Privacy Policy

1. Data controller

The data controller is Ayoub KHAMASSI, as identified in the Legal Notice. For privacy questions or requests, email khamassi1995@gmail.com.

2. Data processed and required fields

We process only the data needed for the purposes described below:

• Account: Firebase identifier, email address, display name, verification status, accepted Terms and Privacy Policy versions, and acceptance timestamp. An email is required to create and secure an account.
• Content: audio or video files, transcript, timestamps, language, filenames, styles, and corrections. The media file is required to provide transcription.
• Usage: duration, quota, plan, history, exports, API keys, referrals, and technical processing events.
• Payment: customer identifier, subscription, currency, amounts, invoice status, and billing address. Captain Transcribe does not receive the full card number.
• Security: IP address, anti-abuse results, error logs, and request identifiers.
• Support: name, email, subject, and content of messages sent to support.
• Communications: opt-in or opt-out choice for product tips and marketing reminders.
• Analytics: page and navigation events only after consent to analytics/advertising trackers.

3. Purposes and legal bases

• Provide transcription, history, quotas, exports, and account features — performance of a contract or pre-contractual steps.
• Manage subscriptions, payments, invoices, and accounting duties — contract and legal obligations.
• Authenticate users, prevent fraud and abuse, diagnose incidents, and protect the service — legitimate interests in securing and operating the service.
• Answer support requests and send necessary transactional messages — contract and legitimate interests.
• Occasionally send usage tips and marketing reminders — explicit consent, off by default and withdrawable at any time.
• Measure audiences and conversions with Google Analytics/Google Ads — consent, which can be withdrawn at any time.

4. Recipients, processors, and transfers

Internal access is limited to people who need it. We do not sell personal data. The following providers may process it on our behalf:

• Hetzner Online GmbH — application hosting and storage, Germany
• Google Firebase — authentication and database
• AssemblyAI — primary speech transcription
• OpenAI — alternative transcription engine and optional AI enhancement
• Stripe — payments, subscriptions, and invoices
• Resend — transactional email and, after consent, product communication delivery
• Cloudflare Turnstile — automated abuse detection on selected forms
• Google Analytics and Google Ads — audience and conversion measurement, only with consent

Some providers may process data outside the European Economic Area. Depending on the provider and destination, transfers rely on an adequacy decision, Standard Contractual Clauses, or another safeguard recognized by the GDPR. You may request details from the privacy contact above.

5. Retention periods

• Stored media, audio, and results: 30 days on Free, 90 days on Starter and Creator, and until user deletion on Pro. The applicable period is set when the transcription is created.
• Temporary media from a failed processing request: deleted when the request ends; scheduled maintenance also removes any residual artifacts.
• Transcription attempt logs: no more than 30 days.
• Account and profile: for the life of the account, then removed through the account-deletion process, except data that must be legally archived.
• Billing data: for the period required by applicable tax and accounting rules; in France, certain accounting documents are retained for ten years.
• Cookie preference: six months, after which consent is requested again.
• Abuse counters and technical reservations: until automatic expiry, generally from a few minutes to 90 days depending on purpose.

6. Security and user controls

We use access controls, short-lived signed audio access tokens stored in an HttpOnly cookie, HTTPS encryption, input validation, rate limits, and centralized deletion mechanisms. From Settings, you can download an account archive or delete the account; individual transcriptions can be deleted before their expiry.

7. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction, objection, and portability. You may withdraw consent to cookies or product communications without affecting earlier processing. Every non-transactional email also includes an immediate unsubscribe link. We may request reasonable proof of identity. You may also complain to the CNIL or your local supervisory authority.

CNIL

8. Cookies and trackers

Strictly necessary local storage remembers items such as language and cookie preference. Google Analytics and Google Ads load only after acceptance. Declining does not prevent use of the service. The “Manage cookies” control available on every page lets you change or withdraw your choice.

9. Content submitted to the service

You must have the rights and permissions required to upload and transcribe a recording, particularly where it contains third-party voices or sensitive data. No solely automated decision producing legal effects about you is made from transcript content.

10. Changes

This policy may change when the product, its providers, or applicable law changes. The date above identifies the current version. Material changes will be communicated appropriately.