Last updated 19 October 2026 · Version 2.3, replacing version 2.2 of 19 October 2026 (a new row for the contact form in section 2 and bot protection in section 4). This is an English translation of the Finnish original; if the versions differ, the Finnish version applies.
Espero is a multilingual messenger: everyone writes in their own language, and AI translates messages, voice messages, images and event speech into the recipients' languages. This policy explains what data we process, why, for how long and to whom it is passed, and what your rights are. We also say plainly what the server can read.
The controller is Quiet North, Inc., a company registered in Delaware, United States (Delaware file number 10788695). Registered address: 2810 North Church Street, Wilmington, DE 19802, United States.
For all privacy matters and to exercise your rights: hello@espero.live.
Our primary database is currently located in the EU (Ireland). Some of our service providers process data outside the EU, mainly in the United States (sections 4 and 9). When an organisation such as a church, school, association or company runs an event in Espero, the organisation is the controller of the event data and Espero processes it on the organisation's behalf under the data processing agreement (section 3b).
The table lists each purpose, the legal basis under Article 6 GDPR, the retention period or its criteria, and the categories of recipients. The categories' tasks, processing countries and transfer mechanisms are in section 4. "Contract" means the processing is necessary to provide the service to you under the Terms of Service (Art. 6(1)(b)). "Legitimate interest" means the processing is necessary for the interest named in the table (Art. 6(1)(f)); you may object to it (section 7). "Consent" means the processing is based on your separate consent (Art. 6(1)(a)), which you may withdraw at any time. "Legal obligation" means obligations under accounting and tax law (Art. 6(1)(c)). The retention periods state when data is deleted automatically; other data is deleted when you delete it or your account (section 6).
| Purpose and data | Basis | Retention | Recipient categories |
|---|---|---|---|
| Account and sign-in: email address, one-time sign-in code, with Sign in with Apple the Apple identifier and the email it provides, session data and device name, platform and app version | Contract | While the account exists. The sign-in code expires in 15 minutes. A session ends when you sign out, delete the account or the session has long been unused. An unfinished registration is deleted after 14 days. | Database and server service; email delivery service; Apple, if you sign in with Apple |
| Profile and discoverability: name, username, profile picture, bio, links, language, visibility settings, followers, friends and blocks; a hash of your email address for contact discovery | Contract | While the account exists. Your username is reserved for 30 days after deletion. | Database and server service; content delivery and storage service |
| Messages, media, groups and stories: messages, voice messages, images, videos, documents, reactions, stories and their participants, times and read state | Contract | Until the message or group is deleted. Stories 24 hours, highlighted stories until you remove the highlight. Messages and media you have delivered to others remain in their conversations even after your account is deleted, but your profile can no longer be opened. | Database and server service; content delivery and storage service |
| Translation, transcription and image and video captioning: message text, audio, images, videos and video links, and the resulting translations, transcripts and descriptions | Contract | For the life of the message. Translations of very common short phrases may be kept in a shared translation cache without sender data for at most 180 days (section 3). | AI services (translation, images and videos; fallback); speech technology service (some voice messages); cache service; video service (video link details) |
| Search and AI features: semantic search, summaries, Ask Espero, pronunciation help, help assistant; message text and the search vectors computed from it, your questions | Contract (a feature you request) | Search text and vector for the life of the message. Summaries and answers are not stored; help-chat messages are deleted with the account. | Primary AI service; database and server service |
| Live interpreter and personal live mode: speech, its transcript and translation, the spoken translation | Contract | Live-mode audio 5 minutes and its metadata 10 minutes. In real-time interpreting your device sends audio directly to our primary AI service with a short-lived token. | Primary AI service; speech technology service |
| Calls: participants, call type, state and times, connection data such as IP addresses, call-notification tokens | Contract | Connection data is deleted when the call ends. Call history while the account exists. Call-notification tokens at most 97 days after the last update. Audio and video are not stored. | Content delivery and storage service (call relay); the phone operating system's notification service |
| Notifications: notification token, sender or group name, unread count; no message text | Contract and your device permission | Until you sign out, revoke the permission, the token stops working or you delete the account. | Notification relay and app update service; the phone operating system's notification service |
| Event live captions, song lyrics and listeners | See section 3b | Captions and listener data 30 days from the start of the broadcast; song lyrics as in section 3b | See section 3b |
| Own Voice: voice sample, voice model, consent version and time, spoken translations | Consent | The voice model until you delete your voice or your account. A spoken translation at most 24 hours. | Speech technology service |
