Privacy policy
Draft, last updated [DATE]. Not yet reviewed by a lawyer.
Who is responsible
Jens Louw-Christensen, Myrdalstræde 1E, 9220 Aalborg Øst, Denmark is the data controller. Contact: pantheon3d.contact@gmail.com.
What stays on your device
Your video and audio files, projects you haven’t synced, and fonts you upload are stored in your browser (IndexedDB) and never sent to us. The site, the studio, its code libraries and its fonts are all served from cuecaps.com. The one exception is on-device transcription: when you choose it, your browser downloads the speech model from Hugging Face and the speech-recognition library from jsDelivr, so those two services see your IP address. After the first download the files are cached in your browser. Your audio is not sent to them.
What we process
Account: your email address and, if you sign in with Google, your Google account ID, name and profile picture. Purpose: providing your account (contract, GDPR art. 6(1)(b)).
Cloud transcription: the audio track of files you choose to transcribe in the cloud, compressed to speech quality. It is stored temporarily in a private bucket, sent to ElevenLabs for transcription, and deleted as soon as the result returns. Uploads that are never transcribed are deleted within 24 hours. We keep a usage record (date and seconds of audio) to meter your plan. Purpose: contract.
Synced projects (Creator and Pro): transcript text, word timings, styles, project names and media file names and durations, so you can continue on another device. Never the media itself. Purpose: contract.
Billing: Stripe sells subscriptions as merchant of record and processes your payment details under its own privacy policy. We receive your Stripe customer ID, subscription status, plan and billing country. Purpose: contract and bookkeeping obligations (art. 6(1)(c)).
Usage analytics, only if you allow it: Google Analytics records which pages you visit, how you arrived (for example from a link on another site), your device, browser and approximate location, and a few actions: starting checkout, completing a purchase (plan and price), and transcribing or exporting in the studio (method, format and length, never the content). Google says Google Analytics 4 does not store IP addresses. Purpose: understanding which pages and features help people and where visitors come from. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time. Data is kept for 14 months.
Ad measurement, only if you allow it: when you arrive from one of our Google ads, Google Ads links that click to whether you later sign up or buy, so we can see which ads work. We don’t use this to show you personalised ads or to build advertising audiences. Legal basis: your consent (art. 6(1)(a)).
Bot protection on the sign-in form: Cloudflare Turnstile checks that the email form is used by a person, so it can’t be used to send sign-in emails to strangers. It processes your IP address and technical details about your browser. Legal basis: our legitimate interest in preventing abuse (art. 6(1)(f)).
Technical logs: our hosting provider records IP addresses and request details for security and debugging, kept for a short period. Purpose: legitimate interest in running a secure service (art. 6(1)(f)).
Processors and transfers
We use Supabase (database, sign-in and temporary audio storage, hosted in the EU in Frankfurt), Resend (sends sign-in emails, so it processes your email address; EU region), Vercel (web hosting), Google Ireland Limited (Google Analytics and Google Ads measurement, only with your consent), Cloudflare (bot check on the sign-in form), ElevenLabs (speech-to-text) and Stripe (payments, as independent seller). If you choose “Continue with Google”, Google handles that sign-in under its own privacy policy and shares your Google account ID, name, email address and profile picture with us. Vercel and ElevenLabs are US companies, and Google Analytics data may be processed by Google LLC in the US; transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. ElevenLabs may keep request logs and transcripts under its own terms; its zero-retention mode is only available on enterprise contracts. [UPDATE if you change providers or sign an enterprise agreement.]
How long we keep data
Audio: until transcription finishes, at most 24 hours. Account, usage records and synced projects: until you delete them or your account. Records we must keep for bookkeeping: 5 years under the Danish Bookkeeping Act.
Cookies
Cookies that keep you signed in are necessary for the service and are set without asking. If you click Allow on the cookie banner, Google Analytics sets two more cookies, _ga and _ga_<ID>, which last up to two years and tell repeat visits apart. If you also allow ad measurement, Google may set _gcl_ cookies, which last up to 90 days and connect an ad click to a later sign-up or purchase. Nothing from Google loads before you allow it. Your choice is stored in your browser for 12 months. To change it, use Cookie settings at the bottom of any page; if you withdraw consent, collection stops and we delete those cookies. We don’t use advertising cookies.
Your rights
You can access, correct, export or delete your data, and object to or restrict processing. Delete your account on the account page, or email us for anything else. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).