Privacy Policy

1. Information we collect

Information you provide

• Account information. Your email address, display name, and password (stored as a one-way hash, never in plain text) when you create an account.
• Authentication data. If you sign in with Apple or Google via Firebase Authentication, we receive your name and email as provided by the identity provider.
• Audio and video files. The recordings you upload or record in the app for transcription. These may include the voices of meeting attendees, clients, and other participants.
• Transcript and meeting data. Titles you assign, company names, notes, generated transcripts with speaker labels, AI-generated summaries, action items, and formal minutes.
• Chat messages. The questions you ask and responses you receive when chatting with your transcripts.
• Waitlist information. Your email address (and optionally your name) if you join our waitlist before creating an account.
• Subscription information. Your subscription tier and status, managed through our payment provider.

Information collected automatically

• Usage data. The number and duration of transcriptions you process, used to enforce plan limits and bill correctly.
• Device and technical data. IP address, device type, operating system, and app version, collected in server logs for security and troubleshooting.

2. How we use your information

• To provide the Service — transcribing your audio, identifying speakers, generating minutes, and powering AI chat.
• To create and manage your account and authenticate you across devices.
• To sync your transcripts and minutes across your devices via cloud storage.
• To track usage against your plan's limits and process subscription payments.
• To send you service-related emails (verification codes, password resets, and important account notices).
• To maintain and improve the Service, including debugging and resolving technical issues.
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with our legal obligations.

We do not sell your personal information or your audio content to anyone.

3. Third-party services

We rely on trusted third-party providers to deliver the Service. Each provider processes data only as needed to perform their function, under their own privacy policies.

• Amazon Web Services (S3). Stores your uploaded audio files, generated transcripts, and exported PDFs. Data is stored in the EU (Ireland) region.
• AssemblyAI. Processes your audio to produce transcripts with speaker diarization. Audio is sent to AssemblyAI for transcription and returned as text.
• Mistral AI. Powers the AI chat feature that lets you ask questions about your transcripts.
• DeepSeek. Generates structured meeting minutes, summaries, and action items from your transcripts.
• Google Firebase. Provides authentication when you sign in with Apple or Google.
• RevenueCat. Manages subscription billing and entitlements for in-app purchases.
• Email delivery. Used to send verification codes, password resets, and account notifications.

4. Data storage & location

Your account data and transcripts are stored in a PostgreSQL database hosted in the EU (Ireland) region on Amazon Web Services. Your uploaded audio files and generated PDFs are stored in AWS S3 in the same region. Data is encrypted at rest using AWS-managed encryption (AES-256) and in transit using TLS.

5. Data retention

• Audio files. Raw audio files are automatically deleted 30 days after transcription completes. The transcript text and minutes are retained so you can continue to access them.
• Transcripts & minutes. If you enable the "auto-delete" setting in your account, your transcripts and minutes are deleted after 30 days. If auto-delete is off, they are retained until you delete them manually.
• Chat sessions. Retained until you delete them from the app.
• Account data. Retained for as long as your account is active. You can request deletion at any time (see Your rights).
• Waitlist data. Your email is retained until you ask us to remove it or until you create an account, at which point it is associated with your account.
• Server logs. Retained for up to 90 days for security and troubleshooting.

6. AI processing

CosecScribe uses AI models to transcribe your audio, identify speakers, generate summaries and minutes, and answer your questions. When you submit audio for transcription, it is sent to AssemblyAI for processing. When you use AI chat or generate minutes, the relevant transcript text is sent to our LLM providers (Mistral AI and DeepSeek). We share only the data needed to perform the requested function.

We do not use your audio or transcripts to train AI models. Our providers' use of your data is governed by their respective terms and privacy policies, which we encourage you to review.

7. Security

We take reasonable measures to protect your data: encryption in transit (TLS) and at rest (AES-256), hashed passwords, scoped IAM credentials, and access controls on our infrastructure. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard practices.

In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

8. Your rights & choices

Depending on where you live, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete information.
• Erasure. Request that we delete your account and associated data.
• Restriction. Ask us to limit how we use your data in certain circumstances.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to certain processing of your data.
• Withdrawal of consent. Where processing is based on consent, withdraw it at any time.

You can delete individual transcripts and chat sessions directly in the app at any time. To delete your entire account or exercise any of the rights above, email us at hello@cosecscribe.com. We will respond within 30 days.

If you are in the UK or EU and you believe we have not handled your data correctly, you have the right to complain to your local data protection authority — for example, the UK Information Commissioner's Officeor your national supervisory authority under the GDPR.

9. Children's privacy

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. International data transfers

Your data is stored and processed in the EU (Ireland) region on AWS. However, our third-party AI and authentication providers may process data in their own infrastructure, which could be located outside the EU/UK. We rely on appropriate safeguards, including the EU Standard Contractual Clauses where applicable, to ensure your data is protected when transferred internationally.

11. Cookies

Our website uses minimal cookies and does not use advertising or tracking cookies. We do not use analytics or advertising networks on the website. Any cookies used are strictly necessary for the site to function. The mobile apps do not use cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you via email or in-app notice. We encourage you to review this page periodically.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Email: hello@cosecscribe.com
Website: cosecscribe.com