Privacy & Cookie Policy

1. Key Definitions

Terms such as “personal data”, “controller”, “processor”, “sell” or “share” (as defined by CPRA) carry the meanings given in the applicable legislation. “User” means any natural person who visits the Site or creates an account to use the Services.

2. What Personal Data We Collect

We collect—and have collected during the past 12 months—the categories of data below. Some data is provided directly by you, some is collected automatically or from third parties.

We do not process “sensitive personal information” (CPRA §1798.121) for the purpose of inferring characteristics about a consumer.

3. Legal Bases (EU/UK GDPR)

For users located in the EEA or UK we rely on the following lawful grounds:

• Contract (Art. 6 (1)(b)). Processing necessary to provide the Services you request.
• Legitimate interests (Art. 6 (1)(f)). E.g. detecting fraud, product analytics, protecting legal claims. We balance these interests against your privacy.
• Consent (Art. 6 (1)(a)). For optional analytics cookies and marketing communications. You may withdraw at any time.
• Legal obligation (Art. 6 (1)(c)). Tax records, Know‑Your‑Customer checks, responding to lawful requests.

4. How We Use Personal Data

1. To create and administer your account and authenticate you (session cookies, API keys).
2. To process payments and issue invoices/receipts via Stripe.
3. To transcribe, summarise, translate or otherwise transform audio content at your request using AI providers such as AssemblyAI and OpenAI.
4. To communicate with you about updates, security alerts or support inquiries.
5. To improve and secure the Services (debugging, analytics, abuse detection, rate‑limiting).
6. To comply with law, enforce our Terms of Service, or defend our legal rights.

5. How We Share Information

We never sell personal information for monetary consideration. We disclose data only:

• Service providers / processors bound by contract to process data on our behalf and under confidentiality (e.g. AssemblyAI for speech‑to‑text, OpenAI for text generation, Stripe for payments, Cloudflare for security, emailing via Zoho).
• Analytics providers (Google Analytics 4) – solely if you have consented to non‑essential cookies.
• Legal & compliance: when required by court order, subpoena or to investigate fraud or threats.
• Business transfers: in connection with a merger, acquisition or sale, subject to equivalent protections.

6. Cookies & Similar Technologies

We use first‑party cookies to operate the Site. We also run our own self‑hosted, first‑party audience measurement so we can see which pages are useful and where people get stuck. It is designed to work without identifying you:

• Your IP address is never stored. Before anything is written down it is truncated (the last part of an IPv4 address, or everything below the /48 prefix of an IPv6 address, is discarded) and then hashed together with a secret salt that changes every day, so yesterday's records cannot be linked to today's.
• The data stays on our own servers. It is not shared with, or sold to, anyone, and it is not used for advertising, profiling or automated decision‑making.
• Without your consent we set no persistent identifier: the measurement cookies below expire the moment you close your browser, so return visits are not linked.

Because it is first‑party, anonymised and not used for profiling, this measurement operates without consent, in line with the Italian Data Protection Authority's guidelines on analytics cookies of 10 June 2021. Anything beyond it — the persistent visitor cookie and Google Analytics — runs only if you press “Allow”. If you decline, or simply never answer, Google Analytics is never loaded at all. You can change your mind at any time by clearing this site's cookies.

How long we keep it. Individual page views and interaction events are deleted after 90 days, and individual visit records after 12 months. Beyond that we keep only day‑level totals (for example “412 visitors on 3 March”), which relate to no one in particular.

You may also send a browser “Do Not Track” or Global Privacy Control (GPC) signal. Where required by law (e.g. CPRA, CTDPA) we honour such signals as an opt‑out of sale/share and targeted advertising.

7. International Data Transfers

We are headquartered in the European Union (Italy) but rely on cloud vendors and subprocessors in the United States and other jurisdictions. Where personal data is transferred out of the EEA/UK we use Standard Contractual Clauses (SCCs) or another lawful mechanism, complemented by transfer impact assessments and technical safeguards (encryption in transit & at rest).

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined above, comply with our legal obligations, resolve disputes and enforce agreements. Audio files and derived transcripts are deleted automatically 30 days after you delete a project or upon account deletion (whichever occurs first), unless legal retention is required.

9. Security

We implement administrative, technical and organisational measures in line with ISO/IEC 27001 practices—including TLS 1.2+, strict transport security, CSP headers, rate‑limiting, encrypted databases (PostgreSQL) and least‑privilege IAM. No system is 100 % secure; you are responsible for safeguarding your password and API key.

10. Your Privacy Rights

10.1 EEA / UK Residents

You have the right to access, correct, erase, restrict or object to processing of your personal data, and to portability and not to be subject to automated decision‑making producing legal effects. You may lodge a complaint with your local supervisory authority (e.g. Garante in Italy, ICO in the UK).

10.2 California Residents (CCPA / CPRA)

You have the right to:

• Know the categories and specific pieces of personal information we collected;
• Request deletion (subject to exceptions);
• Correct inaccurate data;
• Opt‑out of “sale” or “sharing” of personal information;
• Limit use/disclosure of sensitive personal information;
• No retaliation for exercising your rights.

10.3 Virginia, Colorado, Connecticut & Utah Residents

You may:

• Access and obtain a portable copy of your personal data;
• Request deletion or correction;
• Opt‑out of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects;
• Appeal our refusal to act on a request within the timeframe required by local law.

We will respond within 30–45 days (extendable once) as the law permits.

11. Exercising Your Rights

You may submit a request by emailing Contact Us Page or via the in‑app Delete My Account button. To protect your data we will verify your identity (e.g. control of the account email or signed request through your session token). Authorized agents may submit requests on behalf of California residents by following CPRA §1798.105(c).

12. Children’s Privacy

The Services are not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect such data. If you believe we have, contact us and we will delete it as required by COPPA and GDPR.

13. Changes to This Policy

We may update this Policy periodically. If changes are material we will notify you (e‑mail or in‑app banner). Continued use after the effective date constitutes acceptance.

14. Contact

For any questions or concerns about this Policy or our privacy practices, please contact our Data Protection Officer via Contact Us Page.