Privacy policy

Who is responsible

Scribe by Swalent is operated by Swalent (Edmond Ivanov), a self-employed individual, Rue de la Limite 60, 1970 Wezembeek-Oppem, Belgique, enterprise number 1042.844.426.

Contact for any question about your data: contact@swalent.com or the contact form. No data protection officer is appointed, as the law does not require one for this activity.

Two different roles

Swalent is the controller only for the data needed for your account and for running the service: sign-in identity, settings, billing, security, technical logs, contact messages and « Tell me when it opens » sign-ups.

For everything you record, import or have processed in Scribe (audio, video, transcripts, documents, notes, people mentioned), you are the controller. Swalent acts as your processor, only on your instructions, under the data processing agreement, which is part of the terms.

You alone decide who is recorded, on what legal basis, and what is done with the recording. Swalent does not and cannot check that you informed the people recorded or obtained their consent, and is not liable for it. The rules you must follow are in the terms.

If you record a conversation for purely personal purposes, the GDPR may not apply to you (art. 2.2.c). Swalent handles that content with the same safeguards.

The data we process

As controller, Swalent processes:

• Account: email address, name and picture of your Google account, Google identifier, language, settings, sign-in dates.
• Origin of the sign-up, read once when the account is created: the campaign of the link you arrived through (an address under /c/…), written into the sign-in button, and, if you answer it at the end of onboarding, how you heard about Scribe. Nothing is read from your browser: no cookie, tracker, or site you came from.
• Google sign-in: your identity at each sign-in and, if you turn them on, encrypted tokens for Google Drive (files you pick), Google Calendar (read only) or Google Tasks.
• Provider keys: the AI keys you save, encrypted; only their last characters are shown.
• Usage ledger: per call to a provider, the engine, the duration or volume and the estimated cost. Never the content.
• Devices: the name of each linked device, its access token, and your browser’s notification address if you turn notifications on.
• Billing, once payment opens: subscription status, invoices, customer identifier at Stripe. Swalent never sees your card number.
• Contact messages: name (optional), email address, subject, message, an irreversible fingerprint of the IP address.
• « Tell me when it opens » list: email address, the offer awaited, language, page of origin, the text shown when signing up, the dates of the sign-up, the confirmation and the opening email, an irreversible fingerprint of the IP address.
• Technical logs: IP address, browser, page requested, time, errors. No content.
• Usage measurement: from what the service already records for you (recordings, documents, shares, sign-ins) and a few actions our servers perform without keeping them elsewhere (a search run, an export downloaded, a call to a provider, its duration and outcome), a record per account and per day: which feature, on which platform, how many times. Never the content, the text of a search, a title or a file name.
• Service errors: our servers log their own errors (the page or call template, the kind of error, the step, the engine). Error reports from the app or the browser: only if you turn them on in Settings or use "Report a problem"; the kind of error, the step, the app version, durations. Never any content.
• Feedback: the text you send, the screen or feature concerned, the app version, linked to your account; an excerpt of content only if you attach it.

As processor, on your behalf: audio and video, links you paste and the media fetched, transcripts and their corrections, names given to voices, notes, images, documents, the glossary, people, projects, actions and knowledge entries, and the email addresses of the people you share with.

A recording may contain sensitive data (health, opinions): processing it is your responsibility as controller.

Why, and on what basis

• Creating and managing your account, providing the service, writing to you about it (export ready, deletion, cap, end of subscription): performance of the contract (GDPR, art. 6.1.b).
• Processing your content and sending it to the AI provider you designate: performance of the contract, and your instructions as controller.
• Security, abuse prevention, logs, backups: legitimate interest in protecting the service and your data (art. 6.1.f).
• Origin of the sign-up: legitimate interest in measuring what each acquisition channel costs (art. 6.1.f). Deleted with the account, and included in the export.
• Answering contact messages: legitimate interest in replying, or pre-contractual steps at your request.
• Emailing you when an offer you are waiting for opens: your consent (art. 6.1.a; Belgian Code of Economic Law, art. XII.13), given when you sign up, which you can withdraw at any time in one click.
• Billing and accounting: legal obligations (art. 6.1.c).
• Usage measurement: legitimate interest in knowing which features are used and by whom, what they cost and where the service fails, in order to improve it (art. 6.1.f). You can object at any time in Settings, Account: your account leaves the statistics and its record is erased.
• Error reports sent by the app or the browser: your consent (art. 6.1.a), which you can withdraw at any time in Settings, as easily as you gave it. Errors logged by our servers: legitimate interest in running the service (art. 6.1.f).
• Reading your feedback, answering you and improving Scribe: legitimate interest in improving the service (art. 6.1.f). An excerpt you attach is processed on your behalf, like your other content.
• Optional access to Google Drive, Calendar or Tasks: your request, which you can withdraw at any time.

