Privacy Policy

1. Who We Are

PodcastCraft is the data controller for the personal data described in this policy. You can reach us at hello@podcastcraft.app for any question about this policy or to exercise your rights.

2. Information We Collect

We collect the following information:

• Account information - Email address, name (via Google OAuth or email signup)
• Podcast content - Audio files you upload (retained only briefly to run transcription, then automatically deleted)
• Generated content - Transcriptions, timestamps, keywords you create
• Usage data - Login activity, features used, credit consumption
• Payment information - Processed securely by Stripe (we never store card details)

3. How We Use Your Information and Our Legal Basis

Under the GDPR we must tell you why we process your data and on what legal basis:

• Providing transcription and content generation, managing your account and credits - Performance of our contract with you (Art. 6(1)(b))
• Processing payments and keeping accounting records - Performance of the contract and compliance with our legal obligations (Art. 6(1)(b) and 6(1)(c))
• Service-related notifications (processing complete, low credits) - Performance of the contract (Art. 6(1)(b))
• Security, error monitoring, fraud and abuse prevention, and aggregate usage statistics - Our legitimate interest in operating a reliable and secure service (Art. 6(1)(f))
• Optional communications, where we ask for them - Your consent (Art. 6(1)(a)), which you can withdraw at any time

We do not train AI models on your content. Our AI providers are contractually prohibited from using data sent through their APIs to train their models. Improving our service means reviewing aggregate usage patterns and our own prompts, never learning from your podcasts.

We never sell your data to third parties.

4. Data Storage and Retention

Our data retention policy:

• Audio files - Automatically deleted 24 hours after successful transcription. Uploads that are never transcribed are deleted after 48 hours. All processed content (transcription, chapters, keywords, show notes) remains available
• Transcriptions - Stored while your account is active
• Inactive accounts - Data may be deleted after 180 days of inactivity (with 90-day advance notice)
• Deleted accounts - Data removed within 30 days of account deletion

Your data is stored in the European Union (Supabase, Frankfurt) with encryption at rest and in transit. Note that our transcription and AI providers may retain the content sent to them for a limited period for abuse monitoring, as set out in their own terms, before deleting it.

5. Data Security

We implement industry-standard security measures including encryption, secure authentication (via Supabase), and regular security audits. However, no system is 100% secure—we recommend using strong passwords and enabling two-factor authentication when available.

6. Service Providers

We use the following providers to deliver the service. Each processes data only on our instructions, under a data processing agreement:

• Supabase - Database, authentication and file storage (European Union)
• Fly.io - Backend application hosting (European Union)
• Vercel - Frontend application hosting (United States)
• AssemblyAI, and Deepgram as a fallback - Audio transcription (United States)
• Anthropic, and OpenAI as a fallback - AI content generation from your transcripts (United States)
• Stripe - Payment processing (United States and Ireland)
• Sentry - Error monitoring (European Union)
• Resend - Transactional email (United States)
• Umami Cloud - Cookieless website analytics
• Google - Only if you choose to sign in with your Google account

We will update this list before adding a new provider that processes your content.

7. International Data Transfers

Your account data, transcriptions and generated content are stored in the European Union. However, some of the providers listed above are based in the United States, so delivering the service involves transferring personal data outside the EEA — in particular, sending your audio for transcription and your transcripts for AI content generation.

These transfers are covered by the safeguards required under Chapter V of the GDPR: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified under it, and in every case the Standard Contractual Clauses adopted by the European Commission, incorporated into our agreement with each provider.

You can request a copy of the safeguards applying to a specific transfer by writing to hello@podcastcraft.app.

8. Content About Other People

Episodes often contain the voices and personal details of guests and other people. When you upload that content, you decide what is processed and you are responsible for having the right to do so, including the consent of everyone recorded — see our Terms of Service. We process it only to deliver the service to you, under the providers and safeguards described above. If someone who appears in an episode contacts us about their data, we will refer them to the account holder who uploaded it and assist as needed.

9. Your Rights

Under the GDPR you have the right to:

• Access your data at any time via your dashboard
• Rectify inaccurate or incomplete data
• Erase your data by deleting your account
• Port your transcriptions and content by exporting them in a machine-readable format
• Restrict processing in the circumstances set out in Art. 18
• Object to processing based on our legitimate interests (Art. 21)
• Withdraw consent at any time, where processing is based on it, without affecting processing carried out beforehand

To exercise any of these rights, write to hello@podcastcraft.app. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Cookies and Analytics

We use essential cookies for authentication and session management. For audience measurement we use Umami Cloud, which is cookieless: it records aggregate visit statistics without setting cookies, without building a profile of you and without tracking you across other websites. We do not use advertising cookies.

11. Children's Privacy

Our service is not intended for users under 18. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this privacy policy occasionally. Significant changes will be communicated via email. Continued use after changes indicates acceptance.

13. Contact Us

Questions about privacy? Contact us at hello@podcastcraft.app