Privacy Policy
Last updated: 13 August 2026.
This policy explains how Transcritor handles personal data under the European Union's General Data Protection Regulation (Regulation 2016/679, GDPR) and Brazil's General Data Protection Law (Law 13.709/2018, LGPD).
1. Who the controller is
Transcri, with offices at Brazil, is the controller of the data processed on this site.
Contact: contact@transcri.online
Data Protection Officer:
contact@transcri.online
2. What we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Email and hashed password | Create and protect your account | Performance of a contract |
| Audio and video files you upload | Produce the transcript you asked for | Performance of a contract |
| Transcribed text and timestamps | Deliver and store the result in your account | Performance of a contract |
| File length and credit balance | Charge correctly for usage | Performance of a contract |
| Purchase records | Invoicing and tax obligations | Legal obligation |
| IP address on login attempts | Block brute-force attacks | Legitimate interest |
| Analytics and marketing cookies | Understand how the site is used | Consent |
We do not deliberately collect special category data. But the content of an audio file can contain anything — including health data, political opinion or information about other people. That is why transcribed content is never read by humans, never used to train any model, and never shared.
3. How long we keep it
- Uploaded audio and video: 7 days. After that the file is deleted automatically from the server.
- Transcribed text: stays in your account until you delete it.
- Account: for as long as it exists. You can delete it at any time.
- Tax records of purchases: 5 years, as legally required, anonymised once the account is deleted.
4. Where data lives and who it is shared with
Transcription runs on our own servers in Germany, in Falkenstein (Saxony), inside the European Economic Area. If you are in the EEA, your data never leaves it for the purpose of transcription. The content of your files is never sent to any third-party API — not to OpenAI, not to Google, not to any other speech recognition service.
The processors with some access to data are:
| Who | Purpose | Data |
|---|---|---|
| Hetzner Online GmbH (Germany) | Server hosting | The whole infrastructure, under a processor agreement |
| Stripe Payments Europe, Ltd. | Payment processing | Email and card details (which never reach our server) |
| Email provider | Send sign-up confirmation |
Where a processor handles data outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses, together with the technical measures described in section 7.
5. Your rights
Under the GDPR (arts. 15–22) and the LGPD (art. 18) you have the right to:
- Access and portability — download everything in an open format on the My data page.
- Rectification — write to the contact address above.
- Erasure — delete your account and all content on My data, without having to ask anyone.
- Withdraw consent — change your cookie choice at any time through the Cookies link in the footer.
- Object, and not be subject to automated decisions — we make no automated decisions producing legal effects concerning you.
- Lodge a complaint — with your national supervisory authority in the EU, or with the ANPD in Brazil.
Requests sent to the contact address are answered within 30 days.
6. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
sessao | Keep you signed in. Necessary. | 30 days |
idioma | Remember your language. Necessary. | 1 year |
consentimento | Store your cookie choice. Necessary. | 180 days |
Necessary cookies cannot be switched off — sign-in does not work without them. Everything else is only created after you accept.
7. Security
Passwords are stored with Argon2, never in clear text. The site is served over HTTPS. Each account can only reach its own content. Application servers are not exposed to the internet: they answer only through the reverse proxy.
If an incident occurs with a likely risk to your rights, we will notify the competent supervisory authority within 72 hours, and you directly when the risk is high.
8. Children
The service is not intended for anyone under 18, and we do not knowingly collect children's data.
9. Changes
If this policy changes materially, we will tell you by email or on the site before the change takes effect.