HiText Business Privacy Policy

Version: 2026-10-13
Applies to: HiText Business (the website, the free recording with speakers and the monthly and yearly plans)

This is a translation. In case of any discrepancy, the Spanish version prevails: read the Spanish version.

This policy explains what data we process as controller when you use HiText Business: your account data, your billing, your use of the service and the website analytics. HiText Business includes HiText Pro and shares its account with the HiText app and website; for anything you do outside Business (standard transcription, the app and Pro), the general HiText privacy policy, published on its website, also applies.

Recordings are not covered here. You, as the customer, are the controller of the content of the recordings you upload (the voices, what is said, the transcripts and the documents), and we process it on your behalf as a processor. This is governed by the data processing agreement. If you appear in a recording uploaded by someone else, contact that person to exercise your rights; if you write to us, we will pass your request on to them.

1. Controller

• Controller: Roberto Díaz Badra, a self-employed professional trading under the business name Disruptive Normality.
• Privacy contact: disruptivenormality@gmail.com

We do not have a data protection officer.

2. What data we process, why and on what basis

Account and access. Your email address, your sign-in method (email and password, Google or Apple), an internal user identifier and the dates you signed up and were last active. We use them to create your account, let you sign in and provide the service. Basis: performance of the contract (article 6.1.b GDPR).

Plan status and usage. Whether your free recording with speakers is available or used, your plan (and, if you have Pro, where you bought it: web, App Store or Google Play), the hours used in each period, the number of documents generated, service errors and the duration of your files, without accessing their content. We use them to apply the quota and limits, prevent abuse and maintain the service. Basis: performance of the contract.

Free recording once per person. We keep an encrypted digest (a hash) of your normalized email address, together with the account identifier, the identifier of the free recording file and the date. It does not allow the email address to be read, but it does allow us to check whether the free recording has already been used. Basis: our legitimate interest in preventing the free recording from being repeated by creating new accounts (article 6.1.f GDPR).

“What do you record?”. If you answer this question when signing up (research interviews, journalism, homeowners' association minutes, work meetings, classes or studies, or other), we store your answer in your account and, if you accept analytics, as a user property in Google Analytics 4 and Amplitude. It is optional and is used to suggest the template that fits your case and to understand what the service is used for. Basis: our legitimate interest in adapting and improving the service (and your consent, for the analytics part).

Billing. Your name or company name, billing address, country, NIF (Spanish tax ID) or EU VAT number if you provide it, the plan and period, charges, invoices and subscription status. Card details are collected and stored directly by Stripe; we do not see them. If you move from web Pro to Business, also the amount you had left on Pro that is deducted from your Business invoice. We use them to charge you, issue invoices and apply the correct taxes (VAT or IGIC (Canary Islands General Indirect Tax), as applicable). Basis: performance of the contract and compliance with tax and accounting legal obligations (article 6.1.c GDPR).

Acceptance of the data processing agreement. The version of the agreement you accept when paying, the date and an encrypted digest of the IP address from which you accept it. We use them to be able to prove that the agreement was signed. Basis: compliance with a legal obligation (article 28 GDPR) and our legitimate interest in being able to prove it.

Email notifications. We email you when a transcription is ready or has failed, with the file name and a link; never the text of the transcript. You can turn them off in the settings. We also write to you about your account, your subscription or changes to the terms. Basis: performance of the contract.

Support. Whatever you tell us when you write to us. Basis: performance of the contract or, if you are not a customer, our legitimate interest in replying to you.

Analytics (only with your consent). If you accept the “Analytics” category in the cookie notice, we measure how the website is used with Google Analytics 4 and Amplitude: page views, button clicks, sign-up, use of the free recording, documents generated and exported, checkout start and purchase (with its amount excluding taxes). We link these events to your user identifier. Basis: your consent (article 6.1.a GDPR).

Ad measurement (only with your consent). If you accept the “Ad measurement” category, we enable ad storage (ad_storage) and the sending of user data for measurement (ad_user_data) in Google Ads, to find out whether a visit that came from an ad ended in a sign-up, in use of the free recording or in a purchase; and, when you sign up, we store in your account where the visit came from (campaign parameters, the Google Ads click identifier, the keyword, the ad group and match type, the landing page and the referring website). We do not use your data to show you personalized ads. Basis: your consent (article 6.1.a GDPR).

You can withdraw either consent at any time using the “Cookies” link in the footer. Without consent, Google Analytics and Google Ads run in consent-denied mode, without analytics or advertising cookies (the ad click identifier can only pass from one page of the website to another within the URL, the url_passthrough feature), and Amplitude is not loaded. Details of each cookie are in the cookies section of the general HiText privacy policy.

