Privacy Policy.

1. Who we are (data controller)

Scribuo is a UK-based operator of a YouTube-transcription service and is the data controller for the personal data described in this policy. You can reach us about privacy matters at support@scribuo.com.

2. What we collect, why, and our lawful basis

We only collect data we need to run the Service. Under Article 6 of the UK/EU GDPR, we rely on the following lawful bases:

• Account data (email, name) — collected via Clerk to create and secure your account. Lawful basis: performance of a contract (Art. 6(1)(b)).
• Content you submit (YouTube URLs, uploaded files, video metadata) and the transcripts, summaries, and translations we generate — processed to deliver the transcription you request. Lawful basis: performance of a contract (Art. 6(1)(b)).
• Usage and metering data — how much of the Service you use, to enforce plan limits and improve reliability. Lawful basis: legitimate interests (Art. 6(1)(f)) and contract.
• Billing data — handled by Stripe to process payments; we do not store full card numbers. Lawful basis: performance of a contract and legal obligation (Art. 6(1)(c), for tax/accounting records).
• Technical data (IP address, device/analytics) — to keep the Service secure and understand usage. Lawful basis: legitimate interests, and consent where required for non-essential cookies.

3. Sub-processors

We use the carefully selected service providers below to operate the Service. Core transcription runs on our own servers using faster-whisper — audio is not sent to a third party to be transcribed. Our storage (MinIO) and primary database (PostgreSQL) are also self-hosted on our own infrastructure.

4. International transfers

Some of our sub-processors are located outside the UK/EEA (for example in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, together with additional technical measures, to ensure your data receives an equivalent level of protection.

5. Data retention

We keep your account data for as long as your account is active. Transcripts and uploaded files are retained so you can access your library until you delete them or close your account. When you delete content or your account, we remove it from our active systems and from storage within a reasonable period, subject to short-lived backups. We keep billing and transaction records for as long as required by law (typically up to six years for UK tax and accounting purposes).

6. Security

We protect your data with encryption in transit (TLS) and at rest, envelope encryption using a key-encryption-key (KEK) model for sensitive artifacts, role-based access controls, network isolation of our self-hosted infrastructure, and least-privilege access for staff. No system is perfectly secure, but we take appropriate technical and organisational measures to reduce risk.

7. Your rights

Under UK/EU GDPR you have the right to access your data, to rectify inaccurate data, to erase your data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. You can exercise many of these rights directly in-product — you can export or delete your transcripts and close your account at any time — or by contacting us at support@scribuo.com. We will respond within one month.

8. Cookies and analytics

We use strictly necessary cookies to sign you in and keep the Service secure; these do not require consent under PECR. Where we use non-essential analytics cookies to understand how the Service is used, we will ask for your consent first and you can withdraw it at any time. You can also control cookies through your browser settings.

9. Children

The Service is intended for users aged 18 and over. It is not directed at children, and in any case we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Data breaches

We maintain procedures to detect, investigate, and respond to personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required, and will inform affected users without undue delay where the risk is high.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate.

12. Contact and complaints

For any privacy question or to exercise your rights, contact support@scribuo.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how we have handled your data.