standing other member or, where there is none, deleted. Temporary processing files are deleted within 30 days. Feedback is retained for up to 24 months and ceases to be linked to an account when the account is deleted. Server logs are retained for up to 30 days and database backups for 7 days.

6. Your rights

Subject to the conditions set out in the GDPR, you have the right to request access to and rectification or erasure of your personal data, restriction of its processing and data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal. Most personal data can be edited or deleted directly in the application, where the account can also be deleted. You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or with the supervisory authority of your country of residence.

7. Children

The service is not intended for persons under the age of 16. Accounts found to have been created by such persons are deleted.

8. Security

Personal data is encrypted in transit and at rest, access to our systems is restricted, and passwords are stored only in hashed form. In the event of a personal data breach, we notify the supervisory authority and affected users as required by the GDPR.

9. Changes

We may update this policy. Material changes are announced in the application or by email before they take effect.

10. Contact

Astral Anvil Software AB, Stockholm, Sweden. Email: support@astralanvil.com