Saytype — Privacy Policy
Draft — not legal advice. Review by counsel before publication.
Open items before publication: effective/updated dates; the support address (
support@saytype.dev— email routing to be enabled); appointment of EU and UK representatives under GDPR Art. 27; the name(s) of the large-language-model provider(s) in Section 4.
Last updated: [DATE] · Effective date: [DATE]
Mediio Co., Ltd. (주식회사 메디오) ("Mediio," "we," "us," "our"), which operates the Saytype service, is the controller of personal data processed in connection with the Saytype dictation application and related websites and services (the "Service"). This Privacy Policy explains what data we collect, why, how long we keep it, who processes it, and the rights you have — including rights under the EU/UK GDPR and the California Consumer Privacy Act (CCPA, as amended by the CPRA).
Controller / contact
- Controller: Mediio Co., Ltd. (주식회사 메디오), 6-1, Gukhoe-daero 36-gil, Yeongdeungpo-gu, Seoul, Republic of Korea
- Contact: support@saytype.dev
- EU representative (Art. 27 GDPR): to be appointed before publication
- UK representative (Art. 27 UK GDPR): to be appointed before publication
We have no establishment in the EU/EEA or the UK. Under Article 27 GDPR / UK GDPR we must designate a representative in each territory before offering the Service there, and the appointment is in progress. Until a representative is appointed, EU/EEA and UK data subjects and supervisory authorities may contact us directly at support@saytype.dev, and we will respond without undue delay.
1. Data We Collect
1.1 Account data
When you create an account (e.g., via Google sign-in or email), we collect: a unique account identifier, email address, and profile name (and profile photo URL where the sign-in provider supplies it). We do not collect government ID numbers or other special-category data.
1.2 Subscription and payment data
Purchases are processed by PayPal Holdings, Inc. (including credit/debit card payments made through the PayPal checkout, where offered). We receive and store transaction records (payment method type, approval/reference IDs, amount, date, subscription status) needed to operate your subscription, apply quotas, and handle refunds. We do not store your full card number.
1.3 Usage and technical data
To provide and secure the Service, we collect: dictation usage time (seconds), session timestamps, app version, operating system type (macOS/Windows), IP address, device/compatibility diagnostics, and error logs. We use this to measure your allowance, detect abuse, and diagnose problems.
1.4 Audio and transcripts — how voice data works
- While dictation is active, your microphone audio is streamed in real time to our speech-to-text (STT) processor (Soniox) solely to produce the transcription.
- Audio is not stored after transcription — it is processed transiently and discarded. It is not used to train AI or machine-learning models, by us or by our STT processor (contractually committed).
- The resulting text is typed directly into the application on your computer. We do not collect or store your transcripts on our servers.
- Because the audio passes through our STT processor, what you dictate while dictation is active is technically processed. Do not dictate information you would not want processed for transcription, and obtain any consents required by law (e.g., for recording other speakers) — see our Terms of Service.
- Optional text-refinement features (e.g., polishing selected text) send only the text you explicitly submit to our LLM provider for processing, transiently, and not for model training.
1.5 Voice profiles (not active in the Global edition)
Some regional editions of the app include an optional on-device "my voice" speaker-gate feature. In the Saytype Global edition this feature is disabled, and we do not create, collect, or process voiceprints or biometric templates. If this changes, we will update this Policy, provide separate notice, and obtain any consent required by law before enabling it.
1.6 Support and communications
If you contact support or submit feedback, we process the content of your message, your contact details, and any attachments you choose to include (e.g., screenshots — do not include sensitive data you do not wish to share).
2. Purposes and Legal Bases (GDPR Art. 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service; account management; authentication | Account data | Performance of a contract (Art. 6(1)(b)) |
| Process payments, subscriptions, refunds, invoicing | Payment/transaction data | Performance of a contract (Art. 6(1)(b)); legal obligation for tax/accounting records (Art. 6(1)(c)) |
| Real-time speech-to-text | Audio (transient, not stored) | Performance of a contract (Art. 6(1)(b)) |
| Measure and enforce usage allowances; prevent fraud and abuse | Usage data | Performance of a contract (Art. 6(1)(b)); legitimate interests — service integrity (Art. 6(1)(f)) |
| Diagnose errors, maintain security and stability | Logs, technical data | Legitimate interests (Art. 6(1)(f)) |
| Respond to support requests | Support correspondence | Legitimate interests / contract (Art. 6(1)(f), (b)) |
| Service notices (billing, terms/privacy changes) | Contract / legal obligation (Art. 6(1)(b), (c)) | |
| Marketing emails (only where opted in or permitted) | Consent (Art. 6(1)(a)) / legitimate interests where permitted for existing customers, with opt-out |
We do not sell your personal data, and we do not use it for automated decision-making producing legal or similarly significant effects (GDPR Art. 22), except usage metering strictly necessary to perform the contract.
3. Retention
- Account data: for the life of the account; deleted upon account deletion request (subject to statutory retention below).
- Audio: not retained — discarded immediately after transcription.
- Transcripts: not collected or stored on our servers.
- Payment/transaction records: retained as required by Korean tax/accounting law (typically 5 years for contract/payment records; 3 years for complaint/dispute records) and equivalent obligations elsewhere.
- Usage data and logs: for the life of the account, and up to [3] months for security/connection logs; longer where needed for ongoing fraud investigation or legal claims.
- Support correspondence: [3] years from resolution.
When retention periods end, data is deleted or irreversibly anonymized.
