Legal · Plain-language notice
Privacy notice
What VoiceCut processes, why, for how long and which choices you control.
Effective 2026-08-24Version f8ac4fbf6f55
Controller and scope
Alphabit, Obchodná 26, 930 41 Hviezdoslavov, Slovensko; IČO 54823579; sole proprietor not entered in the Commercial Register; Tax ID SK3121389975; phone +421951728213.
The operator is the controller for account, security, support, billing and service-administration data. For personal data contained in a recording or workspace content that an organisation uploads, that customer normally determines the purpose and means of processing and the operator processes the content on its documented instructions. A business customer should contact the privacy address to agree any required data-processing terms before uploading personal data for which it is the controller.
Data and sources
You provide name, email, password or Google sign-in choice, audio and video recordings, YouTube links you submit for transcription, file names, glossary terms, corrections, support messages and billing details. VoiceCut creates workspace membership, sessions, transcript text, speakers, timecodes, confidence signals, still frames extracted from an uploaded video together with the on-screen text and scene descriptions read from them, generated notes and exports, usage and purchase records, deletion receipts, and technical logs such as timestamps, request identifiers, IP address, browser information, error codes and security events.
If you choose Google sign-in, Google supplies the verified account identifier, email and profile name needed to authenticate you. If checkout is enabled, Stripe supplies payment status, billing address, tax calculation and invoice identifiers; VoiceCut does not receive the full card number. Meta identifiers are handled only after the optional consent described below.
Purposes and legal bases
Contract is the basis for creating and securing an account, authenticating sessions, receiving and transcribing a recording, reading the frames of an uploaded video or the content of a submitted YouTube link for on-screen text and scene descriptions, generating requested documents, applying retention settings, exporting data, providing support and delivering paid minute packages. Steps requested before registration also rely on taking steps to enter a contract.
Legal obligations are the basis for required tax, accounting, invoice, consumer and data-rights records. Legitimate interests are the basis for proportionate security monitoring, fraud and abuse prevention, service reliability, incident investigation and establishment or defence of legal claims; these interests are balanced against users’ rights. Consent is the only basis used for optional Meta marketing measurement and can be withdrawn at any time.
An email address and authentication data are required to create and secure an account; recordings and requested settings are required only when you ask VoiceCut to process them; billing details are required only for a purchase. Without the relevant data, VoiceCut cannot provide that part of the contract. Meta marketing measurement is optional and refusing it has no effect on the service.
Processing route and recipients
The operator-managed application, PostgreSQL, Redis and object storage provide the main product route in not configured. Soniox processes speech in the configured US region for transcription and speaker diarization; VoiceCut then requests removal of temporary provider copies. OpenAI API may process transcript text when you request derived briefs, decisions or actions. Google LLC processes video analysis through its Gemini API on a paid tier: still frames that VoiceCut extracts from an uploaded video, to read on-screen text and describe scenes, and, when you submit a YouTube link, the link itself and the content of the linked video, from which Google returns the transcript and the visual description. VoiceCut does not download the linked video, and a link is transcribed by Google rather than Soniox. Google’s processing of this data, including where it takes place and how long Google retains it, is governed by Google’s Gemini API terms for paid services.
Other recipients are Resend for transactional email, Google for sign-in when it is selected and for video analysis as described above, Stripe for checkout, invoicing, tax and fraud controls when checkout is enabled, and Meta Platforms Ireland Limited only for consented marketing measurement. Professional advisers, authorities or counterparties receive data only where necessary for a legal obligation or legal claim. VoiceCut does not sell private recordings or transcripts.
Permanent deletion also reaches the third parties this deployment uses, within what each of them permits. The Stripe customer object a checkout created is deleted and any unused paid checkout is refunded, while Stripe keeps the payment, refund and invoice records it is legally required to retain as financial documentation. Marketing events that Meta accepted under an earlier consent cannot be retracted; the optional marketing measurement section describes exactly what those events contained. Encrypted off-site backup copies expire on the operator’s published schedule, and completed deletion tombstones prevent a restored backup from silently resurrecting a deleted workspace.
International transfers
The main hosting route is configured in the region shown above, but Soniox speech processing is currently configured for the US, Google processes video analysis where its Gemini API terms provide, and other providers may process data outside the EEA. Where Chapter V GDPR applies, each transfer must be covered by an applicable mechanism, such as an adequacy decision or European Commission standard contractual clauses, and any necessary supplementary measures. The operator must verify and document that mechanism for every active provider before launch; ask the privacy contact for the provider-specific record. A configured region does not mean every support, security or backup operation stays there.
Retention and deletion
An unverified registration and its activation records are removed after 7 days. Google sign-in continuations expire after 10 minutes. The workspace owner chooses source and derived-data retention from 1 to 3,650 days; defaults are 30 days for source audio recordings, 14 days for the source file of an uploaded video and 365 days for transcripts and generated results. The owner can instead remove a source as soon as processing finishes. Still frames extracted from a video are stored beside the recording and are deleted with it; for a YouTube link VoiceCut stores the link, the transcript and the visual description, not the video. A Studio item moved to trash is permanently purged after 30 days unless restored first, and the source-retention clock stops while an item is in trash and resumes when it is restored. Studio batch-download files expire after 7 days, and a portable privacy export expires after 24 hours.