No advertising, no profiling, no sale of data. Swalent does not use your content to train any AI model.

Being told when an offer opens

On the pricing page and on the single-file page, you can ask for an email when an offer opens. You give an address and the offer you are waiting for; Scribe sends you a single email per offer, when it opens, with a one-click unsubscribe link. Nothing else is sent to you, and the address is used for nothing else.

Basis: your consent (GDPR, art. 6.1.a; Belgian Code of Economic Law, art. XII.13). The « Email me when it opens » button gives it. Scribe keeps the date, the page, the exact text you were shown and an irreversible fingerprint of your IP address, to be able to show it (art. 7.1).

• After the opening email, it is deleted 30 days later; if the offer does not open, at the latest 24 months after the sign-up.
• Once the sign-up is deleted, the proof of your consent is kept for 3 years without your address in clear: its irreversible fingerprint, the offer, the text shown and the dates.
• If you unsubscribe, the irreversible fingerprint of your address joins that offer’s opt-out list, for as long as the list exists, so that no email is sent to you again (Belgian royal decree of 4 April 2003, art. 2).

The emails are sent through Resend; the form’s anti-robot check is Cloudflare’s (Turnstile), when it is active. Both are described below.

To withdraw your consent: the link at the bottom of every email from the list, or a message to contact@swalent.com. You receive an acknowledgement. Withdrawal does not affect what was done before.

AI and your keys

Scribe runs on your own keys. You open an account with the AI provider of your choice (ElevenLabs, Mistral, AssemblyAI, OpenAI, Anthropic or Google), accept its terms, and it bills you directly.

When you start a transcription, a document or a translation, Scribe sends, on your instruction and with your key, the audio or text needed to that provider. The provider processes that data under the contract you concluded with it: that contract decides whether it keeps the data, for how long, and whether it uses it to train its models. Swalent is not a party to that contract and is not liable for it.

What their API terms provide by default, as checked on 6 October 2026: Anthropic, OpenAI and Google (paid tier, and free tier in the European Economic Area) do not train their models on the data they receive; Mistral, ElevenLabs and AssemblyAI do unless you opt out in your account with them. All keep data for a short period, often 30 days, to detect abuse; zero retention exists on request or for enterprise accounts. Check these settings with your provider.

Should Swalent one day offer a plan using its own keys, it will choose providers contractually committed not to train on your data, with the shortest retention available, and this policy will be updated beforehand.

Minutes and knowledge entries are written by an AI model and marked as such. Any AI-produced content may contain errors.

Processors and recipients

Nobody at Swalent reads your content, except at your request to help you, to handle a security incident, or where the law requires it. These providers process data to run Scribe:

• Vercel Inc. (United States): hosting and server, run in Frankfurt, and fetching the media of a pasted link. Certified under the EU-US Data Privacy Framework (DPF), and standard contractual clauses. Policy
• Databricks, Inc. for Neon (United States): database hosted in Frankfurt. DPF certified, and standard contractual clauses. Policy
• Cloudflare, Inc. (United States): files stored in the European Union (R2, EU jurisdiction) and the anti-robot check of the contact and « Tell me when it opens » forms. DPF certified, and standard contractual clauses. Policy
• Google LLC and Google Ireland: sign-in with Google and the access you turn on. DPF certified, and standard contractual clauses. Policy
• Resend (Plus Five Five, Inc., United States): service emails and the « Tell me when it opens » list. DPF certified, and standard contractual clauses. Policy
• Your browser’s notification service, if you turn notifications on: it receives the notification text encrypted.
• Stripe Payments Europe, Ltd (Ireland), once payment opens: payments, as controller for card data. Stripe, LLC is DPF certified. Policy

Telegram only receives a notice that a contact message arrived, with no name, no address and no content.

