Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how Vindrose sp. z o.o. (a Polish limited liability company, spółka z ograniczoną odpowiedzialnością, registered at ul. Piękna 58c, 50-506 Wrocław, Poland; registered in the National Court Register under KRS No. 0001261581, tax ID (NIP) 8993066384) (“blablascribe”, “we”, “us” or “our”) collects, uses, stores and protects personal data when you use the blablascribe website and services at blablascribe.com (the “Service”).

We act as the data controller for the personal data described here. If you have any questions about this Policy or how we handle your data, contact us at [email protected].

By using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

1. Who this Policy applies to

This Policy applies to everyone who visits our website, creates an account, uploads or imports media for transcription, or otherwise interacts with the Service. It covers personal data we process about you, whether you are a visitor, a registered user, or a member of a team account.

2. What data we collect

2.1 Account and profile data

• Name and email address;
• Password (stored in hashed form) or, if you sign in with Google, the identifier and basic profile information Google shares with us (name, email address and profile picture);
• Team and membership information (the team you belong to, your role, invitations).

2.2 Content you upload or import

To provide transcription and related features, we process the media you submit and the outputs we generate from it:

• Audio and video files you upload;
• Media imported by link, where you paste a URL (for example from YouTube or Vimeo) and we retrieve the audio from that source at your request;
• Transcripts, subtitles, translations and edits produced from your media;
• Voice-overs (dubbing) you create: the voice-over script, the generated speech and, if you request it, a version of your audio with the original speech removed so that only music and sound effects remain;
• Related settings you choose (language, number of speakers, and similar options).

Your media may contain personal data about you or third parties (voices, names, spoken content). We process this content solely to perform the task you requested. See Section 5 on how transcription is processed and Section 8 on how long we keep it.

2.3 Voice clones (voice data)

If you choose to create a voice clone — a synthetic copy of a speaker’s voice used to voice your translation — we process:

• A voice sample: up to 2 minutes of that speaker’s speech, cut from the file you selected;
• The voice model created from the sample by our voice-over provider, ElevenLabs (see Section 5);
• A consent record: the time you confirmed consent, the IP address it came from and the exact wording you agreed to.

A voice sample and voice model can identify a person and may be treated as biometric data — a special category of personal data under Article 9 GDPR and “biometric information” under certain US state laws (for example, the Illinois Biometric Information Privacy Act). We use voice data only to generate voice-overs that you request in your own account. We do not use it to identify or verify anyone, we do not share it with other users, and we do not sell, lease, trade or otherwise profit from it.

You may clone only your own voice or the voice of a person who has given you their permission. Before every clone we ask you to confirm this; without that confirmation no clone is created.

2.4 Payment data

When you purchase a paid plan, payments are processed by Stripe. We do not receive or store your full card number. Stripe provides us with limited billing information (such as your plan, subscription status, the last four digits and card type, and billing country) needed to manage your subscription.

2.5 Usage and technical data

• IP address, device and browser type, and approximate location derived from IP;
• Log data such as pages viewed, features used, timestamps and referring URLs;
• Product-analytics and advertising events collected via PostHog, Microsoft Clarity, Google Analytics 4, the Meta (Facebook) Pixel and Google Ads, only where you have consented (see Section 9 on cookies and analytics).

2.6 Communications

Messages you send us (support requests, emails) and records of transactional and service emails we send you via Brevo.

3. How we use your data

• To create and manage your account and team;
• To provide the Service — transcription, subtitle generation, translation, AI text tools (summaries, quotes, posts), voice-over (dubbing), editing, and media conversion/compression;
• To process payments, manage subscriptions and prevent fraud;
• To send transactional and service messages (for example, account, billing and file-retention notices);
• To send marketing or product updates where permitted, from which you can opt out at any time;
• To operate, secure, debug and improve the Service, including analytics;
• To comply with legal obligations and to establish, exercise or defend legal claims.

4. Legal bases for processing (GDPR)

Under the GDPR we rely on the following legal bases:

• Performance of a contract — to provide the Service you sign up for, including processing your media and managing your subscription;
• Consent — for optional marketing communications and for non-essential cookies/analytics; you may withdraw consent at any time;
• Explicit consent (Article 9(2)(a) GDPR) — for creating and using a voice clone. You give it each time you create a clone and can withdraw it at any time by deleting the voice (see Section 8);
• Legitimate interests — to secure and improve the Service, prevent abuse and fraud, and communicate about your account, balanced against your rights;
• Legal obligation — to meet accounting, tax and other legal requirements.

5. How your content is processed

Transcription, subtitle generation and separating speech from music and sound effects run on our own infrastructure in Germany. Your audio and video are not sent to third-party AI providers for these tasks.

Some features use third-party AI providers, and only when you use those features:

• Translation and AI text tools (summaries, quotes, posts, quizzes) and preparing a voice-over script — we send the text of your transcript to the Google Gemini API. Audio and video are not sent;
• Voice-over (dubbing) — we send the voice-over script to ElevenLabs, which generates the speech. If you create a voice clone, we also send ElevenLabs the voice sample (see Section 2.3) so it can build the voice model. The voice model exists at ElevenLabs only while your voice-over is being generated and is deleted there automatically within minutes after it was last used; the sample itself stays with us (see Section 8).

These providers act as our processors under data-processing agreements and may use your data only to provide these services to us. Access to your content on our side is limited to systems and authorised personnel that need it to operate the Service and provide support.

When you import media by link, we retrieve audio from the source you provide only to perform the transcription you requested. You are responsible for ensuring you have the rights to submit that content (see our Terms of Service).

