Privacy Policy

The Service is operated by:

Voxnoto UAB
Lithuania, European Union
Email: [email protected]

Voxnoto UAB is the controller of personal information processed for its own purposes under the EU General Data Protection Regulation (GDPR). Because Voxnoto UAB is established in the European Union, it does not appoint a separate EU representative.

For privacy-related requests, contact us at [email protected].

This Privacy Policy applies to personal information processed through the Service.

When we process account, billing, analytics, advertising, security, and support information for our own purposes, Voxnoto UAB acts as the controller or business responsible for that information.

When a business customer uploads recordings or other content containing personal information and instructs us to transcribe it, Voxnoto UAB may act as a processor or service provider on behalf of that customer. The customer remains responsible for determining whether it has a lawful basis and all required permissions to collect, record, upload, and process that content.

3.1 Account and contact information

We may collect:

• name, if provided;
• email address;
• account credentials or authentication identifiers;
• account preferences;
• communications with customer support;
• marketing preferences.

3.2 Uploaded content and transcripts

We process:

• audio and video files uploaded by users;
• transcripts generated from uploaded files;
• file names, project names, timestamps, language selections, and related metadata;
• edits or corrections made to transcripts.

Uploaded content may contain personal information about the user or third parties. Depending on the recording, this may include sensitive information such as health information, therapy-related information, financial information, communications, or other confidential material.

3.3 Payment and subscription information

Payments are processed by Stripe. We may receive:

• subscription plan and billing period;
• payment status;
• transaction identifiers;
• billing country and limited payment method details;
• refund, chargeback, and invoice information.

We do not store full payment card numbers. Stripe processes payment information under its own privacy terms.

3.4 Device, usage, and technical information

We may collect:

• IP address;
• browser type and version;
• device and operating system information;
• pages viewed and actions taken;
• login and session information;
• referring URLs;
• approximate location derived from IP address;
• cookie and advertising identifiers;
• error, security, and diagnostic logs.

3.5 Analytics and advertising information

Subject to applicable consent requirements, we use:

• Google Analytics 4;
• Google Ads;
• Microsoft Advertising, including Bing Ads and UET;
• Meta Pixel.

These providers may collect identifiers, device information, browsing activity, interactions with the Service, and conversion information. They may combine this information with information collected through other websites or services according to their own terms and privacy policies.

3.6 Google Calendar data (only if you connect your calendar)

Connecting a Google Calendar is optional and off by default. If you connect one, we request read-only access (calendar.events.readonly and calendar.calendarlist.readonly) and read:

• event title, start and end time;
• guest names and email addresses of the event;
• the conferencing link of the event (for example Google Meet, Zoom, Teams);
• the list of calendars your account is subscribed to.

Why: to name a recording you made after the meeting it belongs to and to show that meeting’s participants on the recording, instead of leaving an unnamed file. We match a recording to a meeting by comparing the time of the recording with the time of the event.

What we never do: we never create, modify, or delete anything in your calendar; we never read attachments; we never use calendar data for advertising; we never sell it or share it for advertising; and we never use it to train machine learning models. Calendar data is used solely to provide this feature to you, and only the service providers that deliver the feature may process it on our instructions. Section 6.2 sets out the binding limits on our use, transfer, and retention of this data.

How to turn it off: Settings → Google Calendar → Disconnect in your account, or remove access in your Google Account. Disconnecting deletes the cached events and the stored authorization token immediately.

We may use personal information to:

• provide, operate, maintain, and secure the Service;
• create and manage accounts;
• process uploaded files and generate transcripts;
• store files and transcripts in the user’s account;
• process subscriptions, payments, refunds, and invoices;
• provide customer support;
• send service-related notices;
• send marketing communications where permitted by law;
• measure traffic, usage, advertising performance, and conversions;
• improve usability, reliability, fraud prevention, and security;
• detect abuse, unauthorized access, and violations of our Terms;
• comply with legal, tax, accounting, and regulatory obligations;
• establish, exercise, or defend legal claims.

This list does not apply to Google user data. Data obtained through Google APIs is used only as described in section 6, which prevails over this section. In particular, Google Calendar data is never used for marketing, advertising, or conversion measurement.

5.1 Transcription runs on our own infrastructure

Speech recognition is performed by our own self-hosted, offline model. We run it inside our own container image on compute we rent and control; the audio and the resulting transcript are processed there and are never sent back to the developer of the model, to any external transcription service, or to anyone else for training or any other secondary purpose. Rented compute is never located in China or the United States, and we prefer providers inside the European Union.

Accounts, uploaded files and transcripts are stored with Hetzner Online GmbH in Finland, European Union.

5.2 Summaries and translation

When you ask for a summary or a translation, the text of the transcript for that recording is processed by a contracted third-party language model provider, which returns the summary or the translated text. Nothing is sent unless you request that feature for that recording.

Google user data is never sent to this or any other AI provider. Calendar events, meeting titles, participant lists and the profile data from Sign in with Google stay inside our own systems. When a recording is named after a meeting from your calendar, that name is deliberately withheld from the request we send to the model.

