Privacy Policy
Your privacy matters to us. This policy explains how we collect, use and protect your personal data, in accordance with the EU General Data Protection Regulation (GDPR).
Last updated: October 21, 2026|Version 2.3
Encrypted In Transit & At Rest
EU-hosted Storage
Defined Retention Periods
Full GDPR Rights
Scribit AI is committed to protecting your privacy and to processing your personal data lawfully and transparently. This policy describes how we collect, use, disclose and safeguard your information when you use our transcription and translation service, under Regulation (EU) 2016/679 (GDPR).
Data Controller: Denis Billi (Scribit AI) · [email protected]
1Data we collect
- Account data: when you create an account we collect your name, email address and password (stored in an irreversible hashed form).
- Audio files and documents: we process the files you upload in order to provide transcription and translation. The original file is deleted within 30 days of processing.
- Usage data: we keep your job history and usage metadata to run and improve the service.
- Payment data: payments are handled by Stripe; we do not store full card details on our servers.
- Consent records: we log the date, version and source of every consent you give us.
2Legal basis for processing (GDPR Art. 6)
- Performance of a contract (Art. 6(1)(b)): processing your files and account data is necessary to deliver the service you signed up for.
- Legal obligation (Art. 6(1)(c)): we keep payment records for 10 years as required by tax law.
- Legitimate interest (Art. 6(1)(f)): we keep security logs for 90 days to detect and prevent fraud and abuse.
- Consent (Art. 6(1)(a)): we send marketing communications only where you have given explicit consent, which you may withdraw at any time.
3How we use your data
- To provide and improve transcription and translation
- To process the files you upload and deliver the results
- To communicate with you about your account and the service
- To provide customer support
- To detect and prevent fraud and abuse
- To comply with legal obligations (tax records, requests from authorities)
4How long we keep your data
- Uploaded source files: deleted within 30 days of the job completing.
- Transcriptions and translations: how long we keep them depends on your plan, because the plan determines how long the results stay available to you.
- Without an account: 30 minutes.
- Free account with no purchase: 2 hours.
- Free account with at least one credit purchase (also by a team you belong to): 30 days.
- Starter and Professional plans: 30 days.
- Business plan: 90 days.
- Once the window closes the text is permanently deleted: only billing data and a record of the operation remain, with no content.
- Security and audit logs: 90 days.
- Payment and invoicing records: 10 years, as required by EU tax law.
- Account data: kept until you request deletion or close your account.
- You can review the full retention schedule and request early deletion from your profile, under Privacy & Data.
5Security and storage
- In transit: files travel over an encrypted connection (TLS 1.2 or above).
- Encryption at rest: the files you upload are stored encrypted with AES-256 on our object storage.
- Antivirus screening: every uploaded file is scanned before processing.
- Access controls: role-based access with access logging.
- Infrastructure: servers located in the European Union, continuously monitored.
- Automatic deletion: source files are removed from our systems within 30 days.
- Translated documents: these stay available for re-download on the application server, protected by access controls and system isolation. We are moving them to the encrypted storage as well.
6Providers that process your data (processors)
- OpenAI (United States): audio transcription and text translation.
- Google (United States): Gemini models used for translation quality checking; they receive the text of your documents.
- AssemblyAI (United States): audio transcription, used as an alternative when the primary provider is unavailable.
- Amazon Web Services (European Union and United States): file storage and service email delivery.
- Stripe (United States and Ireland): payment processing.
- OVH (France, European Union): servers hosting the application and the database.
- Cloudflare (United States, European network): protection of traffic to the site and the API, bot verification (Turnstile).
- Google Ireland (Google Analytics): website usage statistics, only with your consent to analytics cookies.
- All providers are bound by data processing agreements (GDPR Art. 28). We will give you at least 30 days' notice before adding a new one.
7Sharing your data
- We do not sell, trade or rent your personal data to third parties.
- We share data only with the providers needed to run the service, listed above.
- We do not use your content to train AI models.
- We may disclose data where required by law, by a court order, or to protect the rights and safety of our users.
8Transfers outside the European Union
- Our primary infrastructure is located in the European Union.
- Some of the providers listed above (OpenAI, Google, AssemblyAI, Stripe, Cloudflare) are based in the United States: those transfers are covered by the European Commission's Standard Contractual Clauses (GDPR Art. 46) and, for certified providers, by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, GDPR Art. 45).
- This means the content of the files you upload may be processed outside the European Union in order to deliver the service.
- We do not transfer data to countries lacking an adequate level of protection without appropriate safeguards.
9Cookies
- Technical cookies: keep your session open, protect your account and remember choices you make, such as the language. They are necessary and do not require consent.
- Analytics cookies: Google Analytics 4 (Google Ireland Ltd), active only if you agree. It collects pages visited, device and browser type, and an approximate location derived from the IP address. It sets the _ga and _ga_<id> cookies, which last up to 2 years. Without your consent the script is not even loaded.
- Cookie-free statistics: Cloudflare Web Analytics counts visits and page views in aggregate. It uses no cookies or other browser storage and collects nothing that identifies you, so it is always on.
- Bot protection: Cloudflare Turnstile checks that forms and uploads come from a person. It is a necessary security measure and is not used to profile you.
- We do not use advertising or profiling cookies.
- You can change your mind at any time: "Cookie preferences" link at the bottom of every page, or from your profile, under Privacy & Data. If you withdraw consent we delete the _ga cookies from your browser.
10Children
- The service is not intended for children under 16.
- We do not knowingly collect personal data from children under 16.
- If we learn that we have collected data from a child under 16, we delete it immediately.
11Changes to this policy
- We may update this policy from time to time.
- We will notify you by email of any material change at least 14 days before it takes effect.
- Continued use of the service after a change constitutes acceptance of the updated policy.
- We will ask you to re-confirm consent for any new processing purpose we introduce.
Your rights under the GDPR
You can exercise every right below from your profile, under Privacy & Data, or by writing to [email protected]. We will respond within 30 days, as required by GDPR Art. 12.
Right of access (Art. 15)
Receive a full copy of the personal data we hold about you.
Right to rectification (Art. 16)
Correct inaccurate or incomplete personal data.
Right to erasure (Art. 17)
Request permanent deletion of your personal data.
Right to restrict processing (Art. 18)
Pause processing of your data while a dispute is resolved.
Right to data portability (Art. 20)
Download a machine-readable (JSON) copy of your data.
Right to object (Art. 21)
Object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent (Art. 7(3))
Withdraw consent at any time, without affecting the lawfulness of processing already carried out.
Contact us
If you have questions about this policy or wish to exercise your GDPR rights, contact us:
Email: [email protected]
Response time: Within 30 days (GDPR Art. 12)
Supervisory Authority: You have the right to lodge a complaint with your national data protection authority.