Draft, pending lawyer review. Not yet in force.
Privacy Policy
Draft - pending lawyer review. Not yet in force.
This policy explains how [[LEGAL ENTITY NAME - PT Perorangan]] ("Scribewren", "we") handles personal data. It covers the EU and UK GDPR, the California CCPA/CPRA and similar US state laws, and Indonesia's Personal Data Protection Law (UU PDP No. 27 of 2022, with Government Regulation 33 of 2026 from 2027-01-16).
In short
- We collect your account details, the files and transcripts you create, basic usage data and billing status.
- We never use your recordings or transcripts to train AI models, and we never sell your data.
- We keep originals for at most 24 hours after processing, playback copies for 7 days (Free) or 90 days (Unlimited), and transcripts until you delete them.
- You can delete a transcript, a media file or your whole account in Settings.
1. Who we are
The controller is [[LEGAL ENTITY NAME - PT Perorangan]], NIB [[NIB]], [[REGISTERED ADDRESS]]. Contact us at [email protected].
Our EU and UK representative under Article 27 of the GDPR and UK GDPR: [[EU/UK REPRESENTATIVE - pending decision]].
2. Data we collect and why
| Category | Examples | Purpose | Legal basis (GDPR / UU PDP) | Kept for |
|---|---|---|---|---|
| Account | Email, name and avatar from Google, sign-in method, plan | Provide the service, sign you in | Contract | Until you delete your account (plus up to 7 days) |
| Your content | Uploaded audio and video, playback copy, transcripts, edits, speaker names, AI notes, translations, titles | Provide the service | Contract | See section 9 |
| Usage and quota | Job metadata (duration, language, status, timings), usage counters | Apply limits and fair use, support | Contract, legitimate interest | Life of the account |
| Billing | Subscription status, Paddle customer and subscription IDs, country | Billing | Contract, legal obligation | 2 years in our database; invoices are held by Paddle |
| Technical and security | IP address, user agent, hashed session tokens, request IDs, audit logs | Security and abuse prevention | Legitimate interest | Sessions plus 30 days; audit logs 2 years |
| Product analytics | Events such as page views, with no content, titles or filenames | Improve the product | Consent | 12 months |
| Error reports | Scrubbed stack traces | Reliability | Legitimate interest | 90 days |
| Communications | Support emails, waitlist, marketing opt-in | Support, updates | Contract, consent | Support 2 years; marketing until you unsubscribe |
We do not ask for sensitive data. Recordings can contain it anyway, for example health information or beliefs. We process it only on your instruction and only to provide the service.
3. How we use data
We use data to run the service, secure it, support you, meet legal duties and, with your consent, measure how the product is used. Legal bases are listed in the table above.
4. Recordings and speaker labels
We process voices to tell speakers apart inside a single file. During our launch phase this runs at xAI, our speech-to-text processor, under Zero Data Retention, and we receive only a speaker number for each word. After we move processing onto our own workers, speaker features are computed in memory, never stored, never matched across files and never used to identify a person. In both cases we do not create voiceprints.
5. AI processing
- Speech-to-text: a compressed copy of your audio is sent to xAI's speech-to-text API to produce the transcript and speaker labels. Zero Data Retention is switched on and xAI does not train on it.
- AI notes and translation: transcript text goes to xAI's language model API only when you ask for notes or a translation. The same Zero Data Retention applies: xAI does not retain it and does not train on it.
6. No training, no selling
We do not train or fine-tune models on your content. We do not sell personal data, and we do not share it for cross-context behavioural advertising. If that ever changes we will add a "Do Not Sell or Share" link and honour Global Privacy Control.
7. Sharing
We share data with our subprocessors, with Paddle (an independent controller for payment data), with authorities when the law requires it (and we tell you first where we lawfully can), and with a successor if the business is transferred.
8. International transfers
Your data is stored in Singapore (Vultr), with encrypted database backups in the United States (Vultr, California). xAI processes audio and, for notes and translation, transcript text in the United States, but its processing region is not contractually guaranteed. For transfers out of the EEA and UK we use the EU Standard Contractual Clauses (Decision 2021/914) and the UK Addendum with each subprocessor, or the EU-US Data Privacy Framework where the vendor is certified. For Indonesian data subjects we transfer data only where the destination has equal or higher protection, or under appropriate contractual safeguards, or with your consent (UU PDP Article 56).
9. Retention
| Data | Retention |
|---|---|
| Original upload | Deleted within 24 hours after the job reaches a final state |
| Audio copy sent to xAI | Not retained by xAI (Zero Data Retention); our temporary worker files are deleted when processing ends |
| Playback copy | 7 days on Free, 90 days on Unlimited; you can delete it any time |
| Transcripts, edits, AI notes, translations | Until you delete them or your account; deletion is permanent |
| Account | Content within 24 hours, account record within 7 days of your deletion request |
| Sessions | Until expiry or revocation, plus 30 days |
| Billing event payloads and audit logs | 2 years |
| Accounting records | 10 years, as Indonesian tax law requires |
| Database backups | 7 days; deleted data leaves backups as the window rolls forward |
| Application logs (no content) | 30 days |
| Error reports | 90 days |
| Product analytics | 12 months |
| Support emails | 2 years |
| Waitlist and marketing list | Until you unsubscribe, or 2 years without activity |
| Copyright notices and counter-notices | 3 years |
10. Security
We use TLS 1.2 or later in transit, encryption at rest, presigned URLs that expire within one hour, least-privilege access and audit logs. Our staff cannot view your content.
11. Your rights
- EU and UK: access, correction, erasure, restriction, portability, objection, withdrawing consent, and the right to complain to your supervisory authority.
- California and other US states: know, delete, correct, opt out of sale or sharing, limit use of sensitive information, non-discrimination, and use an authorized agent.
- Indonesia (UU PDP): information, access, correction, deletion or destruction, withdrawing consent, objecting to automated decisions, portability and compensation.
Delete transcripts, media or your account yourself in Settings. For anything else write to [email protected].
12. Response times
We answer requests within 30 days, extendable where the law allows. Where UU PDP sets a shorter deadline for Indonesian users, such as access or correction requests, we meet that deadline.
13. Breach notification
We notify the supervisory authority within 72 hours where the GDPR or UK GDPR requires it. For Indonesian data subjects we notify them and the authority within 3 x 24 hours (UU PDP Article 46). We tell affected users without undue delay.
14. Children
Scribewren is not for anyone under 16. If we learn that a child has an account, we delete it.
15. Cookies
See the Cookie Policy.
16. California notice at collection
In the past 12 months we collected identifiers, commercial information, internet activity and audio information (your uploads). We drew no inferences about you. We use them for the purposes and keep them for the periods above, and we do not sell or share them.
17. Changes and contact
We email registered users at least 30 days before a material change. Questions: [email protected]. You may also contact your supervisory authority, for example the Information Commissioner's Office in the UK, your EU data protection authority, or the Indonesian authority for personal data protection.