5.3 We do not train models on your content

We do not use customer audio, video, transcripts, or other uploaded content to train, fine-tune, test, or improve our own transcription or language models.

The use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and such data is never used, transferred, or sold to create, train, or improve any foundational or generalized machine learning or artificial intelligence model.

This section applies to data we obtain through Google APIs (“Google user data”). Notwithstanding anything else in this Privacy Policy, this section governs Google user data and prevails over every other statement in this Policy.

6.1 Sign in with Google

If you choose to sign in with Google, we receive your email address, your name and profile picture if you have one, and a stable account identifier (scopes openid, email, profile). We use them only to create and secure your account, sign you in, link the account to earlier sign-ins with the same address, run your subscription, answer your support requests, and send you the service messages your account needs. Where permitted by law we may also email you product news at that address; every such email carries an unsubscribe link, and unsubscribing stops it immediately.

We never use this data for advertising or ad targeting, never pass it to Google Analytics, Google Ads, Microsoft Advertising, Meta Pixel or any other advertising technology, never sell or rent it, and never use it to train machine learning models. No analytics or advertising technology runs on the signed-in pages of the app at all.

The only third parties that receive this email address are the service providers needed to deliver the features you asked for, acting on our instructions: our hosting provider (Hetzner Online GmbH, Finland), our transactional email provider (Mailgun), which delivers your account and result notifications, and our payment provider (Stripe), which needs the address to issue your subscription receipts and invoices. It is never sent to an AI provider.

6.2 Google Calendar data (Limited Use)

If you connect a Google Calendar, the data described in section 3.6 is subject to the following binding limits:

• Use. We use Google Calendar data only to provide and improve the user-facing features of the Service that you can see in the product: naming a recording after the meeting it belongs to, and showing that meeting’s participants on the recording.
• No advertising. We never use Google Calendar data for advertising, ad targeting, ad measurement, audience building, profiling, or marketing, and it is never passed to any analytics or advertising technology. The signed-in pages that display your calendar data carry no analytics, advertising or tag-manager scripts of any kind.
• No AI training, no AI provider. We never use Google Calendar data to train, fine-tune, test, or improve machine learning or artificial intelligence models, ours or anyone else’s, and we never send it to a third-party AI provider. When a recording is named after a meeting from your calendar, that name is withheld from the request sent to the summarization model (see section 5.2).
• No sale or sharing. We never sell or rent Google Calendar data and we never “share” it for cross-context behavioral advertising under California law.
• Transfers. We transfer Google Calendar data to a third party only: (a) to service providers strictly necessary to deliver the user-facing features above, acting on our documented instructions and bound by equivalent restrictions, namely our hosting provider (Hetzner Online GmbH, Finland) and our transactional email provider (Mailgun), which delivers the notification naming the meeting your recording belongs to; (b) where necessary for security purposes, such as investigating a suspected abuse or technical incident; (c) where required by applicable law; or (d) as part of a merger, acquisition, or sale of assets, and then only after we obtain your explicit prior consent.
• No human reading. No person at Voxnoto reads Google Calendar data, except with your explicit consent (for example, to investigate a problem you reported to support), where necessary for security purposes, or where required by applicable law.
• Retention. Calendar events are cached only for a rolling window of 7 days in the past and 14 days ahead and are deleted automatically outside that window. A meeting title and participant names already applied to a recording stay with that recording and are deleted when you delete it.

Voxnoto’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access: Settings → Google Calendar → Disconnect in your account, or remove access at myaccount.google.com/permissions. Disconnecting deletes the cached events and the stored authorization token immediately.

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:

• Performance of a contract: to create accounts, provide transcription, store user content, process subscriptions, and provide support.
• Legitimate interests: to secure and improve the Service, prevent fraud, maintain records, and understand general Service usage, where those interests are not overridden by the user’s rights.
• Consent: for non-essential analytics, advertising cookies, and certain marketing communications where consent is required.
• Legal obligation: to comply with tax, accounting, law enforcement, and regulatory requirements.
• Legal claims: where processing is necessary to establish, exercise, or defend legal claims.

Users may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

We may disclose personal information to the recipients below. This section does not apply to Google user data: data obtained through Google APIs is disclosed only as permitted by section 6, which prevails over this section.

8.1 Hosting and infrastructure provider

We use Hetzner Online GmbH to host the Service and store account data, uploaded files, transcripts, and related information on servers located in Finland, European Union.

8.2 Payment provider

We use Stripe to process subscriptions and payments.

8.3 Analytics and advertising providers

Subject to applicable consent and opt-out requirements, we use Google Analytics 4, Google Ads, Microsoft Advertising, and Meta Pixel. These technologies receive website and app usage information only. They never receive Google user data, uploaded audio or video, or transcripts.

8.4 Professional advisers and authorities

We may disclose information to lawyers, accountants, auditors, insurers, courts, regulators, law enforcement, or government authorities when reasonably necessary or legally required.

