Privacy Policy

1. Who is responsible

Ratkomo Development Oy is the controller responsible for the personal data processing described here.

This policy covers our website and app, including staging and testing environments. Paddle separately handles purchase data as explained below. If you appear in someone else’s recording, you can contact us even if you do not have an account.

2. Data we handle

• Account data: your account identifier, email address, verification status, sign-in method, account activity and settings. Google or Firebase may also hold profile information provided during sign-in. Password authentication is handled by Firebase; our application database does not store your password.
• Session content: uploaded audio or video, file names, duration, language, campaign and character names, optional player names and character descriptions, context you provide, transcripts and speaker labels, generated titles and recaps, edit instructions, and saved output versions. Recordings and text may include information about other participants.
• Processing and usage data: job status, provider request identifiers, timing, errors, AI usage, credit reservations and deductions, and trial eligibility. We retain a hash derived from a normalized email address to help prevent repeated free trials. That hash is pseudonymous data, not a guarantee of anonymity.
• Purchase data: Paddle customer and transaction references, product and price details, amounts, currency, tax and payment status, credit grants, refunds and payment notifications. These notifications may include billing contact or payment-method information. We do not store full payment card numbers or card security codes.
• Support and feedback: your messages, contact details, selected feedback categories, permission to contact you, and any separate permission to use a testimonial.
• Website and security data: request information such as IP address, browser and device information, access and error events, and the limited analytics described below.

We receive this information from you, other users who upload recordings or name participants, authentication and payment providers, and automatically as the service operates. Providing account details and content is necessary for the relevant features; optional feedback and testimonial permission are not required to use the service.

3. Purposes and legal bases

Under the EU General Data Protection Regulation (GDPR), we rely on the following bases as applicable to each activity:

We do not ask you to consent to all processing merely by reading this policy. The service is not intended to collect sensitive real-world information such as health records, biometric identification data or criminal records. Do not deliberately upload that material. A speaker label in a transcript is used to distinguish turns in a conversation; we do not use it to verify a person’s identity.

4. Service providers and sharing

We use the following providers for the functions described. They receive the information needed for their role, rather than each receiving your entire account.

Authorized personnel may access data to operate the service, respond to support requests, investigate abuse or comply with law. We may also disclose necessary information to professional advisers, authorities or other parties when legally required or necessary to protect rights. If the business is transferred, relevant data may transfer with it, subject to applicable law and notice where required.

We do not sell your personal data or make private recordings and recaps publicly searchable. If you copy or share an output yourself, the recipient’s handling of it is outside our control.

5. AI training and provider retention

AssemblyAI: we have disabled model-training data sharing and enabled its available retention controls for our account. We also request deletion of the provider transcript after saving it in SummaryWizard. Processing and deletion can take time; provider operational, security or legally required records may have separate retention rules.

Anthropic: we use the commercial API. Its Commercial Terms prohibit training models on customer content. We use standard API retention, not a special zero-retention agreement. Anthropic states that API inputs and outputs are ordinarily deleted within 30 days, with exceptions such as safety enforcement, legal requirements or features with different retention terms. See its API retention explanation.

Deleting your SummaryWizard account does not instantly erase every provider security record or backup. The retention periods and exceptions below also apply.

6. Analytics and browser storage

We use Umami Cloud to understand page visits and product usage. Its standard analytics includes the page path and title, referring site, browser, operating system, device or screen characteristics, language and approximate location derived from the request. Our tracker excludes the page URL’s query string and fragment. We do not intentionally send your email, recordings, transcripts or recap text as analytics events, or identify analytics visitors with your account ID.

Umami’s standard tracker does not use analytics cookies. It processes request information, including IP address and user agent, to derive a rotating visitor identifier and approximate location. That is different from saying no personal data is ever processed. See Umami’s Privacy Policy. You can contact us to object to analytics processing, and browser tracking protections may block its script.

Firebase and the app use browser storage to keep you signed in and remember necessary session state. Google sign-in and Paddle checkout may use their own cookies or similar storage for authentication, payments and fraud prevention. Blocking necessary storage may prevent these features from working. We currently use no advertising trackers and send no marketing email campaigns; account verification, password resets, support replies and necessary service notices are different from marketing.