| Reading translations aloud: the text to read and the chosen voice | Contract | Audio file at most 24 hours | Speech technology service |
| Subscriptions, purchases and translation hours: subscription tier and validity, store purchase identifiers; for web purchases the payment provider's customer identifier, order, payment and refund identifiers, product, amount, currency and tax status; balance and usage history (event name, languages, duration, peak listener count); for business customers the organisation name, billing address and VAT ID | Contract; legal obligation for invoices and accounting records | While the account exists. Accounting records for the period required by law. The sellers keep their own payment records under their own obligations (section 3d). | Apple, Google, Stripe and Link (section 3d) |
| Preventing trial and reward abuse: a hash of your email address, a keyed hash, the status of the trial and referral rewards | Legitimate interest: a free trial and rewards only once | While the account exists and 12 months after its deletion | Not disclosed |
| Safety and abuse prevention: blocks, reports and their reasons, rate-limit counters (which may contain a hash of an email address or IP address) | Legitimate interest: protecting users and the service; legal obligations | Blocks until you remove the block or the account. Reports are kept until they are no longer needed to investigate abuse or to meet legal requirements. Counters are kept for calculating limits and are not linked to your profile. | Database and server service; authorities where the law requires |
| Diagnostics and service development: crash reports without message content or user identifier; content-free error reports and technical measurements; the cost of AI requests per user | Legitimate interest: a working, secure service and cost control | Error reports and technical measurements 30 days. AI request cost records 90 days. Crash reports for a limited time in the error-tracking service. | Error-tracking service; database and server service |
| Translation quality review (voluntary): the texts you select and their translations | Consent | 30 days | Database and server service |
| Translation feedback and reporting a message: when you rate the translation of a message you received as poor or report a message: the message, its translation, your feedback or the reason for the report, and basic details such as languages and time | Legitimate interest: checking and improving translation quality and protecting users and the service (section 3) | Translation feedback 12 months. Reports as above. | Database and server service |
| Support and feedback: the feedback you send, its translation, app version and platform; your emails to hello@espero.live | Contract; legitimate interest: service development | In-app feedback is deleted with the account. Emails until the matter is handled and the correspondence is no longer needed. | Database and server service; email service |
| Contact form (espero.live): name (optional), email address, subject, message and the page language; to prevent misuse, keyed identifiers derived from the IP address and the email address that limit how many messages can be sent | Legitimate interest: answering enquiries and preventing misuse of the form; for quote requests, steps prior to a contract | Form messages are deleted automatically after 12 months, or earlier at your request; the limiting identifiers within one day. Our email replies are kept like other email. | Database and server service; email delivery service; email service; bot protection |
| Finding friends from your contacts (optional): hashes of the email addresses in your address book, for matching | Consent (the device contacts permission) | The hashes of your request are not stored. | Database and server service |
| Campaign measurement: the campaign link's source, medium, campaign, content and code, if you create an account from a campaign link; uses of a short campaign link without IP address | Legitimate interest: evaluating the effect of our own campaigns | In the account while it exists. Short-link counters until the campaign's results are no longer needed. No campaign data is stored in your browser (section 6a). | Database and server service |
| Website and web app: page requests and IP address; web-app performance measurements without an identifier or the exact URL path; the event demo's trial texts | Legitimate interest: the operation and security of the site | Hosting and delivery logs for a limited time under the provider's log policy. Demo texts are not stored; only a hash of your address is stored for rate limiting. | Website hosting and delivery service; primary AI service (demo translation) |
We do not sell your data, show ads or build advertising profiles. We do not collect your contact list without explicit permission. Creating an account requires an email address; without it we cannot provide the service. The acknowledgement of AI processing shown when you set up the app informs you about the processing; the processing itself is based on the contract, because translation is the core of the service.
The optional "Find friends" asks for contacts permission. Your device converts the email addresses in your address book into one-way cryptographic hashes. Only the hashes are sent to the server, which compares them against the hashes of account emails and returns matches. The hashes of your request are not stored, and your address book with its names, numbers or addresses is never uploaded or kept. You can deny or revoke the permission in your device settings. If you do not want others to find you this way, turn off contact discovery in Espero's privacy settings; a hash of your email address is still computed, but it is not returned as a match.
