Privacy Policy

Version 4.1 · DRAFT — effective upon EU-route go-live (date TBD)

Introduction

Prodius is a cloud-based voice transcription service that provides real-time speech-to-text conversion with AI-powered enhancement. This Privacy Policy explains how we collect, use, store, and protect your personal data.

Important: Prodius is a cloud-based service. Your audio recordings are transmitted through the Prodius Gateway (hosted by Scaleway in Paris, France — EU region) to AI providers for processing. On the Practice tier, audio is transcribed by Mistral Voxtral (Paris, France) and text is processed by Azure OpenAI West Europe (Netherlands) — EU-only. Free and Pro tier subscribers may use non-EU processors and are not covered by the EU-only guarantee.

Key Privacy Principles

• Zero Data Retention: Audio and transcriptions are processed in memory and never stored on our servers
• EU-First Processing: Practice tier subscribers get EU-only data processing (audio in France, text in the Netherlands, authentication in Ireland)
• Transparency: We clearly disclose all data processing activities
• No Data Sales: We never sell your personal data to third parties
• No Model Training: Your data is never used to train AI models

1. What Data We Collect

1.1 Account Information

• Email address (required for account creation and communication)
• Name (optional, for personalization)
• Account creation date and last login time

1.2 Audio Recordings

• Audio streams captured from your microphone during dictation
• Transmitted to the Prodius Gateway (Scaleway, Paris, France — EU region) via encrypted connection
• Retention: Zero on Prodius servers — audio is processed in memory by the Prodius Gateway and never written to disk on Prodius infrastructure. The transcription provider (Mistral Voxtral on the Practice tier) retains audio for zero/short duration per its Data Processing Agreement.

1.3 Transcription Text

• Raw transcription text generated by speech recognition
• Enhanced transcription text after AI cleanup/formatting
• Retention: Zero on Prodius servers — transcriptions are typed directly into your active application and not stored server-side
• On the Practice tier, AI providers process under contractual zero/short retention and no model training (Azure OpenAI, Mistral). On Free/Pro tiers, AI providers may retain data per their own policies (see Section 5)

1.4 Payment Information

• Company name and billing address
• VAT number (for EU B2B invoicing)
• Transaction history (amounts, dates, invoice numbers)

Self-serve subscriptions (Pro): checkout and subscription billing are handled by Lemon Squeezy, LLC acting as merchant of record. Lemon Squeezy is the seller of record for these purchases and acts as an independent data controller for the payment data it processes (name, email address, billing address, payment method, tax handling) under its own privacy policy. Prodius never receives or stores your card details. Lemon Squeezy notifies us of your subscription status via webhook, which carries your email address, the plan purchased, the subscription status, and your Prodius account ID — no payment card data and no dictation content.

Practice subscriptions are invoiced directly by Zenocritus B.V. (B2B invoicing). We do not store credit card numbers.

1.5 Usage Data

• Device information: Operating system, app version, device type
• Usage metrics: Word counts for quota management
• Product analytics: Feature-usage events from the desktop application (see below)
• Error logs: Technical errors for debugging

Product analytics (PostHog EU). The Prodius desktop application sends product-usage events to PostHog, hosted on PostHog's EU Cloud (eu.i.posthog.com). These events contain only counts, feature categories, and the name of the active application (e.g. "Word") — never audio, transcription text, window titles, selected text, or screenshots — under a pseudonymous identifier. IP-based geolocation is disabled. This helps us understand which features are used and where the product fails.

1.6 Cookies and Tracking

The Prodius website does not currently use analytics cookies or third-party tracking technologies. (For desktop-app product analytics — which does not use cookies — see Section 1.5.)

• Essential cookies (no consent required): Session management, authentication
• Preference cookies (no consent required): Language preference, UI settings

The Prodius desktop application does not use cookies. Authentication is handled via secure tokens stored locally on your device.

2. How We Process Your Data

2.1 Two-Stage Transcription Process

All data flows through the Prodius Gateway (Scaleway, Paris, France — EU region) with zero data retention.

