Privacy Policy

• We collect what we need to run the service: your account info, the audio/video you ask us to transcribe, and the resulting transcripts.
• We do not train AI models on your content. Your transcripts and uploads are never used to improve our (or anyone else's) AI systems.
• We don't sell your data or share it with advertisers.
• We use a small set of carefully chosen sub-processors (listed below) to deliver the service.
• You can export, edit, or delete your data at any time from your dashboard, or by emailing us.
• If you cancel, we delete your transcripts and uploads within 30 days unless you ask us to keep them.

We collect three categories of personal information:

(a) Account information

When you sign up, our authentication provider (Clerk) collects:

• Email address
• Display name (optional)
• Profile picture (optional, if you sign in with a provider)
• Authentication tokens, login timestamps, and IP addresses for security

(b) Content you submit

To transcribe a video or audio file, we need access to the source. Depending on how you give us that source, we collect:

• URLs you paste (YouTube, TikTok, Instagram, etc.)
• Files you upload directly (audio or video)
• Generated outputs: the transcript, speaker labels, and any AI-generated summary, repurpose, chapters, clip-finder results, captions, or translations

We download the audio (and, where applicable, a small video preview) from the URL you provide. The original media is processed on our compute infrastructure and the resulting transcript is stored in your account.

(c) Billing information

When you subscribe to a paid plan, our billing providers (PayPal or Flow.cl) collect your payment details on their own systems. We never see or store your full card number. We receive only:

• Subscription identifier (e.g. PayPal subscription ID)
• Plan tier (Creator / Pro / Studio)
• Billing interval (monthly / annual)
• Renewal date and cancellation status
• Last 4 digits of the card and brand (Flow.cl only, for support purposes)

(d) Usage and diagnostic data

• Counts of transcripts created and AI tools used (so we can enforce plan limits)
• Server-side error logs (which page failed, which API call returned an error). These do not contain your content.
• Standard web request data (IP address, user-agent, timestamp) for security and abuse prevention

We do not use third-party analytics like Google Analytics, Amplitude, or any advertising / tracking pixels.

• Deliver the service: download your media, transcribe it, run AI tools you request, store the output in your account, let you stream playback.
• Bill you: process subscriptions, enforce plan quotas, send renewal/cancellation notices.
• Authenticate you: confirm it's really you signing in, prevent unauthorized access.
• Improve reliability: aggregate, anonymized error metrics so we can fix bugs.
• Communicate with you: account-related emails (e.g. transcript ready, subscription renewed). We do not send marketing emails without explicit opt-in.
• Comply with the law: respond to lawful requests from authorities, defend our legal rights.

What we don't do

• Train AI models on your content. Your transcripts, uploads, and AI-generated outputs are never used to train, fine-tune, or improve any machine-learning model — ours or any third-party's.
• Sell your data. We do not sell, rent, or barter personal information.
• Profile or target you for advertising.
• Read your transcripts. Engineering staff access content only when you specifically request support that requires it, or when responding to a lawful order.

We rely on the following third-party services to deliver TranscribeFlow. Each receives only the minimum information needed for their function.

We sign data processing agreements where applicable and review each provider's security posture before integrating.

• Account information: as long as your account is active. Deleted within 30 days of account closure.
• Transcripts and uploads: indefinitely while your account is active. You can delete individual transcripts at any time. We delete them within 30 days of account closure unless you request otherwise.
• Original audio and video files: stored in our R2 bucket alongside the transcript. Same retention as the transcript.
• Billing records: kept for 6 years to comply with Chilean tax law (Servicio de Impuestos Internos requirements).
• Server logs: 30 days, then aggregated or deleted.

Depending on where you live, you have a combination of the following rights. We honor all of them globally regardless of jurisdiction — we don't do tiered privacy.

• Access: see what we have about you. Most of it is visible in your dashboard; for the rest, email us.
• Correction: fix anything inaccurate.
• Deletion: erase your account and content. Use the Delete account button in Settings or email us.
• Portability: export your transcripts and data in standard formats (TXT, SRT, VTT, JSON, DOCX, PDF). Available from each transcript page.
• Object / restrict: tell us to stop processing for specific purposes.
• Withdraw consent: where processing is based on consent, you can withdraw it at any time.
• Complain to a regulator: in Chile, contact the Agencia de Protección de Datos Personales (once established) or SERNAC for consumer matters. EU/UK users can complain to their national Data Protection Authority. California residents have additional rights under CCPA — see Section 9.

To exercise any of these rights, email skylounge.latam@gmail.com. We respond within 30 days. We may ask you to verify your identity before acting on a request — usually by sending the request from the email on the account.

We use a small number of cookies and similar technologies, all first-party and strictly necessary:

• Authentication cookies (Clerk): keeping you signed in across page loads.
• Theme preference (localStorage): remembering your dark / light mode choice.
• CSRF tokens: preventing cross-site request forgery.

We do not use advertising or analytics cookies. Because all our cookies are strictly necessary, we don't show a cookie banner — but if you block them, the site will not function correctly.

We are based in Chile, and our infrastructure is hosted on services located primarily in the United States and the European Union. Specifically:

• Database (Neon): US-East
• Object storage (Cloudflare R2): global edge network
• Compute (Modal): US
• Web hosting (Vercel): global edge network
• AI processing (Anthropic): US

When you submit data to TranscribeFlow, you consent to it being transferred and processed in these jurisdictions. Where required, we rely on Standard Contractual Clauses or similar frameworks for cross-border data transfers.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know what personal information we've collected, used, disclosed, and sold or shared in the past 12 months.
• Right to delete personal information we've collected.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information. There is nothing to opt out of.
• Right to non-discrimination: we will not deny you service or charge you more for exercising these rights.

Submit a CCPA request to skylounge.latam@gmail.com with the subject line "CCPA Request".

TranscribeFlow is not intended for users under 13 (or under 16 in jurisdictions where the GDPR sets that floor). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

We follow standard industry practices, including:

• HTTPS/TLS for all data in transit
• Encrypted storage at rest (provider-side, all sub-processors)
• Authentication handled by Clerk, including support for hardware keys and OAuth providers
• Server-side authorization on every API request
• Audit logging for sensitive operations
• Card numbers never touch our servers — handled entirely by PayPal and Flow.cl

No system is 100% secure. If we discover a breach affecting your personal information, we will notify you and the relevant authorities within 72 hours, as required under GDPR Article 33 and Chilean Ley 21.719 once it takes effect.

We may update this Privacy Policy as the service evolves or when laws change. If we make material changes, we will notify active users by email at least 30 days before the new policy takes effect. The "Effective date" at the top of this page always reflects the current version.

Past versions are available on request.

For privacy questions, requests, or complaints:

• Email: skylounge.latam@gmail.com
• Postal address: SkyLounge SpA, Santiago, Chile
• Company registration: RUT 78.369.285-6