Privacy Policy

1. Information we collect

Account information

When you register, we collect your name, email address, organization name and a hashed password. We do not store plaintext passwords.

Meeting data

When you use the ScribX extension or platform, we process:

• Audio and video recordings — audio is streamed in real time for transcription. Unless you turn recording off (transcript-only mode), the meeting recording is stored for the retention period of your plan (see Section 3) and then deleted automatically.
• Transcripts — the text output of speech-to-text processing, stored and linked to your account.
• Summaries and notes — AI-generated structured notes derived from transcripts.
• Participant metadata — names and email addresses of meeting participants, if provided.

Voiceprints and speaker identification

ScribX uses speaker diarization to label transcript segments by speaker. This may involve processing voice characteristics to distinguish participants. We treat voiceprint data as biometric information. We do not build persistent voiceprint profiles without explicit consent, and we do not share voice characteristics with third parties except as required for the transcription service (see Section 5). Illinois residents: see our DPA for BIPA compliance commitments.

Usage data

We collect standard server logs (IP address, browser type, timestamps, pages visited) and in-product analytics to understand feature usage and improve the service.

Payment information

Payments are processed by Stripe, Inc.; their handling of your payment data is governed by Stripe's privacy policy. We do not store full card numbers on our servers.

2. How we use your information

• To provide, operate and improve the ScribX service.
• To generate meeting transcripts, translations and AI summaries.
• To send transactional emails (account verification, password reset, billing receipts).
• To respond to support requests.
• To detect and prevent fraud, abuse and security incidents.
• To comply with legal obligations.

We do not use your meeting content to train AI models, and we do not sell your data to third parties.

3. Data retention

Audio and video recordings are retained for the period of your plan — 30 days on Free, 90 days on Pro and Team, and as agreed in contract on Enterprise — or for a shorter period set by your organization's administrator, and are then deleted automatically. You can also turn recording off and keep only the transcript. Transcripts, summaries and structured notes are retained until you or your organization deletes them. You may delete individual meetings at any time from the CMS.

Audit logs are retained for a minimum of 7 years to meet financial and compliance requirements. Usage logs are retained for 90 days. Deleted data is purged from backups within 30 days.

4. Security

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We enforce role-based access controls, conduct regular security reviews and maintain an incident response plan.

The ScribX platform and its database run on servers owned and operated by TDA in Vietnam (Hanoi and Da Nang, operated in parallel); a Tokyo region is planned. Audio and video recordings are stored on Cloudflare R2. The third-party sub-processors we use, and where they process data, are listed in our Data Processing Agreement. We follow the principle of least privilege for internal data access.

5. Sharing and disclosure

We do not sell, rent or trade your personal data. We may share data with:

• Sub-processors — cloud infrastructure, speech-to-text providers and analytics tools listed in our Data Processing Agreement.
• Legal requirements — if required by law, court order or to protect rights and safety.
• Business transfers — in connection with a merger, acquisition or sale of assets, with notice to you.

6. Your rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time where processing is based on consent.

To exercise any right, contact us at support@scribx.app. We will respond within 30 days.

EEA / UK residents: You may also lodge a complaint with your local data protection authority. Below is our legal basis by processing activity:

Vietnam · Japan · Korea residents: In addition to the GDPR bases above, we process personal data in line with Vietnam's Personal Data Protection Decree (Nghị định 13/2023/NĐ-CP), Japan's Act on the Protection of Personal Information (APPI), and Korea's Personal Information Protection Act (PIPA). To exercise your rights under these laws, contact support@scribx.app.

7. Cookies

We use strictly necessary cookies (session authentication) and optional analytics cookies. You can disable optional cookies from your browser settings. We do not use advertising cookies.

8. Children's privacy

ScribX is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us immediately and we will delete it.

9. Changes to this policy

We may update this policy from time to time. We will notify you by email and post the updated policy with a new "last updated" date at least 14 days before changes take effect.

10. Contact

TDA Group (Công ty Cổ phần công nghệ TDA)
Hà Nội (HQ): Tầng 2, Tòa nhà Richy, 5 Nguyễn Xuân Nham, Yên Hòa, Hà Nội, Việt Nam
Đà Nẵng: Tầng 6, Tòa nhà Trực Thăng Miền Trung, Nguyễn Văn Linh, Hòa Cường, Đà Nẵng, Việt Nam
Tokyo: 5F, Tokyo Yusei Building, Iwamotocho 1-5-8, Chiyoda-ku, Tokyo, Japan
Email: support@scribx.app