The AI providers you choose receive what you have Scribe send them, under your contract with them: ElevenLabs and AssemblyAI (United States, DPF certified), OpenAI (OpenAI Ireland for Europe), Anthropic (Anthropic Ireland for Europe), Google Gemini (DPF certified), Mistral AI (France, hosted in the EU by default).

The people you share a recording with see what you share. A tool you connect to Scribe yourself with your personal key sees what that key can read.

Transfers outside the European Union

Your files are stored in the European Union and the database is in Frankfurt. Several providers are American companies that may access them from the United States for operations or support.

These transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Decision (EU) 2023/1795) for certified companies, and on the Commission’s standard contractual clauses (Decision (EU) 2021/914), included in each data processing agreement.

How long

• Account and content: as long as the account exists. You can delete a recording at any time.
• Bin: permanent deletion after 14 days.
• Account deletion requested: 7 days to cancel it, account frozen meanwhile.
• End of a paid subscription: 30 days read-only, then account deletion, with three reminder emails.
• Backups: a daily copy kept 30 days. Deleted data leaves them at most 30 days later.
• Export file: deleted 7 days after it is made.
• Contact messages: 12 months.
• « Tell me when it opens » list: 30 days after the opening email, 24 months at most; proof of consent, without the address, 3 years.
• Technical logs: the short period set by the host.
• Usage events: 90 days. Per-account usage record: 13 months; it is also erased with the account.
• Overall statistics without accounts: kept without limit when they cover at least ten accounts, 13 months otherwise.
• Invoices: 7 years (Belgian VAT Code, art. 60 §4), without the content of your recordings.
• Service errors and error reports: 30 days.
• Feedback: as long as the account exists; feedback leaves with the account when it is erased.

Your rights

For the data Swalent is responsible for, you can at any time:

• Access it and take it with you: "Export my data" in Settings, Account.
• Delete it: "Delete my account" in Settings, Account.
• Correct it: in the app, or by writing to us.
• Object to processing based on legitimate interest, or ask for it to be restricted.
• Revoke a Google access, in Scribe or from your Google account.
• Object to usage measurement: the "Exclude my account from usage statistics" switch in Settings, Account.

Write to contact@swalent.com. We answer within one month and may ask you to confirm your identity.

You can lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be, or with the authority of the country where you live.

If you were recorded by a Scribe user, that user is the controller: address your request to them. If you send it to us, we pass it on without delay, as the data processing agreement provides.

Cookies and local storage

Scribe only uses strictly necessary cookies: no audience-measurement tracker, no advertising tracker, no third-party cookie, and therefore no consent banner. Statistics come from what our servers do for you: nothing is read from or placed on your browser or device for that purpose.

• scribe_session: keeps you signed in, 30 days.
• scribe_oauth and scribe_onetap: protect sign-in with Google against forgery, 10 minutes.
• scribe_lang: remembers the language you chose, 1 year.

The browser’s local storage keeps a few display preferences (theme, playback position), which stay on the device. On the contact page and the « Tell me when it opens » form, Cloudflare’s anti-robot check (Turnstile) may examine technical browser signals, without advertising cookies.

Security

• Encrypted connections (HTTPS) everywhere.
• Provider keys and Google tokens encrypted in the database.
• Files read through short-lived signed links, never public.
• Signed, revocable session ("Sign out everywhere"), protection against requests from other sites.
• Daily backup and check, administrative access limited to the operator.

In the event of a data breach, we inform the Data Protection Authority and the people concerned within the legal deadlines (GDPR, art. 33 and 34) and, for your content, we notify you as the data processing agreement provides.

Minors

Scribe is reserved for people aged 16 and over.

Changes

We tell you by email or in the app before a significant change applies. The version date at the top of the page shows the last update.