Message text, voice-message transcripts and image and video descriptions are sent to third-party AI services for translation. Our primary AI service translates text and processes images and videos; when it is unavailable, a second AI service in the United States translates as a fallback. Voice messages are transcribed in the United States: Finnish, Ukrainian, Russian, Arabic and German ones by the speech technology service and the others by an AI service. The services' processing locations and transfer mechanisms are in section 4. One message is translated into the recipients' languages in a single request. Translation requires processing the text: the server can read cloud messages, so we do not claim they are end-to-end encrypted.
Reuse of common phrases. Translations of very common short phrases (at most 200 characters) may be reused to speed up the service. The cache stores a hash of the text and the translation without sender data; the original text is not stored in the cache in plain form. Entries are deleted after at most 180 days (longer texts after 7 days). Reuse may be limited to phrases that several different users have sent.
AI and model training. We do not use your messages to train AI models. If we want to do so in the future, we will first ask for your separate consent. We use the paid APIs of AI services whose terms state that the providers do not use your content to train their own models. They may keep requests for a limited period for abuse monitoring (under their current terms at most about two months; none for speech recognition).
When you send a message to us for review. When you rate the translation of a message you received as poor or report a message, you send us the message, its translation and your feedback or report, together with basic details such as languages and time. We use only what you send: translation feedback to check and improve translation quality and reports to protect users and the service. Only authorised staff handle the data. Translation feedback can be reviewed for 12 months. The basis is our legitimate interest in improving translations and protecting users and the service; you may object (section 7). The recipients of your messages can also send a message they received and its translation to us in this way. Otherwise we do not read private conversations.
Summaries, Ask Espero answers and pronunciation help are processed with the request and are not stored. The in-app help assistant is an AI; support staff may read help-chat messages to resolve your request.
One-to-one voice and video calls use WebRTC. Media travels directly between devices or, encrypted, through a TURN relay. Connecting a call reveals limited network information, such as IP addresses and connection timing, to the participants' devices and the relay service. Espero keeps call history and the state and times needed for abuse prevention, but does not record or store call audio or video. Call translation or captions work only if the app clearly offers them as a separate feature.
A group's owner or admin can caption an event live. Speech is turned into text and translated so that everyone can follow in their own language. Captions are separate from chat messages, and no notifications are sent about them.
Who is responsible. The organizer decides whether the event is captioned, who can follow it and whether the text can be downloaded afterwards, and tells participants that captioning is on. When the organizer is an organisation, it is the controller of the event's speech, captions, translations, song lyrics and listener data, and Espero processes them on its behalf under the data processing agreement. When the organizer is a private individual, Espero is the controller: we process the organizer's data under the contract and the speakers' and listeners' data under our legitimate interest in providing the captions and translation the organizer requested; you may object (section 7). Speech is captured from the organizer's device microphone.
Speech and audio. The organizer's device sends the audio encrypted through Espero's audio gateway or in short clips to our backend. The audio is passed to speech recognition by the speech technology service in the United States; as a fallback, our AI services perform the recognition (section 4). Espero does not record or store the audio. If speech recognition receives a clip as a file, we delete the file from the service as soon as the text is ready. Speech recognition also receives the event language and the organizer's glossary, and on the fallback route the event name.
Text and translation. The text is stored in our database in the EU. Our AI services translate it into the languages chosen by the organizer and the listeners (section 4). To translate accurately, the AI also receives the event name, the organizer's glossary and the neighbouring sentences. The organizer can correct a line; the correction replaces the text for everyone and is translated again.
Song lyrics. The organizer may save song lyrics for an event so that a song is recognised and its words shown and translated correctly; the lyrics may be translated in advance. Lyrics saved for an event are deleted 30 days after the last save, at the earliest a week after the event ends and at the latest after one year. When the lyrics library is enabled, lyrics saved in the library and their translations remain until the organizer deletes them or deletes their account. The lyrics and their translations are the organizer's content (Terms of Service, section 8.7).