6. When we share data

We do not sell your personal data. We share it only with service providers (“processors”) acting on our instructions, and only as needed to run the Service:

• Stripe — payment processing and subscription management;
• Brevo — sending transactional and marketing emails;
• PostHog — product analytics (page views, feature usage);
• Microsoft Clarity — session replay and heatmaps, used to diagnose usability problems;
• Google (Google Analytics 4) — website audience measurement;
• Google (Google Ads) — measuring which of our ads lead to sign-ups and purchases (conversion measurement) and optimising our advertising;
• Meta Platforms (Meta/Facebook Pixel and Conversions API) — measuring and optimising our advertising;
• Google (Gemini API) — translation, AI text tools and voice-over scripts (text only; see Section 5);
• ElevenLabs — speech generation for voice-overs and, if you create one, the voice model of a voice clone (see Section 5);
• Hetzner Online GmbH — hosting and storage of the Service and your content, in data centres located in Germany (European Union);
• Professional advisers, or authorities and courts where required by law, or to protect our rights.

Each processor is bound by a data-processing agreement and may use your data only to provide services to us.

7. International data transfers

Your account data and the media you upload are stored on servers located in Germany, inside the European Union. Some of our other processors — for example payment, email, analytics and AI providers (Google, ElevenLabs) — may store or process data outside the European Economic Area, including in the United States. Where that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified). You can request more information at [email protected].

8. How long we keep your data

Account data is kept while your account is active and for a reasonable period afterwards as required for legal, accounting and security purposes.

Uploaded and imported media, transcripts and subtitles are retained according to your plan:

• Starter — files are kept in active storage for 30 days;
• Paid plans — files are kept for as long as your subscription is active. If you cancel, they remain recoverable for a retention window that depends on your plan — 60 days on Creator, 9 months on Pro and 18 months on Business — after which they are permanently deleted.

Before files are deleted we send advance reminder emails (typically 14 days and 3 days beforehand). You may also delete your files at any time from your account, which removes them from active storage.

Voice-overs (generated speech, voice-over scripts and versions of your audio without speech) are stored together with the file they belong to and are deleted with it, under the same rules.

Voice clones follow their own schedule, because a clone is stored in your account rather than with a single file:

• The voice sample and the clone’s consent record are kept until the earliest of: you delete the voice (in the voice-over window, “Delete”), your account is deleted, or 12 months pass without the voice being used. They are then permanently destroyed. In any case we do not keep them longer than the purpose — creating voice-overs you request — requires;
• The voice model at ElevenLabs is created only for the time a voice-over is being generated and is deleted automatically within minutes after it was last used;
• Deleting the file the sample came from does not delete the voice; delete the voice itself to remove it.

9. Cookies and analytics

We use cookies and similar technologies (local storage, pixels) to keep you signed in, remember your preferences, secure the Service and — with your consent — to understand how the Service is used and to measure our advertising.

9.1 Categories we use

• Strictly necessary — session, security (CSRF) and language cookies set by us. They are required for the Service to work, are not used for tracking, and cannot be switched off;
• Analytics — set by PostHog, Microsoft Clarity and Google Analytics 4 to measure how the Service is found and used. Clarity also records anonymised session replays (mouse movement, clicks, scrolling) to help us find usability problems; keystrokes in input fields are not recorded;
• Marketing — set by the Meta (Facebook) Pixel and Google Ads to measure the performance of our advertising and to show more relevant ads. When you sign up or make a purchase after clicking one of our ads, we report that event to the ad platform. To match it to the ad more accurately, Google Ads receives your email address in hashed (irreversibly encoded) form (“enhanced conversions”).

9.2 Your choice

Analytics and marketing technologies are loaded only after you consent. On your first visit a cookie banner asks you to accept all, reject all, or choose categories individually; until you make a choice, no analytics or advertising scripts are loaded and no such cookies are set. Rejecting is exactly as easy as accepting, and nothing about the Service depends on your answer.

Your choice applies to both our website (blablascribe.ai) and the web app (app.blablascribe.ai), so you are asked only once. You can change or withdraw it at any time through the “Cookie settings” link in the footer of every page of the website or in your account settings in the app. Withdrawing consent stops further collection and clears the cookies of the affected providers in your browser; it does not affect processing carried out before you withdrew. Your choice is stored in your browser (a cookie and local storage) for 12 months, after which we ask again; we also ask again when we add a new provider to a category. Clearing your browser storage resets it.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal of analytics and marketing technologies unless you have explicitly chosen otherwise in our cookie settings. For Google Analytics and Google Ads we additionally use Google Consent Mode, so advertising and analytics storage stay disabled until you consent.

You can also block or delete cookies in your browser settings; strictly necessary cookies may then prevent parts of the Service from working.

9.3 Legal basis and transfers

The legal basis for analytics and marketing cookies is your consent (Article 6(1)(a) GDPR and the applicable national implementation of the ePrivacy Directive). Strictly necessary cookies rely on our legitimate interest in providing a secure, working Service. Some of these providers are established outside the EEA; see Section 7 on international transfers.

10. Your rights

Subject to the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time, without affecting processing already carried out — for a voice clone, delete the voice in the voice-over window or ask us to delete it;
• Lodge a complaint with your supervisory authority, in particular the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

You can exercise most rights directly in your account settings, or by contacting [email protected]. We will respond within the timeframe required by law.

11. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and secure storage. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your information and will notify you and the relevant authority of a data breach where required by law.

12. Children

The Service is not intended for children under the age of 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this Policy

We may update this Privacy Policy from time to time, for example to reflect changes in law or in the Service. When we make material changes we will notify you by email or through the Service. The “Last updated” date above shows when the current version took effect. Continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact us

Vindrose sp. z o.o.
ul. Piękna 58c, 50-506 Wrocław, Poland
Email: [email protected]

For privacy requests — access, correction, deletion, portability, objection or withdrawal of consent — write to [email protected] and we will respond within the timeframe required by law.