Privacy Policy
Data Controller
The data controller responsible for processing your personal data is:
This Privacy Policy applies to all users of the Conspexi website and web application at conspexi.com (the "Service" or "Platform"). In this policy, "Conspexi", "we", "us", and "our" refer to the data controller identified above. "You" and "your" refer to the person using the Service.
Data We Collect
We collect only the personal data that is necessary to provide and improve the Service. The categories of data we process are:
Account data
- Email address — used for account creation, login, and service communications
- First and last name — collected when you enter it in your profile settings; used for invoicing
- Billing address — collected when you enter it in your profile settings; used for invoicing
- Password — stored as a cryptographic hash; we never store your password in plain text
Usage & payment data
- Token balance and transaction history — records of tokens consumed and purchased, stored for billing and account management
- Subscription plan — the plan you have purchased
- Activity logs — timestamped records of note creation and token usage; used to display your activity history and prevent abuse
Technical data
- IP address — collected at login and on form submission for security and fraud prevention
- Browser and device information — collected automatically via server logs to diagnose technical issues
- Session cookies — used to keep you logged in (see Section 8)
Purposes & Legal Basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Email, name, password | Contract — Art. 6(1)(b) |
| Processing audio files and generating notes | Uploaded audio, note text, chosen settings | Contract — Art. 6(1)(b) |
| Billing and subscription management | Email, transaction history, billing address | Contract — Art. 6(1)(b) |
| Sending transactional emails (password reset, subscription confirmation) | Email address | Contract — Art. 6(1)(b) |
| Security, fraud prevention, abuse detection | IP address, activity logs | Legitimate interest — Art. 6(1)(f) |
| Compliance with legal obligations (e.g. tax records) | Transaction history, billing address | Legal obligation — Art. 6(1)(c) |
| Service improvement and analytics (aggregate, anonymised) | Anonymised usage statistics | Legitimate interest — Art. 6(1)(f) |
| Support access to notes — when you contact support, authorised Conspexi employees may access your notes and account data to diagnose and resolve your issue | Notes, transcripts, account data, support correspondence | Contract — Art. 6(1)(b) |
Audio & Note Data
When you upload an audio or video file, the file is transmitted to our servers and forwarded to a third-party AI speech recognition service to generate a transcript. The resulting transcript is then processed by an AI summarisation model to produce your notes. Both the transcript and the notes are stored in your account.
- Audio files are not permanently stored after processing is complete. They are deleted from our servers as soon as the transcription step finishes.
- The generated notes and transcript text are stored in your account for as long as you keep them, or until you delete your account.
- Any custom instructions (comments) you provide when uploading are stored as part of the note in your account and retained for as long as that note exists.
Support Access to Your Notes
When you contact Conspexi, you allow authorised Conspexi employees to access your notes, transcripts, and relevant account data to investigate and resolve your reported issue.
Please be mindful of what you upload. Do not upload audio that contains sensitive special-category data (e.g. health information, racial or ethnic origin, political opinions) unless you understand the implications. We do not knowingly process special-category data and have no specific legal basis to do so.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with a legal obligation.
| Data category | Retention period | Reason |
|---|---|---|
| Account data (email, password) | Until account deletion + 30 days | Accidental deletion recovery window |
| Uploaded audio files | Deleted immediately after processing | Not required after transcription |
| Notes and transcripts | Until you delete them or your account | Core service functionality |
| Transaction & billing records | 7 years from transaction date | Legal obligation (tax law) |
| Activity logs | Until account deletion | Security and abuse prevention |
| Server / access logs | 90 days | Technical diagnostics |
When data is deleted, it is removed from active systems and from backups within 90 days.
Your Rights
As a data subject in the EU/EEA, you have the following rights under the GDPR. You may exercise any of these rights free of charge by contacting us at contact@conspexi.com.
Right of Access
You can request a copy of all personal data we hold about you, including what it is, why we process it, and who we share it with.
Right to Rectification
You can ask us to correct inaccurate personal data or complete incomplete data at any time.
Right to Erasure
You can request deletion of your personal data ("right to be forgotten"). Exceptions apply where we have a legal obligation to retain data.
Right to Restriction
You can ask us to pause processing of your data in certain circumstances, for example while a dispute is being resolved.
Right to Object
You can object at any time to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
Security
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure, These measures include:
- All data in transit is encrypted
- Passwords are stored using a one-way cryptographic hash
- Access to production systems and databases is restricted to authorised personnel only
- Audio files are deleted from our servers after processing
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and will inform affected users without undue delay if required.
Children
The Service is not directed at persons under the age of 18. You must be at least 18 years old to create an account and use the Service. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at contact@conspexi.com and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are significant, we will notify you by email and/or by a prominent notice on the Service at least 14 days before the changes take effect.
Your continued use of the Service after the effective date of the updated policy constitutes your acknowledgement of the changes. If you do not agree with the updated policy, you may delete your account at any time.
Contact & Complaints
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our data protection contact point:
Data Protection Contact
Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority in the EU Member State where you live, work, or where the alleged infringement occurred.