Stage 1: Speech Recognition

1. Audio is transmitted from your device to the Prodius Gateway via encrypted connection (HTTPS)
2. The Gateway forwards audio to the transcription provider
3. The transcription provider converts speech to text
4. Audio is never stored — processed in memory and immediately discarded

Stage 2: AI Enhancement

5. Raw transcription text is forwarded through the Gateway to an AI language model
6. The model improves punctuation, capitalization, and formatting
7. Enhanced text is returned through the Gateway to your device
8. Final transcription is typed directly into your active application — no server-side storage

Data Flow (Practice tier): Desktop App → Gateway (Scaleway, Paris, EU) → audio to Mistral Voxtral (Paris, FR) for transcription; text/screenshot to Azure OpenAI West Europe (NL) for cleanup, commands and vision → Gateway → Desktop App

Third-Party Data Handling (Practice tier):

• Mistral (Voxtral) — audio transcription. EU (French) entity. Under an Article 28 DPA: no model training, zero/short retention. Data processed in France (EU).
• Azure OpenAI — text cleanup, command processing and screenshot/vision grounding (not audio). Under modified abuse monitoring / zero data retention: no retention of prompts/completions, no human review, no model training. Data processed in West Europe (Netherlands), within Microsoft's EU Data Boundary.

Free and Pro tiers may use non-EU AI providers and are not covered by the EU-only guarantee; those tiers are not suitable for client-confidential data. See Section 8.2.

2.2 Account and Usage Data

• Account data (email, authentication tokens) is stored in Supabase (West EU, Ireland)
• Usage metrics (word counts) are stored for quota management
• Transcription content is NOT stored

Account verification and one-time-passcode (OTP) sign-in emails are generated by Supabase Auth and delivered via TransIP's SMTP (Netherlands, EU). These emails contain your email address and a verification code — no dictation content.

2.3 Application Context Processing

To provide context-aware transcription accuracy and intelligent text formatting, Prodius may capture:

• Active application name and window title
• Selected text in the active window (for context-aware transcription)
• Screenshots of the active window (only when you have explicitly bound a destination window for a command turn — see Section 2.4)

Context data is transmitted to the AI provider in real-time for that single request and is never stored on Prodius servers. Privacy protections include automatic exclusion of password managers and private browsing detection.

2.4 Local Screenshot Cache (Desktop App)

When you issue a command while a destination window is explicitly bound (manual target pick or pinned modal), Prodius captures a single screenshot of that window, sends it to the AI provider to ground the response, and — by default — caches the resulting JPEG on your own device so that you can see in the conversation view exactly which image was sent. This cache is intended as a transparency control: you can verify the provenance of every AI response grounded by a screenshot.

Where the cache lives (on your device, never on Prodius servers):

• macOS: ~/Library/Application Support/Prodius/context_screenshots/
• Windows: %LOCALAPPDATA%\Prodius\context_screenshots\
• Linux: ~/.local/share/prodius/context_screenshots/

Retention:

• Default lifetime: 7 days, configurable in Settings
• Per-conversation cap: 50 MB (oldest thumbnails are evicted first)
• Global cap: 500 MB
• When you delete a conversation, the corresponding screenshot directory is deleted from disk

Your control: The cache can be disabled entirely via Settings → Privacy → "Cache context screenshots locally" (default ON). When disabled, screenshots are still displayed inline for the duration of the turn in which they were sent, but are not written to disk and do not survive closing the modal.

No new third-party transmission: The screenshot is sent to the AI provider only once, as part of the command turn itself — the same transmission that was already covered before this cache existed. The local cache is a local-only copy of that same image, read by the Prodius desktop application when rendering your conversation history. Nothing from the cache is uploaded to Prodius, to AI providers, or to any other party.

File security: Cached files use standard operating-system file permissions (user-owned, readable by your OS user account). They are not additionally encrypted at rest by Prodius. For devices protected by full-disk encryption (FileVault, BitLocker, LUKS), the cache is encrypted as part of the wider disk. We recommend full-disk encryption for any device used for professional client work.

For firms subject to professional secrecy (beroepsgeheim): because the cache may contain pixels of documents in Outlook, Word, Excel, case-management systems, or similar, the compliance officer or IT administrator should include the paths above in the firm's device-hygiene policy (e.g., the existing policy for browser caches, recent-document lists, and other local AI-assistant histories). Disabling the cache in Settings is the simplest way to remove this surface entirely.

