Politique de confidentialité

Last updated: 30 September 2026

Who processes your data

For anything related to this policy, write to that address. You will get a reply from a person on our team, not an automated form.

What we process, and why

Your account

The email address, your name if you choose to give one, the password — stored as a hash, never in plain text — and the date you last signed in.

Why: to give you access to what's yours. Legal basis: performance of the contract.

What you upload

The audio or video file, and whatever comes out of it: the transcript, the speakers, the translation and the summary when you ask for them.

Why: to provide the service. Legal basis: performance of the contract.

There may be other people's data inside that content — the voices of everyone taking part in a meeting, whatever is said there. In that case you are the controller and we are the processor: you decide what is uploaded and for what purpose. Our role is set out in the DPA.

Payments

On taking a plan, Stripe processes your card details, your name and the billing address. We never see or store your card number: Stripe only sends us the last four digits, the card brand and the expiry date, so that we can show them to you.

Why: to charge you and issue invoices. Legal basis: performance of the contract and a legal obligation (accounting and tax).

How you got here

We record where you arrive from, which pages you visit and any campaign identifiers included in the URL (utm_*, gclid). These analytics are our own and are stored on our servers; for this we use neither Google Analytics nor any other third-party tool.

If you arrived from a Google ad and then subscribe, we tell Google Ads that the ad led to a sale, so the campaign can be measured and paid for correctly. To do this we send Google the ad's click identifier (gclid, gbraid or wbraid), the amount and the date. Where the click identifier was lost on the way — some browsers remove it — we may instead send a SHA-256 hash of your email address, which Google can only compare with its own records and cannot turn back into your address. We send that hash only if you are outside the European Economic Area, the United Kingdom and Switzerland, or if you accepted all cookies. You can object at any time from the cookie policy or by writing to us.

If you arrived from an ad in ChatGPT and then start a trial, we tell OpenAI, which runs those ads, so the campaign can be measured. We send the ad's click identifier (oppref), the amount and the date, and — only if you are outside the European Economic Area, the United Kingdom and Switzerland, or if you accepted all cookies — a SHA-256 hash of your email address, your IP address and your browser's user agent, which OpenAI uses only to match the conversion to its ads. With the same consent, OpenAI's measurement pixel runs in your browser and sets the cookies described in the cookie policy. You can object at any time from the cookie policy or by writing to us.

Why: to know what works and what doesn't. Legal basis: our legitimate interest in measuring the service, collecting as little data as possible and without profiling you.

Support

Whatever you write to us, and whatever you ask the documentation assistant.

Why: to help you. Legal basis: performance of the contract and our legitimate interest in providing support.

We don't train on your content

Neither we nor the providers involved use your audio or text to train models. Those providers act as our processors and may only process the content to deliver what we have asked of them.

How long we keep it

This is the part we are asked about most, and it is worth reading in full, because audio and text are not kept for the same length of time.

Audio is deleted automatically and cannot be recovered afterwards. It is the most sensitive data we handle and is no longer needed once it has been converted into text, so we keep it no longer than necessary. We notify you by email three days beforehand; you can switch that notice off, but the deadline does not change. Without an account there is no email to write to, which is one reason that window is shorter.

The text is kept because it is precisely what you came for. It is deleted when you delete the transcript, when you close your account, or when you ask us to.

If you delete a transcript yourself, the file is removed from storage immediately and the record is permanently deleted seven days later. That margin allows an accidental deletion to be recovered.

Who else is involved

To provide the service we rely on the following providers, all of which act as our processors under signed contracts:

Where data is transferred outside the European Union, the transfer is covered by the Standard Contractual Clauses approved by the European Commission, together with any supplementary measures appropriate in each case.

Your rights

You have the right to ask us for access, rectification, erasure, objection, restriction and portability of your data, and to withdraw consent wherever consent is the basis of the processing.

Write to support@audiototexts.com. The maximum time to reply is a month, though we normally answer well before that. We may ask you to verify your identity, so that we do not hand your data to the wrong person.

Much of this does not require waiting for us: from your own dashboard you can download what's yours, delete transcripts and close the account.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es). We would appreciate it if you wrote to us first: almost everything can be resolved with an email.

How we protect it

Encryption in transit, with HTTPS across the whole site, and encryption at rest. Passwords are stored hashed. Server access is by cryptographic key only, with no passwords. Audio is never public: it is served through signed links that expire within minutes.

No system is infallible. If a breach occurred that put your rights at risk, we would notify you and the supervisory authority within the deadlines set by the GDPR.

Minors

This service isn't directed at anyone under 14. If we become aware of an account belonging to a minor, we will delete it.

Changes

If we make a significant change, we will let you know by email or when you sign in. The date at the top shows when this policy was last updated.