Last updated: 24 September 2026
Who processes your data
| Controller | AUDIO TRANSCRIPTOR APP, S.L. |
| Tax ID | B93982734 |
| Address | Calle París, 1, Planta 2, Puerta E · 08191 Rubí (Barcelona), Spain |
| hola@audio-transcriptor.com | |
| Site | https://audio-transcriptor.com |
For anything about this policy, write to that address. A person answers, not a form.
What we process, and why
Your account
Email address, your name if you give one, your password — stored as a hash, never in the clear — and the date you last signed in.
Why: to give you access to what's yours. Legal basis: performance of the contract.
What you upload
The audio or video file, and the text that comes out of it: the transcript, the speakers, the translation and the summary if you ask for them.
Why: to provide the service. Legal basis: performance of the contract.
That content may contain other people's data — the voices of everyone in a meeting, whatever gets said in it. There you are the controller and we are the processor: you decide what gets uploaded and what for. Our side of it is in the DPA.
Payments
If you take a plan, Stripe processes your name, billing address and card details. We never see or store your card number — only the last four digits, the brand and the expiry date that Stripe hands back so we can show them to you.
Why: to charge you and issue invoices. Legal basis: performance of the contract and a legal obligation (accounting and tax).
How you got here
We record the pages you visit, where you came from and any campaign identifiers in the address (utm_*, gclid). This is our own analytics, on our own servers; we don't use Google Analytics or any third-party tool for it.
If you arrived from a Google ad and then subscribe, we tell Google Ads that the ad led to a sale, so the campaign can be measured and paid for properly. To do that we send Google the ad's click identifier (gclid, gbraid or wbraid), the amount and the date. If the click identifier got lost on the way — some browsers remove it — we may send a SHA-256 hash of your email address instead, which Google can only compare against its own records and can't turn back into your address. We only send that hash if you're outside the European Economic Area, the United Kingdom and Switzerland, or if you accepted all cookies. You can object at any time from the cookie policy or by writing to us.
Why: to know what works and what doesn't. Legal basis: our legitimate interest in measuring the service, with the minimum data possible and no profiling.
Support
What you write to us, and what you ask the documentation assistant.
Why: to help you. Legal basis: performance of the contract and our legitimate interest in providing support.
We don't train on your content
Neither we nor the providers involved use your audio or your text to train models. Those providers act as our processors and may only handle the content to return the result we asked them for.
How long we keep it
This is the part people ask about most, and it's worth reading in full because audio and text don't last the same.
| How long | |
|---|---|
| The audio you upload | 14 days without a paid plan · 90 days with one |
| The text (transcript, translation, summary) | For as long as your account exists |
| Account data | For as long as your account exists |
| Invoices and tax records | 6 years, by legal obligation |
| Visit analytics | 24 months |
| Expired sessions | Deleted automatically |
The audio deletes itself and cannot be recovered. It's the most sensitive data we handle and the part that stops being needed once it's transcribed, so we don't keep it any longer than necessary. We email you three days before; that notice can be switched off, but it doesn't change the deadline.
The text stays because it's what you came for. It goes when you delete the transcript, when you close your account, or when you ask us.
When you delete a transcript by hand, the file leaves storage immediately and the record is removed for good after seven days. That window exists so an accidental deletion can be undone.
Who else is involved
To run the service we rely on these providers, all as our processors and under contract:
| Provider | What for | Where |
|---|---|---|
| OVH | Server and data hosting | Gravelines, France (EU) |
| AssemblyAI | Transcription and translation | European endpoint (EU) |
| Anthropic | Summaries, re-translation and help | USA |
| Stripe | Payments and billing | USA / Ireland |
| Resend | Email delivery | USA |
| Cloudflare | Anti-bot check (Turnstile) | USA |
| Measuring which ads lead to sales (click identifier and, where allowed, a hashed email) | USA |
Transfers outside the European Union rely on the Standard Contractual Clauses approved by the European Commission, with whatever supplementary measures apply.
Your rights
You can ask us for access, rectification, erasure, objection, restriction and portability, and withdraw consent where consent is the basis.
Write to hola@audio-transcriptor.com. We answer within a month at the latest, and usually much sooner. We may ask for something to confirm it's you, so we don't hand your data to someone else.
Much of this doesn't need to wait for us: from your dashboard you can download everything of yours, delete transcripts and close your account.
If you think we've got it wrong, you can complain to the Spanish Data Protection Agency (aepd.es). We'd appreciate an email first — almost everything gets sorted that way.
How we protect it
Encryption in transit (HTTPS across the site) and at rest. Hashed passwords. Server access by key only, no passwords. Audio is never public: it's served through signed addresses that expire in minutes.
No system is infallible. If a breach occurred that put your rights at risk, we'd tell you and the supervisory authority within the deadlines the GDPR sets.
Minors
The service isn't aimed at anyone under 14. If we spot a minor's account, we'll delete it.
Changes
If we change something significant, we'll tell you by email or when you sign in. The date at the top says when this was last touched.