Privacy policy

1. Controller

The data controller is WEB FLOYD Sp. z o.o., ul. Prof. Michała Bobrzyńskiego 31B/3, 30-348 Kraków, Poland, entered in the National Court Register (KRS) under no. 0000695623 kept by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division, tax ID (NIP) 6762536185, REGON 368296900. Contact for data protection matters: biuro@webfloyd.pl.

2. Speech and recordings

• Audio from your microphone is sent to our server and turned into text live, while you speak.
• We do not store recordings. Audio is processed only in the server’s memory and discarded right after transcription.
• Transcription runs on our own server — recordings are never passed to third parties.
• The text is not stored unless, while logged in, you click “Save to history”.
• If you choose automatic language detection, the language is recognised from the first sentence and used for the rest of the session.

3. Your account

If you create an account, we process:

• your e-mail address and (optionally) first name, and your preferred language,
• your password as a cryptographic hash (we never know your password),
• when signing in with Google or Apple: the account identifier from that provider, plus e-mail and name if provided,
• voice notes you save to your history (text, length, date),
• shopping lists and product inventory (names, quantities, categories), your assistant’s name and voice commands,
• the dates of account creation, last login and acceptance of the terms.

Legal basis: performance of the service contract (Art. 6(1)(b) GDPR). We keep the data until you delete your account. You can delete it yourself in the settings — all saved voice notes and lists are deleted with it.

4. Security and abuse prevention

• To protect the service, we count login attempts and sessions. IP addresses are stored for this only as a cryptographic hash and deleted after 24 hours.
• The server keeps standard technical logs (e.g. IP address, time, page address) for 30 days.
• Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

5. Cookies and browser storage

• We only use a strictly necessary login session cookie (valid for up to 30 days) and temporary cookies during Google/Apple sign-in.
• Your day/night mode, chosen language and speech language are remembered in your browser’s storage.
• We don’t use advertising cookies or third-party analytics.

6. Recipients and transfers

• Our server hosting provider: home.pl, ul. Zbożowa 4, 70-653 Szczecin, Poland (processor); servers located in Poland, so data stays in the European Union.
• Google and Apple — only if you choose to sign in with them; they act as separate controllers.
• We don’t sell data or share it for marketing.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You can also lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO), or the authority in your country of residence. To exercise your rights, write to biuro@webfloyd.pl.

8. Changes

We’ll announce significant changes on this page and, for account holders, by e-mail.