Security audit events are kept for 365 days and production backups for 30 days. Workspace deletion blocks access immediately and deletes customer content from active systems and the off-site mirror; encrypted backups age out on their schedule and completed deletion tombstones prevent restoration. A pseudonymous erasure-guard receipt is kept for 3,650 days. A consumer-withdrawal request and its delivery evidence are kept for 3 years; workspace deletion removes the consumer name, user ID and email and replaces the workspace ID with a one-way pseudonymous reference. Purchase, invoice and tax records are kept for the period required by applicable law. Data needed for a dispute or legal hold may be isolated and kept only for that purpose.
Optional marketing measurement
VoiceCut uses your consent as the legal basis for this optional measurement. Only after you choose Allow, VoiceCut loads Meta Pixel on the public landing, blog, use-case and demo pages. It sends Meta a PageView containing the public page URL and the browser, device and network information that accompanies the request. The Meta Pixel may also process public page metadata and visible public content relevant to measurement: the page title, public media URLs, content classification, product or offer names and properties, displayed prices or reviews, and business contact details, if they appear on that page. This public-page collection does not give Meta access to private product surfaces or account content. The purpose is to measure advertising visits and attribute campaign results.
Under the same consent, VoiceCut may send three types of server events through Meta Conversions API: CompleteRegistration after registration is completed and FirstTranscriptionReady after the first transcription in a workspace becomes ready, plus Purchase for each verified paid purchase. The event name and actual time, a random event identifier, the fixed public URL https://voicecut.alphabit.vision/, the browser IP address and User-Agent, and valid _fbp or _fbc cookies are sent, together with the SHA-256 hash of the account email when an email is available. VoiceCut trims surrounding whitespace and lowercases the email before hashing. Meta receives the hash, not the raw email address. Only the Purchase event additionally contains the paid amount and three-letter currency code; no internal purchase identifier is sent. An event waits on the VoiceCut server for no more than 6 days and 23 hours; without current consent it is not sent and expires after that period. VoiceCut records the allow or decline receipt server-side, so dispatch does not rely on the browser cookie alone.
Meta Platforms Ireland Limited receives and processes this information under the Meta Business Tools Terms and Meta Privacy Policy. Meta may use cookies such as _fbp and _fbc for advertising measurement. Meta describes its own retention and international-transfer practices in its Privacy Policy; the Business Tools Terms govern the Pixel service.
VoiceCut does not send PageViews from sign-in, registration, Studio, Settings, shared-recording links, erasure receipts or legal pages. Server events also contain no Studio URL, raw email address, name, phone number, user, workspace, recording or run ID, uploaded file name, recording or transcript text. Value and currency are sent only for a verified Purchase event. Automatic event collection and Automatic Advanced Matching are disabled.
The first-party cookie that records your choice is kept for up to 180 days. Marketing measurement is optional, and declining does not limit the product. You can change the choice here or in Settings under Privacy and data. Declining after an earlier approval stops further events and removes the Meta cookies accessible to this site. Withdrawing consent does not affect processing that was lawful before withdrawal and cannot retract an event Meta has already accepted.
Separately, VoiceCut keeps its own cookie takt_signup_source for up to 90 days. It holds only the campaign parameters of the link that first brought you here (utm_*) and the domain of the referring page. It exists so we can tell which of our own ads or links led to a registration, and it is not shared with Meta or anyone else. It contains no email address, name, recordings or transcript text.
Independently of that choice, VoiceCut counts visits to its own public pages: the page address, how long it was open, the device type (phone, tablet, computer), the utm_* parameters and the domain of the referring page. To count visitors rather than page opens, the server derives a pseudonym from the date, the IP address and the browser string under a secret key. The IP address itself is not stored, the pseudonym cannot be reversed, and it changes every day — tomorrow you are a different pseudonym. These counts stay with us, are shared with nobody, and write nothing to your device. Linking a visit to your account happens only with the marketing measurement consent above.
Optional OpenAI Ads measurement
With your separate permission, VoiceCut loads the OpenAI Ads Measurement Pixel on public pages and sends a page_viewed event. After successful email verification or creation of a new Google account, it sends registration_completed. Submitting the initial email form does not count as registration. No recording, transcript, Studio page view or purchase event is sent to OpenAI Ads.
OpenAI may receive the ad click reference (oppref), the browser reference, event name and time, the site origin and request information such as IP address and User-Agent. If automatic advanced matching is enabled in Ads Manager, the Pixel may detect supported customer details on the registration page and hash them in the browser before sending an event. The Pixel may store first-party __oppref and __obref cookies for up to 30 and 365 days respectively, subject to browser limits. VoiceCut keeps your separate OpenAI Ads choice for up to 180 days. OpenAI processes this data for ad measurement under its Conversion Terms and privacy terms. OpenAI Conversion Terms.
You can allow or decline this measurement independently of Meta. Declining does not limit VoiceCut. Withdrawal stops future events and asks the Pixel to remove its attribution cookies; it cannot retract events already received by OpenAI.
Current OpenAI Ads choice: no choice yet.
Your rights
Subject to applicable conditions, you can request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Settings lets you correct profile and transcript data, review and revoke sessions, change retention, export the workspace, change marketing choice and request permanent deletion. VoiceCut does not make solely automated decisions with legal or similarly significant effects.
Send a rights request to [email protected]. You may also complain to the Office for Personal Data Protection of the Slovak Republic or the supervisory authority where you live or work. Slovak authority guidance.
Changes and contact
This notice applies from 2026-08-24. Material changes are announced in the product or by email where required. The content hash shown on this page identifies the published version.