Who is responsible
Digiplan, Christine d'Haenstraat 16, Bruges, Belgium - VAT BE 1025.952.964 - is the controller for the data described here. Questions, requests and complaints: [email protected]. If our answer does not satisfy you, you may complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be), or to the supervisory authority of the country in which you live.
Recordings
A recording made through the microphone widget is sent to us, transcribed, and discarded within the same request. It is never written to disk and never stored. The audio passes to OpenAI, who return the text and are contractually bound not to retain it or train on it.
What is retained after the request is a record that a transcription took place, when, and for which site. That record is the basis of the invoice. There is no field for the transcribed text, so no transcript of what was said exists to be disclosed, whether by legal process or by accident.
That record also holds the name of the form the microphone was placed in, and the hour on the visitor's own clock at which it was used. No minute and no date are stored. It exists so that a site owner can see that their returns form is used in the evening and their contact form is not. Both values describe the website rather than the visitor: the form name is either one the site owner chose or the page's own address with any identifier removed before it is written down, and an hour of the day is shared by everybody who was awake at the same time.
One further number is kept: how many characters the transcription came to. Not the characters, their count - the difference being that a sentence can be reconstructed from a redacted copy of itself and cannot be reconstructed from the fact that it was six hundred characters long. It is recorded because a site owner is entitled to know whether speaking produces fuller answers than typing does, which is the claim this service is sold on, and a claim of that kind ought to be checkable against their own visitors rather than taken from us.
We do not make voiceprints
Stated explicitly, because it is commonly assumed of a speech service. We do not identify speakers, do not attribute parts of a recording to individual speakers, and do not build a model of anybody's voice. No biometric data is processed for the purpose of identifying a person, so none of this falls within the special categories of Article 9 of the GDPR. That follows from how the service is built rather than from a policy decision that could be reversed.
Text you want spoken
Text sent to the studio is held for as long as it takes to produce the audio and deliver it, and the audio file is kept only until the download link expires. Neither is used for any other purpose and neither is used for training.
If you are a visitor, not a customer
You may have encountered the microphone on a website that is not ours. In that case the site owner decided to install it and is the controller of what you said; we act as their processor and on their instructions. Questions about what happens to the text once it reaches their form should be addressed to them. We retain none of it.
The widget requests the microphone from your browser, and your browser asks you. Nothing is recorded before the button is pressed, and pressing Escape discards a recording before it is sent.
Accounts and payment
Where you purchase something we retain your email address, what was purchased and when. Card details do not reach us: payment is handled by Stripe, who see the card and report only whether the payment succeeded.
Why we are allowed to do any of this
Article 6 of the GDPR requires a legal basis for each processing operation. Performance of our contract with you covers producing your audio, operating your widget, taking payment and providing support. A legal obligation covers retaining invoices for the seven years required by Belgian tax law. Our legitimate interest covers securing the service and preventing abuse: rate limits, fraud checks, and the counting that shows when a key is being used where it should not be. Consent is not relied upon for any of this, because there is nothing here that would require it.
How long things are kept
- Recordings and transcripts - not retained. Discarded before the request completes.
- Text sent for speaking - until the audio has been produced; the audio until its link expires.
- Usage counts - for the billing period, then aggregated into a total with no detail retained.
- Invoices and the email address on them - seven years, as required by tax law.
- Account and site settings - until the account is closed, then thirty days, then deleted.
Who else sees anything
As few parties as possible, and no advertisers. In practice: OpenAI, who carry out the transcription and produce the studio audio; Stripe, for payment; our hosting provider within the European Union; and the service that sends transactional email. That is the complete list. No data is sold, shared, or exchanged for services.
Where it goes
The application runs within the European Union: the site, your account, the widget and the billing all sit on European infrastructure. The transcription itself is performed by OpenAI in the United States, which is the only part of the processing that leaves the European Union, and it is stated here rather than left to a sub-processor list. It takes place under the European Commission's Standard Contractual Clauses, and the audio is not retained there.
Cookies
One session cookie and one security token, both strictly necessary to maintain your session and to prevent a form being submitted on your behalf. There are no analytics that follow you between sites, no advertising cookies and no third-party scripts, and therefore no consent banner, because there is nothing here to consent to.
One further value is held, in that same session and nowhere else. Our customers can share a link stating who recommended us; where you arrive on such a link, the code it carries is kept for the duration of your visit so that the referral can be credited if you register. The same holds for the small link beneath a microphone on a website using our free plan: it names the site you clicked it on, so that the site can be credited with having sent you, and that name is held in the same manner and for the same period. It sets no additional cookie, writes nothing to your device, and is discarded when the browser closes. Nothing about you is recorded either way: the customer sees how many visitors arrived and how many registered, never which ones.
Keeping it safe
All traffic uses HTTPS. Widget keys are public identifiers rather than secrets; they are checked against the domains you have authorised and are subject to fixed caps, so a leaked key results in a cap being reached rather than an unexpected invoice. Access to the servers is limited to the person who operates the service. In the event of a breach of personal data we will notify the supervisory authority within seventy-two hours and notify you without undue delay where you are affected.
Children
AddSpeech is sold to operators of websites and is not directed at children. We do not knowingly hold data relating to anyone under sixteen. If you install the microphone on a site used by children, that decision and the consent required for it are yours; notify us first so that the appropriate agreement can be put in place.
Your rights
You may request a copy of the data we hold, request its correction, request its erasure, request it in a portable format, request a restriction of processing, and object to processing based on legitimate interest. An email is sufficient and there is no form to complete. We will respond within one month, and usually within a day, as there is little to review. No profiling and no automated decision-making producing legal effects is carried out.
Changes
Where this page changes materially, customers are notified by email before the change takes effect rather than after it.