Who sees the captions. Group members in the app. If the organizer turns on the viewing link, anyone with the link or QR code can read the captions without an account for as long as the link is on and the text is kept, including after the event; the page shows the event name and start time, a video added by the organizer, the captions and a question shown on the projector, but not the event location or the followers' names. The organizer can cut the link at any time. If the organizer shows a question from the group chat on the projector, it appears without the sender's name to all followers; in their workspace the organizer sees the latest questions with the senders' names. After the event the organizer can download the whole text and allow group members and viewing-link holders to download it too; downloaded files are outside Espero, and we cannot delete them.
Listening. With an Espero account you can listen to the captions read aloud. The text is sent to the speech technology service in the United States to be turned into speech, and the audio is stored for at most a day for playback. When someone is listening, audio for new lines may be generated in advance. If the organizer has created their Own Voice, the captions are read by default with an AI voice created from the organizer's voice (section 3c); a listener may also choose a generic AI voice. The AI voice is marked in the listening view.
What is stored about listeners. The caption page reports itself every couple of minutes so that the organizer sees how many people are following and how far behind listeners are. For a signed-in listener we store the account identifier and otherwise a random device identifier that the page creates and stores in your browser or app and that is the same from one event to the next (section 6a); the time of the last report, whether you are listening and how far behind you are; and the languages listeners added, without an identifier. The organizer sees only counts. We do not store a listener's name, email address or IP address in this data.
Feedback. When feedback is enabled, after the event you can say whether you understood the captions and write an optional comment. The answer is stored under a keyed identifier without a name, and the organizer sees the number of answers per language group and the comments without names.
Caption delivery. Captions are delivered to listeners through our content delivery and storage service's global network (section 4). Caption lines are kept in the delivery service for at most five minutes in EU-restricted storage.
Retention. Captions, translations and listener data are deleted automatically 30 days after the start of the broadcast. The group's owner or admin can delete the text of an ended broadcast earlier, and the deletion cannot be undone. Spoken audio is deleted within a day. The organizer's usage history (event name, languages, duration and peak listener count) is kept while the organizer's account exists. Your registrations are deleted with your account; events and their registrations are deleted when the group is deleted. If you delete your Espero account, the captions of events you hosted are deleted on the 30-day schedule.
Sensitive content. Speech at an event may reveal sensitive information, for example religious beliefs or, in a prayer request, health information. The organizer should pause the microphone before personal parts; what was said before the pause still appears in the captions.
Your choices. If you spoke at an event or are mentioned in its captions, you can ask the organizer or us (hello@espero.live) to delete the text. Captions can be followed without an account; listening requires an account.
What Own Voice does. An Espero+ user can create an AI voice from their own voice. You record a 20–120 second sample, and our speech technology service creates a voice model from it. After that, translations of your messages and the captions of events you host can be read aloud with this voice to those who have access to the content, including people listening through a viewing link. For listeners the speaker's AI voice is the default, but they can also choose a generic AI voice.
Basis. The processing is based on the consent you give before recording. You can withdraw it at any time by deleting your voice (Settings → Own Voice).
What is stored. The voice sample is not stored on Espero's servers; it is passed directly to the speech technology service, and on your device the sample remains until the voice has been created or you discard the sample. The speech technology service keeps the voice model until your voice is deleted; the model's name contains neither your name nor your contact details. We store the version and time of your consent, the status of the voice and the voice identifier issued by the speech technology service. A spoken translation is stored as a file for at most a day for playback. The speech technology service currently processes the sample and the text to be read in the United States; the transfer mechanism is in section 4.
Deletion. When you delete your voice or your account, use of the voice is blocked immediately, stored audio files are deleted and we ask the speech technology service to delete the voice model; the request is repeated until the deletion succeeds. We cannot recall copies already listened to or downloaded.
AI voices. Every translation Espero reads aloud is AI-generated speech. A speaker's AI voice imitates the speaker's voice, but the speaker did not say the translation. The AI voice is marked in the listening view.
In-app purchases (Espero+, Espero+ Max, AI minutes, organizer hours). Apple or Google sells and charges the purchase and processes your payment details as an independent controller. From the store we receive the purchase identifier, product, validity and status, for example a renewal, cancellation or refund, so that we can grant access. We do not process your card details.
