Privacy policy

1. Data controller

The data controller is Francesco Miragliuolo. For any privacy request, write to privacy@subitosbobina.online.

2. What data we process

• Account data: email address, preferred language, sign-up date.
• Access and security data: IP address and browser type linked to your session, used to keep you signed in and to protect the service from abuse (for example too many requests in a short time). If you set up a passkey we only store its public key: biometric data (Face ID, fingerprint) stays on your device and never reaches us.
• Content you upload: audio files and the texts derived from them (transcript, corrected version, flashcards). The original file name is not stored.
• Payment data: amounts, date, payment status and transaction references. Card details are collected directly by Stripe and never pass through our servers.
• Communications: emails you send us and service emails we send you (sign-in links, transcript ready).
• Free trial checks: a device identifier (sb_did cookie), a browser fingerprint computed from technical characteristics (browser type, language, screen, time zone), the card fingerprint provided by Stripe, the surname on the card and the network you connect from. They are stored only in non-reversible encrypted form (HMAC): they are used to compare, not to identify you.

We do not process data for profiling or advertising and we do not sell data to anyone.

3. Why we process it and on what legal basis

• Providing the service (account, upload, transcription, editor, Word file and flashcards): performance of a contract (Art. 6(1)(b) GDPR).
• Handling payments, receipts and accounting and tax obligations: performance of a contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
• Protecting the service from abuse, fraud and unauthorised access, including rate limiting: legitimate interest (Art. 6(1)(f) GDPR).
• Preventing the free trial from being used more than once by the same person (card, device, network, anonymous connections such as Tor and VPN): legitimate interest in fraud prevention (Art. 6(1)(f) and Recital 47 GDPR). The outcome is automatic only when the signals are certain; otherwise a person decides. You can ask for an explanation and contest the decision by writing to privacy@subitosbobina.online.
• Answering your support requests: performance of a contract or pre-contractual steps.

4. Your audio and your texts

Audio and texts are yours. We use them only to produce your transcript: we do not use them to train artificial intelligence models and we choose providers that state they do not do so with customer data.

Texts are stored encrypted (AES-256-GCM) with a key kept separate from the data. Service administrators have no feature to listen to audio or read transcripts, unless you ask for support. Whoever operates the servers and keys could technically access them: this is why we keep the people and systems involved to a minimum.

If you record other people (for example a lecturer or an interviewee), make sure you have their consent or another lawful basis: this remains your responsibility.

5. How long we keep data

• Audio: deleted as soon as you download the Word file. If you don't download it, after 30 days at most. Audio from uncompleted or rejected uploads is deleted within one day.
• Text, corrected version and flashcards: deleted 24 hours after the Word download, or after 30 days at most. You can delete audio and text at any time from the transcript page.
• After deletion only minimal data remains: date, duration in minutes and linked payment, with no audio, text or file name.
• Account: until you close it. Sign-in sessions: 30 days.
• Payment data: 10 years, as required by Italian tax and civil law.
• Data used for rate limiting: a few minutes or hours, then it expires automatically.
• Free trial check fingerprints: as long as the account exists, to prevent a second trial; then deleted with the account.

6. Who we share data with

We use providers that process data on our behalf under data processing agreements (Art. 28 GDPR):

• Vercel Inc. (United States): website hosting.
• Neon (PostgreSQL database, Frankfurt data centre, EU): accounts, transcript status and encrypted texts.
• Cloudflare R2 (EU jurisdiction): temporary audio storage.
• AssemblyAI (European servers): transcription of paid transcripts.
• Groq Inc. (United States): transcription of the free trial and free access, text correction and flashcard creation.
• Stripe Payments Europe Ltd (Ireland): payments and fraud prevention.
• Resend (sending from Ireland, EU): service emails.
• Upstash (Frankfurt data centre, EU): rate limiting for security.
• Register.it (Italy): domain and email.
• proxycheck.io (United Kingdom), only if enabled: receives the IP address when you activate the free trial to check whether it is a VPN or proxy.

Some providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework, where the provider participates, or on the standard contractual clauses approved by the European Commission.

7. Your rights

You can ask at any time for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Arts. 15-22 GDPR). Write to privacy@subitosbobina.online: we reply within 30 days.

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the European country where you live.

8. United States residents

If you live in California or another state with consumer privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon):

• Categories of data collected: identifiers (email, IP address), commercial information (purchases), audio and text content you upload, technical usage data. Purposes and retention periods are those described above.
• We do not sell or share personal information for cross-context behavioral advertising, and we do not use it for profiling with legal effects.
• You have the right to know what data we hold, to obtain a copy, to correct and delete it, and not to be discriminated against for exercising these rights.
• To exercise them, write to privacy@subitosbobina.online. We may ask you to confirm your identity from your account email address. You may also act through an authorized agent.

9. Children

The service is intended for people aged 14 or over. Below this age, consent from a parent or guardian is required.

10. Security

We use encrypted connections (HTTPS), encrypted texts in the database, expiring sign-in links, permission checks on every request and limits on repeated requests. No system is 100% secure: in case of a data breach we will inform you as required by law.

11. Changes

If we change this notice we update the date at the top; for important changes we notify you by email. Questions: info@subitosbobina.online.