SPOKEN DIARY — Privacy Policy

Introduction

At Spoken Diary, privacy is not a compliance checkbox — it is a product requirement. Your diary entries, voice recordings, and family photos are among the most personal data you will ever share with any service. This Privacy Policy explains precisely what we collect, why we collect it, who we share it with, and what rights you have over it.

This policy is written to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening Gegevensbescherming, “UAVG”), and other applicable Dutch and EU law.

1. What Data We Collect and Why

We only collect data that is necessary to provide the Services. Below is a complete account of what we collect, the legal basis under GDPR Article 6 (and Article 9 where special categories are involved), and the purpose.

Account data

Voice recordings

Transcripts and AI-generated diary entries

Photos and images

Subscription and billing data

Messaging integration metadata

Service communications

Crash reports and diagnostic data

What we do not collect

We do not collect:

• Location data beyond what you voluntarily include in a diary entry
• Health or fitness data
• Browsing behaviour or advertising identifiers
• Data from your device's contacts, camera roll, or microphone except when you actively use those features within the app

2. What We Do Not Do With Your Data

We want to be explicit about what we will never do:

• We will never sell your personal data to any third party, under any circumstances.
• We will never use your User Content — voice recordings, transcripts, diary entries, or photos — to train, fine-tune, or benchmark any AI or machine-learning model, our own or our providers', without your separate and affirmative consent. This consent will always be requested through a standalone mechanism, never bundled with Terms acceptance or any other consent.
• We will never serve you targeted advertising based on the content of your diary entries.
• We will never share your diary content with other users or make it publicly accessible.

3. Sub-processors: Who Processes Your Data on Our Behalf

We engage the following third-party service providers as data processors. We have entered into a Data Processing Agreement (DPA) with each provider listed below, including Standard Contractual Clauses (SCCs) where applicable for transfers outside the EEA. These DPAs prohibit providers from using your data for any purpose other than providing their service to us, and specifically prohibit using your content to train AI models. We maintain a private register of executed DPAs and are happy to confirm any specific provider's DPA on request to [email protected].

All AI providers listed below are incorporated in the United States. Data transfers to them are governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR. See Section 5 for details.

We will update this sub-processor list when we add or change providers. Where a new sub-processor involves a material change to how your data is processed, we will notify you in advance.

4. Legal Bases for Processing — Summary

Data category	Legal basis
Account data	Contract (Art. 6(1)(b))
Voice recordings	Contract (Art. 6(1)(b)) + Explicit consent for special-category content (Art. 9(2)(a))
Transcripts and AI outputs	Contract (Art. 6(1)(b))
Photos	Contract (Art. 6(1)(b)) + Explicit consent where sensitive content
Billing records	Contract + Legal obligation (Art. 6(1)(c))
Messaging metadata	Contract (Art. 6(1)(b))
Service communications	Contract + Legitimate interest (Art. 6(1)(f))

We do not rely on legitimate interest as a legal basis for processing your diary content under any circumstances.

5. International Data Transfers

Our core infrastructure (Supabase/AWS) is configured to store data within the EU. However, OpenAI, Anthropic, Google, Deepgram, Groq, and Sentry are US-based companies. When your voice recordings or transcripts are sent to these providers for processing, personal data is transferred to the United States.

The United States does not have a blanket EU adequacy decision covering these providers. We protect these transfers by relying on Standard Contractual Clauses (SCCs) — the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission on 4 June 2021 (Decision 2021/914). We have executed SCCs with each of these providers as part of our Data Processing Agreements.

You may request a copy of the relevant SCCs by contacting us at [email protected].

6. Data Retention

We keep your data for as long as your account is active and for 30 days after account closure, regardless of the reason for closure. During this 30-day period, you may request a copy of your personal data in a structured, commonly used, machine-readable format at any time by contacting [email protected].

At the end of the 30-day period, your User Content — voice recordings, transcripts, diary entries, photos, and generated outputs — is permanently and irreversibly deleted from our systems and those of our sub-processors.