Web purchases (espero.live). You pay on Stripe's payment page. The seller is, as described in the Terms of Service, either Stripe's Link service as reseller or Quiet North, Inc.; in both cases Stripe processes the payment, receipt and tax as an independent controller or on the seller's behalf. We pass your Espero account email and the order identifier to the payment page; the page may ask for a billing address and, from business customers, a VAT ID. From the payment provider we receive a customer identifier, order and payment identifiers, the product, amount, currency, tax status and refund information. We do not process your card details. We identify the purchase by its order identifiers, not by the email you use on the payment page. We send a purchase confirmation to your Espero account email.
Retention. Purchase data, balance and usage history are kept while the account exists and deleted with it; invoices and accounting records are kept for the period required by law. Apple, Google, Stripe and Link keep their own records, such as receipts, under their own obligations. So that the same store purchase cannot be credited twice, after account deletion we keep a one-way hash of the purchase's transaction identifier, computed with a secret key. It contains no account, name, email address, product or amount; we use it only to recognise a purchase that has already been credited, and we keep it as long as the store can still present that purchase.
Preventing trial and reward abuse. When you start the organizer's free trial, we store a hash computed from your email address so that the same trial cannot be started again. We also store, in a separate list, a hash protected with a secret key and the status of the trial and referral rewards. When you delete your account, this record is kept for 12 months from the deletion date and then deleted automatically. No name, email address or profile is attached to it. The basis is our legitimate interest in preventing repeated redemption of the free trial and rewards; you may object (section 7).
Validity. Bought hours and AI minutes do not expire in any channel (web, App Store, Google Play), and gift hours are valid for 24 months (Terms of Service, sections 6–8). The validity is unrelated to the retention of the record described above.
Our service providers are listed by recipient category: what each service does, what data it processes, where the data is currently processed and under which transfer mechanism. The providers process data on our behalf and on our instructions under data processing agreements that require confidentiality and protection equivalent to this policy. We update this section when a recipient category, processing country or transfer mechanism changes; we tell you in advance about a new recipient category or a new transfer outside the EU (section 10). A named list of providers is available on request from hello@espero.live.
| Recipient category | Task and data | Processing location (currently) | Transfer mechanism |
|---|---|---|---|
| Database and server service | Database, backend, sign-in and small files: account, message, event and purchase data | EU (Ireland) | EU Standard Contractual Clauses for any processing by the provider from the United States |
| Content delivery and storage service | Media storage, call relay, relaying event audio to speech recognition and caption delivery: images, audio, video and documents, IP addresses, encrypted call media, event audio during relay | Media files in the EU; relay through the provider's global network, including the United States | Data Privacy Framework (DPF); EU Standard Contractual Clauses as fallback |
| Primary AI service | Translation, transcription, image and video captioning, search vectors, summaries, Ask Espero, help assistant, live interpreter and event translation: message and caption text, audio, images, videos and questions | No location commitment: the United States or another country where the provider operates | Data Privacy Framework (DPF) to the United States; EU Standard Contractual Clauses to other countries |
| AI service as translation fallback and for speech recognition | Part of voice-message speech recognition; fallback for text translation and event speech recognition: audio and text | United States | EU Standard Contractual Clauses |
| Speech technology service | Speech recognition (some voice messages and events), reading translations aloud and Own Voice: audio, text to read, voice model | United States | EU Standard Contractual Clauses |
| Cache service | Translation cache for common short phrases: a hash of the text and the translation without sender data | United States or EU depending on the provider's region | Data Privacy Framework (DPF) or EU Standard Contractual Clauses |
| Email delivery service | Sending sign-in codes, purchase confirmations, and contact-form notifications and confirmations: email address and message content | Sent from the EU; account and log data in the United States | Data Privacy Framework (DPF) |
| Email service | Receiving and storing messages sent to hello@espero.live: messages with attachments and the sender's contact details | EU or United States depending on the provider | Data Privacy Framework (DPF) or EU Standard Contractual Clauses |
| Error-tracking service | Diagnosing app crashes and errors: error type and code location, device and operating-system details; no message content or user identifier | EU (Germany); the service's account data in the United States | Data Privacy Framework (DPF) |
| Website hosting and delivery service | Serving espero.live and app.espero.live and measuring web-app performance: IP address and page requests, measurements without an identifier | United States and a global delivery network | Data Privacy Framework (DPF) and EU Standard Contractual Clauses |
| Bot protection | Protecting the website's forms (event demo and contact form) from automated submissions: IP address, technical browser and device data and the form's verification token | United States and a global network | Data Privacy Framework (DPF) |
| Notification relay and app update service | Relaying notifications to the phone's notification service and distributing app updates: notification token, notification title, IP address | United States | Data Privacy Framework (DPF) |
| The phone operating system's notification service (iOS or Android) | Delivering notifications and call notifications to your device: device token and notification content | United States | Data Privacy Framework (DPF) |
| Video service | Fetching details of a video link added to a chat or event, such as duration and availability: the video link | United States | Data Privacy Framework (DPF) |
Independent controllers. The following parties process data for their own purposes under their own privacy policies: Apple (App Store and Sign in with Apple) and Google (Google Play) as sellers of in-app purchases (we receive the purchase identifier, product and status from them, not payment details); Stripe and Link as payment processor and seller for web purchases (section 3d); the third-party video service when you open a video added to a chat or event (the player loads from the video service directly to your device); and authorities where the law requires disclosure.
