Privacy Policy

1. Introduction

XPRO d.o.o. ("we", "our", or "us"), located at Stegne 21C, 1000 Ljubljana, Slovenia, operates Transcribe7 ("the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our transcription and translation service.

XPRO d.o.o. is the controller of your personal data for the Service on all platforms. In the Apple App Store, the Transcribe7 iOS app is published by SK MEDIA d.o.o. (Stegne 21C, 1000 Ljubljana, Slovenia, registration no. 2268299000) on behalf of XPRO d.o.o.; SK MEDIA d.o.o. only acts as the App Store publisher and does not receive or process your recordings, transcripts or account data.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us:

• Account information (name, email address, password)
• Payment information: card and payment details are handled by Stripe (website and desktop app purchases) or by Apple or Google (in-app purchases) and are not stored by us; we keep billing records such as your plan, amount, date, and invoice
• Profile information (optional preferences and settings)

2.2 Content Data

When you use our Service, we process:

• Audio and video files you upload for transcription and translation
• Generated transcriptions and translations
• Customization preferences (language settings, export formats)

2.3 Usage Information

We automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (features used, processing time, error logs)
• Cookies and similar tracking technologies
• With your consent, interaction data collected by analytics tools, including heatmaps and session recordings via Microsoft Clarity (clicks, scrolling, and mouse movement)

3. How We Use Your Information

We process your personal data for the following purposes:

• Service Provision: To provide, maintain, and improve our transcription and translation services
• Account Management: To manage your account and provide customer support
• Payment Processing: To process payments and prevent fraud
• Communication: To send you service updates, technical notices, and support messages
• Analytics: To understand how users interact with our Service and improve performance
• Legal Compliance: To comply with legal obligations and enforce our terms

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract Performance: Processing necessary to provide the Service you requested
• Legitimate Interests: To improve our Service, prevent fraud, and ensure security
• Consent: Where you have given explicit consent for specific processing activities
• Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We may share your information with:

5.1 Service Providers and Other Recipients

We use the following third parties to operate the Service. Each receives only the data needed for its role:

• Auth0 (Okta, Inc.): sign-in and account authentication
• Cloud hosting providers: Microsoft Azure (Microsoft Ireland Operations Limited / Microsoft Corporation) for database and file storage, and DigitalOcean for application servers
• Speech-recognition provider: a specialised speech-to-text and translation provider that processes audio to produce transcripts and translations
• OpenAI: optional AI features (for example summaries, titles, and AI tools) process the relevant transcript text
• Resend: sending transactional emails
• Stripe: card payments on our website and in the desktop app; we do not receive your full card details
• Apple and Google: in-app purchases in the mobile apps; they process payment data as independent controllers under their own privacy policies
• RevenueCat, Inc.: management of in-app subscriptions; receives your account identifier, purchase and subscription history, and basic device information to confirm your subscription and keep it in sync across your devices
• Minimax (accounting and invoicing software, Slovenia): issuing and fiscally verifying invoices for website and desktop app purchases, as required by Slovenian law; invoice data is reported to the Financial Administration of the Republic of Slovenia (FURS)
• Analytics providers: Google Analytics, provided by Google Ireland Limited, and Microsoft Clarity, provided by Microsoft Corporation and Microsoft Ireland Operations Limited (used only with your consent; see Sections 10 and 11)

Service providers acting on our behalf are contractually bound to protect your data and use it only for the specified purposes. Where a recipient acts as an independent controller (such as Apple and Google for in-app purchases, or FURS for invoice reporting), its own privacy policy or applicable law governs its processing.

5.2 Legal Requirements

When required by law, court order, or government regulation, or when necessary to protect our rights or the safety of others.

5.3 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS)
• Encryption at rest provided by our cloud storage providers
• Access controls and authentication mechanisms
• Backups

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy:

• Account data: Retained while your account exists and for up to 30 days after its deletion
• Recordings and transcripts: Retained until you delete them or delete your account. In the mobile app you can choose to keep recordings and transcripts only on your device, in which case they are not stored on our servers
• Invoices and payment records: Retained for 10 years, as required by Slovenian tax law
• Usage and security logs: Retained for up to 12 months

7.1 Account Deletion

To delete your Transcribe7 account and all its data (recordings, transcripts, account details), use the mobile app (Profile → tap your name at the top → Request account deletion) or email privacy@transcribe7.com from the address of your account. We complete the deletion within 30 days. Records that we are legally required to keep, such as invoices, are retained for the periods stated above.

Deleting your account does not cancel a subscription purchased through the App Store or Google Play. To stop future charges, cancel the subscription in your Apple ID subscription settings or in your Google Play subscriptions.

8. Your Rights (GDPR)

Under GDPR and applicable data protection laws, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@transcribe7.com. We will respond within 30 days. For deleting your account, see also Section 7.1.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for transfers to countries with adequate data protection, such as the EU–US Data Privacy Framework where applicable

10. Cookies and Tracking

We use cookies and similar technologies to:

• Maintain your session and preferences (strictly necessary)
• Analyze usage patterns and improve our Service (analytics)

For analytics we use Google Analytics (Google Ireland Limited) and Microsoft Clarity (Microsoft Corporation / Microsoft Ireland Operations Limited). Microsoft Clarity additionally generates heatmaps and session recordings of interactions such as clicks, scrolling, and mouse movement to help us diagnose usability issues; it applies automatic masking to reduce the capture of sensitive content. Analytics cookies are only set after you accept them via our cookie consent banner, and you can withdraw your consent at any time. Analytics data may be transferred to Google and Microsoft, including in the United States, subject to the safeguards described in Section 9.

For a full list of the cookies we use, their purposes and durations, and how to manage them, please see our Cookie Policy. You can also control cookies through your browser settings; note that disabling strictly necessary cookies may limit Service functionality.

11. Mobile Apps

The Transcribe7 iOS and Android apps use the same account as the website and desktop app, and this Privacy Policy applies to them. In addition:

• Product analytics: the app uses Microsoft Clarity product analytics only if you opt in. You can turn it on or off at any time with the toggle in the app's Settings.
• Diagnostics: only when you choose to send a diagnostics report, the app sends logs and basic device information to help us troubleshoot problems. You can choose to send the report anonymously.
• Apple Watch: recordings made on Apple Watch are transferred to your iPhone and uploaded in the same way as other recordings.
• In-app purchases: subscriptions purchased in the app are processed by Apple or Google and managed through RevenueCat, as described in Section 5.1.

12. Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.

13. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Information

For questions about this Privacy Policy or to exercise your rights, please contact us:

16. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement if you believe our processing of your personal data violates applicable law.

For Slovenia: Information Commissioner of the Republic of Slovenia (www.ip-rs.si)