Legal
Privacy policy
1. Who is responsible
Applifyer, LLC (131 Continental Dr, Suite 305, Newark, DE 19713, USA) runs Fjalim. Our role depends on the data:
- Controller for your account data and our own records (sign-in, billing, support, security).
- Processor for the audio, video and transcripts you send us. You decide why and how they are processed, and we process them on your instructions. We will sign a data processing agreement on request.
2. What we process
| Data | Details | Why |
|---|---|---|
| Account data | Email address, name (optional), language, password hash, API key hashes, sign-in sessions (IP address and browser identifier) | To run your account and keep it secure |
| Billing data | Purchases, credit balance and usage ledger. Card details go to Stripe and never reach us. | To charge, to bill usage and to keep accounting records |
| Your audio and transcripts | Uploaded files, transcript versions, file names, and the metadata you add | To provide the transcription service |
| Trial data | The audio you try, a trial token hash, and a salted hash of your IP address | To run the free trial and limit abuse |
| Free-trial human check | Your IP address and browser signals, processed by Cloudflare Turnstile on the trial form. We receive only a pass-or-fail token. | To stop automated abuse of the free trial |
| Support messages | What you write to us and our replies | To help you |
| Technical logs | Request logs with IP address, time and errors | Security and fixing faults |
Cloudflare Turnstile. The free-trial form can use Cloudflare Turnstile to tell people from automated bots. When it is switched on, the home page loads a script from Cloudflare (challenges.cloudflare.com). Purpose: preventing abuse of the free trial. Provider: Cloudflare. Legal basis: our legitimate interest in keeping the free trial from being abused (GDPR 6(1)(f)). It loads only on the free-trial form on the home page, and on no other page. See also the cookies page.
3. Legal bases (GDPR Article 6)
- Contract (6(1)(b)): your account, credit, and transcription requests.
- Legitimate interests (6(1)(f)): security, preventing abuse and rate limiting, the Cloudflare Turnstile check on the free trial, and improving reliability.
- Legal obligation (6(1)(c)): keeping accounting records.
- Consent (6(1)(a)): only if you ever allow us to use your audio to improve our models. We do not do this without your permission, and you can withdraw consent at any time.
4. Who helps us (subprocessors)
- Cloudflare: website hosting, object storage for audio, the compute that runs the transcription model, and Turnstile, the abuse check on the free-trial form, loaded only there.
- Google Cloud: the database for transcripts and account data, in Belgium.
- Stripe: payment processing and invoices. May process data outside the EU.
- Resend: sending account and security emails. May process data outside the EU.
We choose providers that offer a data processing agreement. We will update this list before we add a new one.
5. Where data is processed
Audio and transcripts are stored in the EU: audio files in Cloudflare storage, and transcripts and account data in a Google Cloud database in Belgium. Transcription runs on servers in the EU.
Website delivery (Cloudflare, including Turnstile on the free-trial form), payments (Stripe) and email (Resend) may involve processing outside the EU. Where personal data leaves the EU, the provider processes it under the standard contractual clauses approved by the European Commission, or under an adequacy decision.
6. How long we keep data
Audio is kept for up to 365 days and transcripts for 365 days after creation, and you can delete them at any time. Trial audio and transcripts are deleted after 24 hours. The full table is on the data retention page.
7. Your rights
Under the GDPR you can ask us to give you access to your data, correct it, delete it, restrict its use, give it to you in a portable format, or stop using it on the basis of our legitimate interests. You can withdraw consent at any time.
For audio and transcripts, where we are the processor, we will help you answer requests from the people in your recordings.
Write to [email protected]. We answer within one month. You can also complain to your data protection authority.
8. Security
Connections use TLS. Passwords are stored as salted scrypt hashes and API keys as hashes, so we cannot read them. Uploads go to private storage and are served only through short-lived signed links. Access to production data is limited to people who need it. To report a vulnerability, write to [email protected].
9. Children
Fjalim is not meant for children, and we do not knowingly collect their account data.
10. Changes and contact
We will post changes here and email account holders about material ones. Data protection contact: [email protected]. General contact: [email protected]. Postal address: Applifyer, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.