7. Retention and deletion

We keep data for the purpose described, then delete or anonymize it unless a legal obligation or justified need requires retention. Different kinds of data have different lifecycles:

• Uploaded recordings: temporary audio is normally deleted after its transcript has been safely saved. Failed or abandoned uploads are eligible for cleanup after 24 hours; active processing is excluded from that cleanup. A seven-day storage lifecycle provides a fallback for temporary audio. Cleanup failures are retried, so deletion is not instantaneous.
• Saved session content: transcripts, recaps, campaign context and edit history are retained to provide your account library. Deleting a session from the library currently hides it; it does not immediately erase all stored copies. To request erasure, use account deletion or contact support and identify the session.
• Account deletion: request it through Account settings where available or by email. We verify the request, stop account access and arrange deletion of account content, stored uploads, transcripts, recaps and feedback. Some cleanup runs in the background and may be delayed by in-flight work or a provider failure. Records needed for accounting, payment disputes, security, legal claims or enforcing trial limits may remain, with use restricted to those purposes.
• Database recovery and manual content backups: Cloudflare D1’s paid-plan Time Travel window is up to 30 days, so an earlier copy may remain recoverable for up to 30 days after deletion from the live database. Our policy for separate manual backups containing user content is a maximum of 30 days from creation. These copies are restricted to recovery; if restored, applicable deletion requests must be reapplied. A specific legal preservation obligation may require an exception.
• Billing and accounting: we retain records for the statutory period. Under Finnish accounting law, transaction vouchers and related correspondence generally require at least six years from the end of the calendar year in which the financial year ended; financial statements and accounting books generally require ten years from the end of the financial year. Only records belonging to those categories need those periods. Other legal obligations or unresolved disputes may require longer retention. Paddle has its own retention responsibilities.
• Support, security and abuse-prevention records: retained as needed to resolve the request, investigate an incident, prevent repeated abuse or establish or defend claims. We consider the issue’s status, relevant limitation periods and continuing security need. Minimal deletion records and trial-eligibility hashes may remain after account closure; this does not require keeping your recording or recap library.

Deleting a Firebase sign-in alone does not necessarily erase all application or payment records. Use the SummaryWizard deletion process or contact us so that we can address the relevant systems. AI provider retention is described above. A deletion request does not remove records that we must lawfully retain, and we will explain relevant exceptions when responding.

8. International processing

We are based in Finland, but our providers operate internationally. Your data may be processed outside Finland and the European Economic Area, including in the United States. We do not promise EU-only storage or processing.

Where GDPR requires safeguards for a transfer, the transfer must be supported by an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with any additional measures required for the circumstances. Contact us for information about the arrangements applicable to your data and how to obtain a copy of relevant safeguards.

9. Security and access

Campaign sharing is off by default. If you enable link sharing, anyone with a campaign link can view its saved overview and completed session recaps, including future completed sessions. A session link allows viewing that session only. Shared pages do not expose recordings, transcripts, campaign settings or account and billing details, but recap text can contain names or other personal information. Shared pages do not load our analytics. You can disable sharing or regenerate all links to stop future access through old links; this cannot remove copies already made by recipients.

We use measures including encrypted connections, authenticated requests, checks that an account owns the requested campaign or session, private file storage and restricted administrative access. In-app administrative access to private session content requires a recorded reason and an audit entry. These measures do not make the service end-to-end encrypted: our systems and AI providers must process readable content to produce your results.

No system can guarantee absolute security. Protect your account, avoid uploading unnecessary sensitive information, and contact support if you suspect a security problem.

10. Your rights

Depending on applicable law and the circumstances, you can ask to access or correct your personal data, erase it, restrict processing, receive portable data, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier processing. These rights have legal conditions and exceptions.

Send requests to support@summarywizard.com. We may ask for proportionate information to verify your identity and locate the data, while protecting other people’s information. We normally respond within one month as required by GDPR; if a permitted extension is necessary, we will explain it.

You may complain to the Office of the Data Protection Ombudsman in Finland or to the competent supervisory authority in your country, including where you live or work in the EEA. You do not have to contact us first.

11. Participants and children

Accounts are for people aged 18 and over. Adult uploaders must inform everyone recorded and obtain permission for recording and AI processing, including any required parent or guardian permission for a minor. We do not knowingly offer accounts to children.

If someone uploaded a recording containing your personal data and you have a concern, contact us with enough context to find it, such as the uploader, approximate session date and relevant passage. Do not send more sensitive information than necessary. We will consider your request and the rights of other people involved.

12. Policy updates

We will update this policy when our practices or legal requirements change. The date above identifies the current version. We will provide additional notice of material changes where appropriate and obtain consent where a change requires it by law.