4. Service Providers (Data Processors)
We engage the following processors, under data-processing agreements limiting use to the services they provide to us:
| Processor | Role | Data |
|---|---|---|
| Soniox, Inc. | Speech-to-text transcription | Transient audio stream during active dictation (not retained; not used for training) |
| Cloudflare, Inc. | Hosting, database (D1), object storage, CDN, email infrastructure | Account data, usage/billing records, logs, support attachments |
| PayPal Holdings, Inc. | Payment processing (PayPal balance, cards, and other methods offered in the PayPal checkout) | Transaction data |
| Large-language-model provider(s) (optional text refinement) | Optional text refinement and term extraction, on explicit user action | The text you submit (transient; not used for training) |
Each provider processes data under contract and applicable data-protection terms. Where a provider acts as an independent controller of your payment data (e.g., PayPal), its own privacy policy also applies.
5. International Transfers
We are based in the Republic of Korea, and our infrastructure is global (Cloudflare). Your personal data may be transferred to and processed in Korea, the United States, and other countries.
- The European Commission has adopted an adequacy decision for the Republic of Korea (2021), so transfers from the EEA to Korea do not require additional safeguards.
- For transfers to countries without an adequacy decision (e.g., the United States), we rely on Standard Contractual Clauses (EU 2021/914; UK Addendum for the UK) and/or the UK International Data Transfer Addendum, supplemented by technical measures (encryption in transit and at rest, access controls). Transfers subject to the EU–US Data Privacy Framework rely on the recipient's DPF certification where applicable.
- Copies of the applicable transfer safeguards are available on request (see Section 9).
6. Your Rights
6.1 GDPR (EU/UK) — Articles 15–22
Subject to applicable law, you have the right to:
- Access (Art. 15): obtain a copy of your personal data and information about its processing;
- Rectification (Art. 16): correct inaccurate or incomplete data;
- Erasure (Art. 17): request deletion of your data ("right to be forgotten");
- Restriction (Art. 18): limit processing in specified cases;
- Data portability (Art. 20): receive your data in a structured, machine-readable format;
- Object (Art. 21): object to processing based on legitimate interests, including profiling, and to direct marketing at any time;
- Withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it without affecting prior lawful processing;
- Not be subject to solely automated decisions (Art. 22): as described in Section 2.
To exercise a right, email support@saytype.dev. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity. You also have the right to lodge a complaint with your local data protection authority.
6.2 CCPA/CPRA (California residents)
- Right to know / access: request the categories and specific pieces of personal information we have collected, sources, purposes, and third parties/shared-with details (last 12 months).
- Right to delete: request deletion of your personal information, subject to legal exceptions.
- Right to correct: request correction of inaccurate personal information.
- Right to opt out of sale/sharing: we do not sell personal information and we do not share it for cross-context behavioral advertising. No opt-out is necessary.
- Right to limit use of sensitive personal information: we do not use or disclose sensitive personal information beyond permitted purposes; audio is processed only transiently to perform the transcription you request.
- Non-discrimination: we will not discriminate against you for exercising these rights.
Requests: support@saytype.dev. We will verify your identity as required and respond within 45 days (extendable by 45 more). You may use an authorized agent with proper verification/authorization. We retain usage data only as described in Section 3; categories collected are those listed in Section 1.
6.3 Other jurisdictions
Residents of other jurisdictions (e.g., UK, Canada, Brazil, Japan, Korea) have equivalent rights under local law; contact us and we will handle requests in accordance with applicable requirements.
7. Cookies, Local Storage, and Web Analytics
Saytype is built privacy-first. We do not use third-party advertising cookies, social-media tracking pixels, or cross-site behavioral analytics, and we do not sell or share personal information for cross-context behavioral advertising.
7.1 Web analytics (cookieless)
- Cloudflare Web Analytics. Our websites use Cloudflare Web Analytics, a privacy-respecting measurement service that does not use cookies or local-storage identifiers and does not track individual visitors across sites. Metrics such as page views, country, and browser type are aggregated and anonymized.
- First-party aggregate counters. When you take certain public actions (for example, clicking a download button), our system increments an aggregate daily counter (operating system and campaign source only, e.g. UTM tags). We do not link these counts to IP addresses or user accounts.
Because we do not set non-essential cookies, no cookie consent banner is required under the EU/UK ePrivacy rules.
7.2 Cookies (website)
- We do not deploy advertising or behavioral-analytics cookies.
- Where applicable, our web service uses strictly necessary session cookies only, for authentication, security, and checkout-session continuity. Under EU/UK ePrivacy rules these do not require prior consent.
- You can block or delete cookies in your browser settings; blocking essential cookies may prevent you from signing in.
7.3 Desktop application local storage
The Saytype desktop application does not use browser cookies. It stores your authentication token and local preferences (such as hotkey and audio-input settings) on your device, in secure application directories. This data stays on your device except when the app validates your session against our authentication endpoint.
8. Security
We use encryption in transit (TLS) and at rest, access controls, token-based authentication, and vendor security reviews. No system is perfectly secure; report vulnerabilities to support@saytype.dev.
9. Children
The Service is not directed to children under 16 (or the higher minimum age in your jurisdiction). We do not knowingly collect children's data; if we learn we have, we will delete it.
10. Changes to This Policy
We will post updates here with a revised "Last updated" date and provide notice (email or in-app) for material changes, in advance where required by law.
11. Contact
- Email: support@saytype.dev
- Postal: Mediio Co., Ltd. (주식회사 메디오), 6-1, Gukhoe-daero 36-gil, Yeongdeungpo-gu, Seoul, Republic of Korea
- Supervisory authority: you may complain to your local data-protection authority (EEA/UK) or the Personal Information Protection Commission (PIPC) of Korea.