A small policy
for a small product.

gettranscript.io is operated by Leadout Oy (Y-tunnus 2584445-3), Linnankatu 61, 20100 Turku, Finland. Leadout Oy is the data controller for personal data processed through this service. For any privacy questions, email hello@gettranscript.io.

When you create an account and use our service, we collect:

• Account data — your email address and a hashed password, stored in Supabase.
• API key — a randomly generated key tied to your account, used to authenticate API requests.
• Credit balance — the number of credits remaining on your account.
• Request history — a log of transcript requests, including the video ID, whether the result was served from cache, and timestamp. We do not log request IP addresses in this table.
• Cached transcripts — transcript text and segment data are cached to reduce redundant fetches. Cached data is not tied to individual users; it is shared across all users who request the same video.
• IP address & request metadata — temporarily processed at the edge for rate limiting, abuse detection, and security by Cloudflare Turnstile (on signup), the Upstash rate limiter (signup, demo, and authenticated API), and Sentry. Your IP is not stored in our database; it is held only ephemerally by these services for their stated purpose.
• Pageview data — anonymous pageview events collected by Vercel Analytics. No cookies set, no personal data stored.
• Error data — stack traces, request URLs, request headers, and IP address collected by Sentry when errors occur. This may incidentally include your user ID.

• To provide the transcript service and authenticate your requests.
• To track credit usage and enforce rate limits.
• To send transactional emails — welcome email on signup, low-credit alerts at 50 and 10 credits remaining. We do not send marketing email.
• To monitor and fix errors in the service.
• To understand aggregate usage patterns via anonymous analytics.

We use the following sub-processors:

Some of these providers are based outside the European Economic Area (notably in the United States). Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism approved under GDPR Article 46.

We retain your account data for as long as your account is active. Request history and cached transcripts are retained indefinitely to support the cache-first architecture. If you delete your account, your personal data (email, API key, credit balance, and request history) is deleted within 30 days. Cached transcript data, which is not personal, is retained.

Abuse-prevention records — Upstash rate-limit windows and Cloudflare Turnstile challenge logs — auto-expire within hours. Error events captured by Sentry follow Sentry's default retention (90 days) and are then deleted automatically.

Depending on your location, you may have the right to access, correct, delete, or receive a portable copy of the personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email hello@gettranscript.io. We may need to verify your identity before fulfilling a request — typically by replying from the email address on your account.

If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.

We do not use tracking or advertising cookies. Your login session is stored in your browser's local storage by Supabase to keep you signed in. Cloudflare may set a short-lived cf_clearance cookie during signup if its Turnstile captcha shows an interactive challenge; this is used for anti-fraud only and is not used to track you across the site. Vercel Analytics is cookieless.

The service is not intended for users under 13 (the Finnish digital age of consent under GDPR Article 8). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, email hello@gettranscript.io and we will delete it.

We may update this policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the service after a change constitutes acceptance of the updated policy.