3. How We Use Your Data

3.1 Primary Purposes (Legal Basis: Contract Performance)

• Provide transcription service: convert your speech to text
• Enhance transcription quality via AI processing
• Process payments and issue invoices
• Customer support

3.2 Service Improvement (Legal Basis: Legitimate Interest)

• Performance monitoring: system uptime, transcription speed
• Security: detect fraud, abuse, and threats

3.3 Communications (Legal Basis: Consent or Legitimate Interest)

• Transactional emails: Account notifications, payment receipts (cannot opt out)
• Product updates: New features, service changes (cannot opt out)
• Marketing emails: Promotions, tips, company news (can opt out anytime)

4. Data Retention

Data Type	Retention Period
Audio Recordings	Zero — in-memory processing only
Transcription Text	Zero — not stored on Prodius servers
Application Context (app name, window title, selected text)	Zero on Prodius servers — processed in real-time, not stored
Context Screenshot — Prodius servers	Zero — processed in real-time by the AI provider, not stored on Prodius infrastructure
Context Screenshot — your own device (local cache)	Up to 7 days by default (configurable); deleted on conversation delete; can be disabled in Settings. See Section 2.4.
Account Data	While account active + 30 days after deletion
Usage Metrics	While account active + 30 days after deletion
Billing Data	Per tax law requirements (typically 7 years)

5. Third-Party Service Providers (Subprocessors)

We use the following third-party services. Your data is shared with them only as necessary for service delivery.

See the full Subprocessor List for details.

Not a subprocessor: Lemon Squeezy (Section 1.4) acts as merchant of record and independent controller for payment data and therefore does not appear in the subprocessor list; it never processes dictation content.

Subprocessor	Purpose	Location
Mistral (Voxtral)	Audio transcription (Practice)	France (EU)
Azure OpenAI (Microsoft)	Text cleanup, commands, vision (Practice)	Netherlands (West Europe, EU Data Boundary)
Scaleway	Gateway hosting (API routing, zero data storage)	Paris, France (fr-par)
Supabase, Inc.	Authentication + usage tracking	West EU (Ireland, eu-west-1)
PostHog	Desktop-app product analytics (counts, feature categories, active-app name only — never content; see Section 1.5)	EU Cloud (eu.i.posthog.com)
Sentry (Functional Software, Inc.)	Error monitoring and performance tracing	Frankfurt, Germany
TransIP	Domain, DNS & mailbox host; SMTP for account/verification (OTP) emails	Amsterdam, Netherlands

Changes: We will notify you 30 days before adding or replacing a subprocessor that handles your personal data. You have a right to object (veto): while your objection stands the change does not take effect for you, and you may terminate without penalty. See the DPA §6.3.

6. Data Security

6.1 Technical Safeguards

• Encryption in Transit: TLS 1.2+ for all data transmission
• Zero Storage: Gateway processes data in memory only — nothing written to disk
• Access Controls: JWT authentication, role-based access
• Audit Logging: Metadata-only request logs (never content)

6.2 Limitations

• No system is 100% secure
• You must secure your account credentials and device
• We rely on our subprocessors' security measures

In Case of Breach: We will notify affected users without undue delay, and in any event within 24 hours of becoming aware of the breach (see our DPA for full details). We will provide details about the breach, affected data, and remediation steps. We will also notify the Autoriteit Persoonsgegevens within 72 hours as required by GDPR Article 33.

7. Your Privacy Rights

7.1 GDPR Rights (EU/UK/EEA Residents)

Under the General Data Protection Regulation, you have the right to:

• Access (Article 15): Request a copy of all personal data we hold about you
• Rectification (Article 16): Correct inaccurate account information
• Erasure (Article 17): Request deletion of your account and associated data
• Restriction (Article 18): Temporarily pause processing
• Portability (Article 20): Export your data in machine-readable format
• Object (Article 21): Object to processing for direct marketing
• Withdraw Consent (Article 7): Withdraw consent for optional features
• Lodge a Complaint (Article 77): File a complaint with your national data protection authority

How to Exercise Rights: Email privacy@prodius.ai. We will respond within 30 days.

