Privacy policy

Last updated: 17 October 2026

1. Who we are

EchoScribe (demo company placeholder), Example street 1, 10115 Berlin, Germany, hello@echoscribe.example ("EchoScribe", "we") is the controller for personal data processed through the EchoScribe website, web application, browser extension and API (the "Service").

2. What we process and why

Data	Purpose	Legal basis (GDPR)	Retention
Audio/video you upload or record, and the resulting transcripts, summaries and translations	Providing the Service	Art. 6(1)(b) contract	Until you delete them or your retention setting expires (default 30 days for uploads; transcripts until deleted)
Account data (email, name, password hash, plan, usage minutes)	Account, billing, abuse prevention	Art. 6(1)(b), (c), (f)	Life of the account + statutory retention for invoices
Technical logs (IP address, user agent, timestamps, error details)	Security, debugging	Art. 6(1)(f) legitimate interest	30 days
Payment data	Billing via our payment processor	Art. 6(1)(b), (c)	Handled by the processor; we store no card numbers
Optional analytics cookies	Usage statistics	Art. 6(1)(a) consent	13 months

We never use your audio or transcripts to train machine-learning models, and we do not sell personal data.

3. Where data is processed

Files and transcripts are stored and processed on servers located in EU (Frankfurt). If you select a transcription or language-model provider located outside the EEA (see section 4), audio or text is transferred to that provider under the EU Standard Contractual Clauses or an adequacy decision; the current sub-processor list states each provider's location.

4. Sub-processors

• Hosting and storage: EU data centre (EU (Frankfurt)).
• Speech recognition providers (selected per deployment): self-hosted Whisper (EU), or API providers with an EU region where available.
• Language-model provider for summaries and translation (selected per deployment).
• Payment processing: Stripe Payments Europe Ltd.
• Email delivery for account messages.

The full, current list with locations is available on request at hello@echoscribe.example and in the data processing agreement.

5. Recordings of other people

When you record or upload conversations, you are responsible for having a lawful basis to do so (for example, informing participants and obtaining consent where required). The browser extension displays a reminder before capturing audio.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. Use the account page (export and delete functions) or write to hello@echoscribe.example. You may lodge a complaint with your supervisory authority.

7. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted to personnel who need it to operate the Service. Transcripts can be deleted immediately from the editor or the library; deletion also removes derived data (summaries, translations).

8. Cookies

See the Cookie policy. Strictly necessary cookies (session, locale, consent choice) are set without consent; analytics cookies only after you accept them in the banner.

9. Children

The Service is not directed at children under 16.

10. Changes

We will announce material changes on this page and, for account holders, by email.