Privacy Policy

Scribefy is operated by AXM Intelligence LLC, a Wyoming (USA) limited liability company ("we", "us"), which is the data controller for the personal data described here. This policy explains what we collect, why, who processes it, and the choices you have. It is written to be read, not skimmed past. Questions: support@scribefyapp.com.

The short version: your audio keeps its home in your Plaud account and we keep no durable copy of your audio files; we store the transcripts, notes and account data needed to run the product; we never sell your data and we never train AI models on your content; analytics only run if you accept them.

1. What we collect

Account data. Your email address and a password, or your Google or GitHub identity if you sign in with OAuth. We do not store plaintext passwords: your password is transmitted securely to our authentication provider (Supabase), which stores only a hash. Standard technical logs (IP address, browser type) are kept by our infrastructure providers for security and debugging.

Plaud connection. When you connect your Plaud account we store the email of that Plaud account, the API region it uses, and the access and refresh tokens that let Scribefy read your recording list. These tokens are encrypted at rest with AES-256-GCM and are never exposed to your browser or to other users.

Recording metadata. Titles, dates, durations and technical metadata of your Plaud recordings, so your library can be listed. This is the list only, not the audio (see section 2).

Transcripts and speakers. When you request a transcription we store the resulting text segments, timestamps and speaker labels. This is the product; it stays until you delete it.

AI notes and chat. Notes generated from your transcripts and your chat messages with the AI (including which AI model produced each answer) are stored so you can revisit them.

Billing. Payments are processed by Stripe. We store your Stripe customer ID, subscription status and plan details, plus an internal ledger of your transcription minutes. Your subscription record may also include your billing address and non-sensitive card metadata that Stripe shares with us (card brand, last four digits, expiry). We never store or even receive full card numbers or security codes; those go directly to Stripe.

Usage and cost records. Internal records of transcription and AI usage (minutes, tokens, estimated cost) used for billing accuracy, fair-use accounting and abuse prevention.

Settings and optional keys. Product preferences and, if you choose to add one, your own AI provider key (BYOK), stored to make the feature work.

Support. Messages you send to support (email or the in-app support chat) so we can help you.

Analytics, only with consent. If you accept the cookie banner, Google Analytics 4 and Meta Pixel collect standard usage events (pages viewed, sign-ups, purchases). Nothing loads before you accept; see section 5.

2. What we deliberately do not store

• Your audio files. Recordings live in your Plaud account. When you request a transcription, the file is fetched and processed transiently (in memory and, in parts of the pipeline, in temporary storage that is discarded after the run); the transcription engine receives the audio only to produce that transcript. Scribefy keeps no durable copy of your audio, and deleting a recording in Scribefy never touches your Plaud library.
• Voice snippets are the one small exception. To help you name speakers, we may generate short clips (up to roughly 24 seconds per speaker). These clips are stored in a private bucket and deleted automatically after at most 30 days; they can be regenerated on demand.
• Full card numbers or security codes. Never stored by us; they go directly to Stripe (see Billing above for the metadata we do keep).
• Plaintext passwords. Password storage and hashing are handled by our authentication provider (Supabase).

3. How we use your data

To provide the Service (sync your library, transcribe, generate notes, answer chat), to bill you, to give support, to keep the Service secure and prevent abuse, and, with your consent, to understand how the product is used so we can improve it. We do not sell personal data, we do not share it with data brokers, and we never train AI models of our own on your recordings, transcripts or notes; providers listed below process your content only to return the result you asked for. Emails we send today are account emails only (confirmation, password reset); we do not send marketing email.

Where European data-protection law applies, our legal bases are: performance of our contract with you (running the Service and billing), legitimate interests (security, abuse prevention, defending legal claims), consent (analytics), and legal obligation (tax and accounting records).

4. Who processes your data (subprocessors)

We use a small set of providers, each only for what its row says:

Transcription engines receive audio only for the recording you asked to transcribe and only to produce its transcript. AI providers receive the text needed for the feature you invoked; requests routed through OpenRouter are fulfilled by underlying model providers (such as Anthropic, OpenAI or Google) under OpenRouter's terms.

5. Cookies and analytics choices

Scribefy shows a consent banner before any analytics load. If you decline, no Google Analytics and no Meta Pixel scripts run, and the product works exactly the same. Your choice is stored in your browser (localStorage key scribefy-consent). To withdraw consent later, use the Privacy choices link in the footer, which stops analytics immediately; you can also email us. Because analytics are strictly opt-in, visitors who never accept are never tracked, which also satisfies opt-out signals such as Global Privacy Control.

Strictly necessary storage does not depend on this choice: your session login, and, if you use the support chat, an HTTP-only cookie (scribefy_support_vid, kept for one year) that lets your support conversation continue across visits.

6. How long we keep things

• Transcripts, notes, chat, recording metadata: kept while your account is active. You can delete staged recordings yourself; to delete specific transcripts, notes or conversations, email support and we will remove them.
• Voice snippets: deleted automatically after at most 30 days.
• Audio files: not stored (section 2).
• Support conversations: kept so we can help you over time; ask support to delete yours.
• Billing records: kept as long as required for accounting, tax and fraud-prevention obligations.
• Account deletion: email support@scribefyapp.com from your account email and we will delete your account and the personal data associated with it within 30 days, except what we must keep by law (for example, invoices). There is no self-service delete button yet; the email route is the official one and it works.

7. Your rights

Depending on where you live (for example under the GDPR in Europe or the CCPA/CPRA in California), you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can exercise most of this directly: transcripts and notes export in one click, and deletion works as described above. For anything else, email support@scribefyapp.com and we will respond within 30 days. You also have the right to complain to your local data-protection authority.

California residents: we do not sell personal information. The only data practice that could count as "sharing" under the CPRA is the Meta Pixel, and it never runs unless you opt in through the consent banner; declining (or withdrawing through Privacy choices) is a complete opt-out. We will never treat you differently for exercising any privacy right.

8. Security

Data moves over TLS. Plaud tokens are encrypted at rest with AES-256-GCM, with key identifiers that allow rotation. Database access is protected by row-level security so each user can only reach their own rows, and sensitive columns (like tokens) are never readable from the browser at all. Payment data is handled entirely by Stripe. No system is perfectly secure, but the design principle throughout is that we hold as little as possible: the most sensitive thing you own, your audio, stays in your Plaud account.

9. Where data is processed

Our providers operate primarily in the United States, and some process data in other regions where they run infrastructure. Where data moves from the EEA, the UK or Switzerland to other countries, our providers rely on recognized safeguards such as the EU Standard Contractual Clauses or Data Privacy Framework certification. Wherever it is processed, your data is subject to this policy.

10. Children

Scribefy is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product evolves. For material changes we will give notice on the site (or by email) before they take effect, and the "last updated" date at the top will change.

12. Contact

support@scribefyapp.com · Scribefy is operated by AXM Intelligence LLC, a Wyoming (USA) limited liability company. See also our Terms of Service.