The following data is retained for longer where required by law:

• Transaction records (subscription payments, invoices): 7 years, as required by Dutch tax law (Belastingdienst record-keeping obligations).
• Legal correspondence: Retained as long as necessary to defend or pursue legal claims.

If you submit a deletion request before the 30-day period expires, we will delete your User Content within 30 days of receiving the request, subject to the legal retention obligations above.

7. Children's Data

Our Services are not directed at children under 16. We do not knowingly collect personal data directly from children under 16.

However, our Services are used by parents and caregivers who create diary entries about their children, including uploading photos and recording stories that reference children's personal information. In this context:

• The account holder (parent or guardian) is the data subject for GDPR purposes, not the child.
• Photos and recordings of children uploaded by account holders are processed under the account holder's explicit consent and their representation that they have lawful authority to upload such content.
• We apply heightened care to any content that obviously involves minors. We do not use photos of children for any purpose beyond rendering them in your diary entries and printed books.
• If you believe a child's data has been uploaded without appropriate authority, please contact us at [email protected] and we will act promptly.

8. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights. You can exercise any of them by contacting us at [email protected].

Right of access (Article 15)

You can request a copy of all personal data we hold about you, including your voice recordings, transcripts, diary entries, and account data.

Right to rectification (Article 16)

You can correct inaccurate personal data. For diary content, you can edit entries directly within the app.

Right to erasure (Article 17)

You can request deletion of your personal data. We will delete your User Content within 30 days, subject to legal retention obligations. You can also delete individual entries or your entire account at any time within the app.

Right to restriction (Article 18)

You can ask us to restrict processing of your data in certain circumstances, for example while a complaint is being resolved.

Right to data portability (Article 20)

You can request your personal data in a structured, commonly used, machine-readable format (JSON and/or PDF). This right applies to data you have provided to us and that we process on the basis of contract or consent. You can also use the in-app export feature at any time.

Right to object (Article 21)

You can object to processing based on legitimate interest. We do not rely on legitimate interest for processing your diary content, so this right is most relevant to service communications.

Right to withdraw consent

Where we process data on the basis of your consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) at https://autoriteitpersoonsgegevens.nl, or with the supervisory authority in your EU member state of residence.

We will respond to all rights requests within 30 days. In complex cases we may extend this by a further 60 days, in which case we will notify you of the extension and the reason.

9. Security

We implement the following technical and organisational measures to protect your personal data:

• Encryption at rest: All data stored in Supabase/AWS is encrypted using AES-256.
• Encryption in transit: All data transmitted between your device, our servers, and our sub-processors uses TLS 1.2 or higher.
• Access controls: Access to production systems is restricted to authorised personnel on a strict need-to-know basis. We do not access, read, or review the content of your diary entries, recordings, or photos in the ordinary course of operating the service. In the rare event that a technical issue requires investigation at the data level, access would only occur with your explicit request and would be limited to what is strictly necessary to resolve the issue.
• Sub-processor controls: All sub-processors are contractually required to implement equivalent technical and organisational security measures.
• Breach notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and affected users without undue delay, as required by GDPR Articles 33 and 34.

No system is completely secure. We encourage you to use the in-app export feature regularly as your own backup.

10. Cookies and Tracking

We use only technically necessary cookies and local storage required to operate the app and maintain your session. We do not use advertising cookies, cross-site tracking, or analytics cookies at this time.

If we introduce analytics tools or non-essential cookies in the future, we will update this policy and seek your consent before placing them.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes — including changes to sub-processors, legal bases, or retention periods — we will notify you by email at least 30 days before the change takes effect. The “Last updated” date at the top of this policy reflects the most recent version.

Your continued use of the Services after the effective date of an updated policy constitutes acceptance of the changes. If you do not accept the changes, you may close your account and request deletion of your data before they take effect.

12. Contact and Complaints

For any privacy-related questions, rights requests, or complaints:

For disputes you can also use the EU Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr/.

If you are unsatisfied with our response, you have the right to escalate to the Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl.