← Back to app

Privacy Policy

Last updated: June 2025 · Pursuant to Articles 13–14 of EU Regulation 2016/679 (GDPR)

1. Data Controller

The data controller is:

BAROS LUCA (Sole Trader)
Via Sante Cettolini, 18 — 31015 Conegliano (TV), Italy
VAT no.: IT05588920263
Email: info@scribethat.com

2. Data collected and purposes

Category	Purpose	Legal basis
Email address and password (hashed)	Account creation and management	Contract performance (Art. 6 §1 lit. b)
Uploaded audio/video files	Transcription processing	Contract performance (Art. 6 §1 lit. b)
Transcription text	Temporary storage for the user	Contract performance (Art. 6 §1 lit. b)
Payment data (processed by Stripe)	Billing and subscription management	Contract performance (Art. 6 §1 lit. b)
Usage data (minutes used, plan)	Quota and plan management	Legitimate interest (Art. 6 §1 lit. f)
Technical logs and cookies	Security, fraud prevention, service operation	Legitimate interest (Art. 6 §1 lit. f)
Contact form messages	Responding to support requests	Consent (Art. 6 §1 lit. a)

We do not use your personal data or transcription content to train AI models, nor for marketing purposes without your explicit consent.

3. Data processors (sub-processors)

• OpenAI, Inc. — Whisper transcription engine. Audio files are securely transmitted for processing and are not retained by OpenAI beyond the individual request.
• Stripe, Inc. — Payment processing and billing. Payment card data never passes through our servers.
• Google LLC — OAuth authentication (optional). If you sign in with Google, Google processes your data according to their own Privacy Policy.
• Resend — Transactional email delivery (verification codes, notifications).
• Railway — Cloud hosting and infrastructure.

4. Data retention

• Active transcriptions: retained for 14 days from the creation date.
• Trash: deleted files are retained for a maximum of 7 days before permanent deletion.
• Account data: retained for the duration of the contractual relationship and for 10 years thereafter for accounting/tax obligations.
• Audio/video files: deleted immediately upon completion of transcription processing.

5. International data transfers

Some of our service providers (OpenAI, Stripe, Google) are based in the United States. Transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission or, for Google and Stripe, the EU–US Data Privacy Framework.

6. Your rights (Arts. 15–22 GDPR)

• Access: obtain confirmation and a copy of the data being processed.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your account and all personal data (you can do this directly from Settings → Delete account).
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request restriction of processing in certain circumstances.
• Withdrawal of consent: withdraw any consent given at any time.

To exercise your rights, write to info@scribethat.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it.

7. Cookies and tracking technologies

We use exclusively:

• Technical/functional storage (localStorage): stores your login session (email) on your device. Not transmitted to third parties.
• Google Sign-In cookies (only if you use Google sign-in): managed by Google LLC. See Google's Privacy Policy for details.

We do not use profiling or advertising cookies.

8. Minors

The service is intended for users aged 16 or over. We do not knowingly collect data from children under 16. If you believe a minor has created an account, please contact us at info@scribethat.com.

9. Changes to this policy

We may update this policy in the event of changes to the service or applicable regulations. We will notify you of material changes by email or via a notice in the application.