Privacy policy
1. Who processes your data
The controller is Reducto Ltd, company number BG208651488, registered at 6, Osma St., Malina, Bulgaria, as the provider of the Sonbrio service. Reach us at [email protected].
2. What we process
- Account: your email address, your name if you enter one, and a one-way hash of your password. The password itself is never stored.
- Dictation text: the recognised text, its tidied version, and the translation if you used translation.
- Personal dictionary: the terms you added so they are recognised correctly.
- Usage: the length of your dictations in seconds, to account for your plan.
- Technical records: a log of system emails sent to you and of errors in the service.
Your voice is not stored. Audio is transcribed as you speak and is written to disk neither by us nor by the recognition provider. Only the text remains.
3. Purposes and legal bases
- Providing the service - processing dictations, keeping your archive and dictionary. Basis: performance of a contract (Art. 6(1)(b) GDPR).
- Billing - counting minutes and issuing documents. Basis: contract and legal obligation.
- Security and support - error records, protection against abuse. Basis: legitimate interest (Art. 6(1)(f)).
- System email - confirmations, password resets, plan notices. Basis: performance of a contract.
4. Who we share data with (processors)
We use providers who process data under contract and in line with the GDPR:
- Soniox, Inc. (USA) - real-time speech recognition. Audio is streamed for transcription and not retained.
- Anthropic PBC (USA) - tidying the recognised text with a language model. Only the text of the dictation is sent.
- Hetzner Online GmbH (Germany) - hosting of the application and database.
- Cloudflare, Inc. - network protection and access to the application; backups are held in Cloudflare R2 under EU jurisdiction.
- Postmark (ActiveCampaign, LLC) (USA) - sending system email.
- Stripe, Inc. - payment processing on a paid plan. Your card details never pass through our servers.
We do not sell or rent data to third parties for advertising.
5. Retention
- Dictations and dictionary - for as long as your account exists. You can delete individual records at any time.
- Account - until you ask for deletion, after which data is removed within 30 days.
- Backups - up to 3 months, then deleted automatically.
- Accounting records - for the periods the law requires, regardless of account deletion.
6. International transfers
Some processors are established in the United States. Transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, participation in the Data Privacy Framework.
7. Cookies
We use only strictly necessary cookies - to keep you signed in. There are no advertising cookies and we do not track your behaviour with external analytics tools.
8. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- erasure (the "right to be forgotten");
- restrict processing;
- portability - export your dictations;
- object to processing based on legitimate interest;
- complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your local authority.
Write to [email protected] and we answer within 30 days.
9. What you dictate
You decide what you dictate. If the text contains other people's personal data - client names, health or financial information - you are the controller for it and we remain a processor. We advise against dictating data you have no basis to process.
10. Security
Connections are encrypted. Passwords are stored as an irreversible hash. Server access uses keys, not passwords. Backups are encrypted and taken every hour.
11. Changes
We will tell you by email at least 14 days before any material change. The date of the last change is at the top of this page.
12. Contact
Reducto Ltd · Company number BG208651488 · 6, Osma St., Malina, Bulgaria
[email protected]