We do not make automated decisions with legal effects concerning you, nor do we carry out profiling for that purpose. We do not sell your data.

3. Providers involved

To provide the service we use these providers, under data processing agreements. Some receive your account data and others the content of your recordings, which we process on your behalf under the data processing agreement.

• Google Cloud and Firebase (Google Ireland Limited and Google LLC): sign-in (Firebase Authentication, a global service that may process data in the United States); database (Firestore, in the European Union multi-region location `eur3`); file storage (Cloud Storage, in the European Union multi-region); and server functions that process requests and files, which run in the United States (`us-central1`) and, partly, in Belgium (`europe-west1`).
• Google Vertex AI (Google Ireland Limited and Google LLC): transcription with speaker separation using Gemini models, in the European Union multi-region location (`eu`).
• Deepgram (Deepgram, Inc.): backup transcription when the main service fails and for files longer than 60 minutes, through its European Union endpoint and with the option of not using the data to improve its models.
• Replicate (Replicate, Inc.): standard transcription (without speakers) with the Whisper model, when you turn off speaker separation or transcribe a video link. United States.
• Firecrawl: retrieves the audio track when you transcribe a video link. United States.
• OpenAI (API service for businesses): drafting the documents from the transcript and, in standard transcription, language detection, translation and summarization. May process data in the United States and does not use it to train its models.
• Stripe (Stripe Payments Europe, Limited): subscription billing, tax calculation, invoices and customer portal. Receives your billing and payment data, and an identifier of your account.
• RevenueCat (RevenueCat, Inc.): subscription status, to unlock the plan on the web and in the app with the same account. Receives an account identifier and the subscription data. United States.
• Resend (Plus Five Five, Inc.): sending email notifications. Receives your email address and the file name. United States.
• Google Analytics 4 and Google Ads (Google Ireland Limited and Google LLC): website analytics and campaign measurement, only with your consent.
• Amplitude (Amplitude, Inc.): product analytics, only with your consent. United States.

In addition, we may disclose data to public authorities when the law requires it (for example, to the Agencia Tributaria, the Spanish Tax Agency) and to advisers bound by a duty of confidentiality.

4. Transfers outside the European Economic Area

Some providers process data in the United States, as indicated in section 3. Those transfers are made with appropriate safeguards under Chapter V GDPR: the provider's participation in the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914), with any appropriate supplementary measures. You can ask us for more information about these safeguards.

5. How long we keep data

• Original audio or video file: deleted when the transcription finishes and, if the process fails, an automatic rule removes it at the latest 7 days after it was uploaded.
• Business transcripts, documents, projects, templates and settings: until you delete them. You can delete each file, or all your Business data from “Settings → Delete my data”, and they are deleted immediately. If you ask us in writing, we delete them within a maximum of 30 days.
• Inactive accounts: if 12 months pass without activity on your Business account (without signing in or using it) and with no subscription in force, we automatically delete its data: files, transcripts, documents, projects, templates, settings, usage history and any file left in storage. The 12 months are counted from whichever happened last: your last activity or the end of the last paid period.
• What is kept after a deletion: the encrypted digest of the email address used for the free recording (section 2) and, blocked, the minimum subscription and agreement-acceptance data (Stripe identifiers, status and dates, accepted version), to meet legal obligations and handle possible claims during the limitation periods. We do not keep your email address in the Business account after deletion.
• Invoices and tax data: for the periods required by law (generally up to 6 years under the Código de Comercio (Spanish Commercial Code) and tax regulations), even if you delete your data or cancel the subscription. They are kept in Stripe and in our accounting records.
• Analytics: up to 14 months in Google Analytics 4 and Amplitude, or until you withdraw your consent; after that they are deleted or anonymized.
• Support emails: for as long as necessary to handle your enquiry and, afterwards, during the limitation periods for possible claims.

Your sign-in account is the same as for the HiText app and website. Deleting your Business data does not delete that account or anything you have outside Business (for example, recordings in the app). To delete it, write to us from your account's email address.

6. Security

We encrypt communications (HTTPS/TLS) and stored data, restrict access to each account's data to its holder with per-user security rules, sign requests between our services and restrict access to systems to those who need it. Details about the content of recordings are in the data processing agreement.

7. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time without affecting processing carried out before. You can exercise many of them yourself on the website: view and export your documents, change your billing details in the customer portal, delete files or all your Business data, turn off email notifications and change your cookie preferences.

For anything else, write to us at disruptivenormality@gmail.com from your account's email address. We will reply within one month. If you believe we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es).

8. Minors

HiText Business is a service for professionals and is not directed at anyone under 18.

9. Changes to this policy

If we change this policy, we will publish the new version with its date on this page and, if the changes are significant, we will notify you by email.