8.5 Business transfers

Information may be transferred as part of a merger, financing, acquisition, reorganization, sale of assets, or similar transaction, subject to applicable law. Google user data is transferred in such a transaction only after we obtain your explicit prior consent.

8.6 With the user’s direction

We may disclose information when the user instructs us to do so or consents to the disclosure.

8.7 Google user data

Data obtained through Google APIs, including Google Calendar data, is disclosed only as set out in section 6 (Google User Data), which prevails over this section. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell personal information for money. Certain advertising technologies may constitute “sharing” for cross-context behavioral advertising under California law. Where applicable, users may opt out through our cookie settings or other privacy controls. Google user data, uploaded audio and video, and transcripts are never sold or shared for advertising.

Voxnoto UAB is established in Lithuania and the Service is hosted in Finland, both within the European Union. Personal information leaves the European Economic Area only when one of the service providers described in this Policy, such as our payment provider, our transactional email provider, our analytics and advertising providers, or the language model provider used for summaries and translation, processes it in another country, for example the United States.

For those transfers we rely on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where required. Users may contact [email protected] for additional information about applicable transfer safeguards.

We use cookies and similar technologies for:

• essential functions and account sessions;
• security and fraud prevention;
• preferences;
• analytics;
• advertising and conversion measurement.

Where required by law, non-essential analytics and advertising technologies are disabled until the user provides consent. Users can change their choices through the cookie settings available on the Service.

More information is available in our Cookie Policy.

We may send service-related messages that are necessary to operate the account or subscription.

We may also send marketing and educational emails. Where required by law, we will obtain consent before sending them. Users can unsubscribe using the link in any marketing email or by contacting [email protected].

Unsubscribing from marketing messages does not stop essential account, security, billing, or service communications.

Uploaded files, generated transcripts, and related project data are retained in the user’s account until the user deletes them or closes the account, unless retention is required for legal, security, fraud-prevention, dispute-resolution, or enforcement purposes.

When an account is deleted, associated uploaded files and transcripts are deleted from active systems.

Deleted files and transcripts may remain temporarily in incremental backups until those backups are updated or overwritten through our backup processes. Backup copies are maintained for security, disaster recovery, and system integrity and are not used for ordinary access or active processing.

Google Calendar data, if you connected a calendar, is cached only for a rolling window of 7 days in the past and 14 days ahead, and only to match your recordings to your meetings. Events outside that window are deleted automatically. Disconnecting the calendar, or deleting your account, deletes the cached events and the stored authorization token immediately. Meeting title and participant names that were already applied to a recording stay with that recording and are deleted when you delete it.

We retain account, billing, transaction, tax, security, and support records for as long as reasonably necessary for the purposes described in this Policy and to comply with legal obligations.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and for notifying us of suspected unauthorized access.

Users must have all rights, permissions, notices, consents, and lawful bases required to record, upload, store, and transcribe content.

Users must not upload content unlawfully obtained or content that violates privacy, confidentiality, intellectual property, recording-consent, employment, healthcare, or other applicable laws.

Voxnoto does not determine whether a recording was lawfully made.

The Service may technically process medical or therapy-related recordings. However, Voxnoto is not represented as HIPAA-compliant and does not enter into Business Associate Agreements unless expressly agreed in a separate signed writing.

A person or organization subject to HIPAA must not upload protected health information unless a valid Business Associate Agreement with Voxnoto UAB is in place.

Depending on location and applicable law, users may have the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• obtain a portable copy of certain information;
• restrict or object to certain processing;
• withdraw consent;
• opt out of marketing;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• appeal a decision concerning a privacy request;
• lodge a complaint with a data protection authority.

To submit a request, email [email protected]. We may need to verify identity before completing a request. Authorized agents may submit requests where permitted by law, subject to verification.

Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). Users in the EEA or United Kingdom may also complain to the supervisory authority in their place of residence, place of work, or location of the alleged infringement.

If the California Consumer Privacy Act, as amended, applies to Voxnoto UAB and the user, California residents may have rights to know, access, correct, delete, and obtain information about the collection, use, disclosure, sale, and sharing of personal information. They may also have the right to opt out of sale or sharing and to limit certain uses of sensitive personal information.

We do not discriminate against users for exercising applicable privacy rights.

Users may submit requests through [email protected] and may manage advertising choices through our cookie settings. Where legally required, we honor recognized opt-out preference signals, such as Global Privacy Control.

See our U.S. State Privacy Notice.

The Service is intended only for persons who are at least 18 years old. We do not knowingly allow persons under 18 to create accounts.

If we learn that a person under 18 has provided personal information through an account, we may delete the account and associated information.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices.

We may update this Privacy Policy from time to time. We will post the updated version and revise the effective date. Where required, we will provide additional notice or obtain consent.

For questions, requests, or complaints concerning privacy:

Voxnoto UAB
Lithuania, European Union
[email protected]
Privacy requests: [email protected]