Traffic is encrypted (TLS), and our providers state that stored data is encrypted at rest. Access to data is limited to authorised staff. To translate, the server processes the text, so cloud chats are not end-to-end encrypted. More in the security description.
Retention periods are listed in the table in section 2. When a retention period ends, the data is deleted.
You can delete your account in the app (Settings → Delete account) or by email to hello@espero.live. Deletion starts immediately, and larger data sets are deleted in stages soon afterwards. When you delete your account, we delete your profile, sign-in, session and device data, notification tokens, friends, followers, blocks and group memberships; your call history; your Own Voice, including the voice model at the speech technology service; the link between a subscription and your account, bought AI minutes and the organizer workspace, balances, usage history and orders (recurring subscriptions made through Stripe are cancelled); your listener data from events and your event feedback; your Saved Messages, help-chat messages, stories, feedback, event registrations and access grants.
The following remain: messages and media you delivered to others, in their conversations, but your profile can no longer be opened; the captions of events you hosted until their 30-day schedule; your username, reserved for 30 days; the trial record for 12 months (section 3d); reports you filed and reports about you and data related to translation feedback, for as long as they are needed to investigate abuse and check translation quality (sections 2 and 3); invoices and accounting records for the period required by law; Apple's, Google's, Stripe's and Link's own purchase records. Data may persist in backups until those backups rotate out, after which it is gone.
Deleting your account does not cancel an App Store or Google Play subscription; cancel it in the store's settings. More: deleting your account and data.
The website and the app use no advertising or tracking cookies and no visitor analytics. We store only the following on your device:
You have the right to know what data we process about you and to receive a copy; to have inaccurate data corrected; to have data deleted; to have processing restricted; to object to processing based on our legitimate interest (section 2); to receive the data you provided in a machine-readable form and transfer it to another service when the processing is based on consent or contract; and to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Send your request to hello@espero.live, preferably from your account email. If there is reasonable doubt about your identity, we may ask for more information to confirm it. We reply within one month; if a request is complex or there are many requests, this may take up to two further months, and we will tell you about the extension and its reasons within one month of the request. You can also delete your account yourself in the app, and in your device settings you can revoke, for example, the contacts or notification permission.
We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you. Automatic usage limits and username checks are not based on profiling.
Right to complain. If you consider that we process your data unlawfully, you may lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live or work or where the alleged infringement took place. In Finland the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi). We hope you contact us first so that we can put things right.
The service is not directed to children below the minimum age required in your country: the age limit is at least 13, or higher where local law requires. We do not knowingly collect their data. If you notice that someone below the age limit has created an account, tell us at hello@espero.live and we will delete the account. The event viewing link can be used without an account; the organizer is responsible for ensuring that minors' participation in a captioned event is appropriate.
Our primary database and media files are in the EU. In the following situations data is also processed outside the EU, mainly in the United States:
Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (DPF) where the provider is certified under it, and otherwise on the Commission's Standard Contractual Clauses (EU SCCs). If the DPF ceases to apply, transfers rely on the SCCs. The transfer mechanism of each recipient category is in section 4. You can obtain a copy of the Standard Contractual Clauses from hello@espero.live.
We update this policy as the service evolves. The version and update date are at the top of the page. We announce material changes in the app or by email. We tell you about a new purpose, a new recipient category or a new transfer outside the EU before the change takes effect. Earlier versions are available on request.