7.2 CCPA Rights (California Residents)

• Right to Know: Categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out of Sale: We do NOT sell personal information
• Right to Non-Discrimination: Same service quality regardless of rights exercise

8. International Data Transfers

8.1 Practice Tier (EU-Only Processing)

For Practice subscribers, all content processing stays within the European Union:

• Gateway: Scaleway (Paris, France, fr-par region)
• Audio transcription: Mistral Voxtral (Paris, France)
• AI text / command / vision: Azure OpenAI West Europe (Netherlands), within the EU Data Boundary
• Authentication: Supabase West EU (Ireland)
• No content is transferred to the United States
• Fail-closed: If the EU provider is unavailable, requests fail — they do NOT fall back to non-EU providers

8.2 Free & Pro Tiers (May Include Non-EU Processing)

For Free and Pro subscribers, AI processing may use non-EU providers. These tiers are intended for private use and are not suitable for processing client-confidential data. The exact processor list for Free/Pro is confirmed at EU-route go-live. We implement safeguards including:

• EU Commission-approved Standard Contractual Clauses (SCCs) where a processor's parent is outside the EEA
• Zero storage on the Prodius Gateway
• Contractual prohibition on model training

If you object to non-EU processing, contact us about upgrading to the Practice tier for EU-only processing.

9. Children's Privacy

• Minimum Age (US): 13 years old (COPPA)
• Minimum Age (EU/UK/EEA): 16 years old (GDPR Article 8)

We do not knowingly collect data from children below minimum ages.

10. What Prodius Does NOT Do

• We do NOT sell your data
• We do NOT store audio, transcriptions, or context screenshots on our servers
• We do NOT upload the local screenshot cache (Section 2.4) anywhere — it stays on your device
• We do NOT train AI models on your data
• We do NOT share data with advertisers
• We do NOT use analytics or tracking cookies on our website; desktop-app product analytics (Section 1.5) never contains content — only counts, feature categories, and the active application's name

11. HIPAA Compliance

Prodius is NOT HIPAA-Compliant. Do not use Prodius to transcribe Protected Health Information (PHI). See our Terms of Service for details.

12. Accuracy Disclaimer

Transcriptions may contain errors. You should independently verify all transcriptions, especially for legal documents, financial reports, and safety-critical communications. See our Terms of Service for full disclaimer.

13. Changes to This Policy

Material changes will be communicated via email notification (30 days advance notice) and updated effective date. Continued use after changes take effect constitutes acceptance.

14. Contact Information

• Privacy questions: privacy@prodius.ai
• Data subject requests: privacy@prodius.ai with subject "Data Subject Request"
• General support: support@prodius.ai

Data Protection Authority: Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — https://autoriteitpersoonsgegevens.nl/

Summary

Data Type	Retention	Shared With
Audio	Zero — in-memory only	AI provider (for transcription)
Transcriptions	Zero — not stored	AI provider (for enhancement)
App Context (text)	Zero on Prodius servers	AI provider (in enhancement request)
Context Screenshot	Zero on Prodius servers; optional local cache on your device (default 7 days, can be disabled — see §2.4)	AI provider (for the bound-destination command turn only)
Account Info	While active + 30 days	Supabase (Ireland, EU)
Usage Metrics	While active + 30 days	Supabase (Ireland, EU)
Billing Data	Per tax law (7 years)	Lemon Squeezy as merchant of record (Pro self-serve, §1.4); Practice: none (direct B2B invoicing)

Version 4.1 · DRAFT (effective upon EU-route go-live)

Changes in v4.1 (2026-08-11): Gateway host named as Scaleway (Paris, fr-par) — the EU gateway is now in operation. Added Lemon Squeezy as merchant of record for self-serve (Pro) checkout and billing (§1.4). Added desktop-app product analytics via PostHog EU Cloud (§1.5, §5, §10) — counts and app names only, never content. Tier naming: "Personal" is now "Pro".
Changes in v4.0 (EU-route): Practice-tier processing chain rewritten — audio transcription moves to Mistral Voxtral (Paris, FR); text cleanup, commands and vision move to Azure OpenAI West Europe within Microsoft's EU Data Boundary; the gateway moves to an EU host. Fly.io, Groq and OpenAI-direct removed from the Practice content path. This is a draft and takes effect only on the EU-route go-live date, once the chain is live and the Microsoft and Mistral DPAs are signed.