1. Who is responsible
Scrivio, a company established in Switzerland, is the controller for the personal data described here. Contact details are on the Imprint and Contact pages. For data-protection matters, write to the privacy address listed on the Contact page.
2. What we collect
Account data: your email address, first and last name, hashed password, interface language and account status. Content data: the audio and video files you upload, the transcripts produced from them, and the corrections, highlights, comments and tags you add. Usage data: how many audio-minutes you have transcribed, when, and against which file. Technical data: a log of each request — timestamp, route, HTTP status, duration, your IP address and a limited set of request headers — kept as a security and audit record.
3. Why we process it
To provide the service you asked for: storing your files, transcribing them and showing you the result. To operate a fair free tier, which requires counting the minutes you use. To keep the service secure and to investigate abuse. To send you transactional email: address verification, password reset, notification that a transcript is ready, quota warnings and retention warnings. We do not send marketing email and do not sell or share personal data with anyone for their own purposes.
4. Legal basis
Under the GDPR: performance of a contract (Art. 6(1)(b)) for providing the service and its transactional email; legitimate interests (Art. 6(1)(f)) for security, abuse prevention and audit logging; and consent where we specifically ask for it. Under the revised Swiss Data Protection Act, processing is carried out in accordance with the principles of Art. 6 FADP. Your recordings may contain sensitive personal data — that is your decision to upload, and we handle it accordingly.
5. Where your data is
All of it is hosted at Infomaniak in Switzerland: application servers, the database, uploaded files and outbound email. Nothing is replicated to another country, and there is no transfer to the United States or any other third country in the ordinary operation of the service.
6. How long we keep things
Transcripts and their audio: 90 days from the last time you opened the transcript. Opening it restarts the period, so material you actively use is retained for as long as you use it. We email you 14 days and 7 days before automatic deletion. Account data: for as long as your account exists. Usage records: retained while the account exists, because they are the basis of the monthly budget. Technical request logs: 365 days. System logs: 365 days.
7. What deletion actually removes
This is the section worth reading carefully, because "delete" means two different things here and we would rather be precise than comfortable. When you delete a single transcript — or when the 90-day retention period expires — we permanently remove the audio recording and the generated transcript files from disk. The transcript text itself is retained in your account record, together with the usage entry, so that the monthly minute accounting remains correct and cannot be reset by deleting files. That text is not visible to you afterwards and is not shared with anyone, but it is present in our database and in our backups, and we are telling you so rather than claiming otherwise. When you delete your account, everything goes: the files on disk, the transcripts and their text, your annotations, your tags and your usage records are erased. Your email address is retained only in an archived form so the address can be reused for a new account, and technical request logs are kept in an anonymised form with no link to you.
8. Sub-processors
We use Infomaniak (Switzerland) for hosting, storage and outbound email. That is the entire list, and it is published on the Sub-processors page; we will update it before adding anyone new.
9. No model training
Your recordings, transcripts and corrections are never used to train, fine-tune or evaluate any machine-learning model, ours or a third party's, and are never sold or licensed to anyone. Transcription runs on our own infrastructure; your audio is not sent to an external transcription API.
11. Your rights
You may request access to your personal data, correction of it, deletion of it, a portable copy of it, restriction of processing, and you may object to processing based on legitimate interests. You can exercise most of these directly in the application: correct your transcripts in the editor, export your content at any time, and delete individual files or your entire account from your account settings. For anything else, write to the address on the Contact page; we will respond within 30 days. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU or EEA, to your national supervisory authority.
12. Security
Traffic is encrypted with TLS 1.2/1.3 and HSTS is enabled. Passwords are stored as Argon2id hashes. Access to every transcript is checked on each request rather than only in the interface. Internal services communicate over a private network that is not exposed to the internet. No system is perfectly secure, and we will notify you and the competent authority without undue delay if a breach affects your personal data.
13. Children
Scrivio is not directed at children and we do not knowingly create accounts for anyone under 16. If you believe a child has created an account, tell us and we will delete it.
14. Changes to this policy
We will publish any updated version here with its date. If a change materially affects how we handle your personal data, we will tell you by email before it takes effect.
15. Contact
For any privacy question or to exercise a right, use the address on the Contact page. We answer every request and confirm receipt.