1.Scope and our role
This Privacy Policy explains how YapperTalk LLC, a California limited liability company (“YapperTalk”, “we”, “us”) handles personal information in connection with the yappertalk.com website and the YapperTalk dictation app (together, the “Service”).
Which parts apply to you depends on how you got the Service:
- You subscribed yourself. This is most people. We are the controller of your personal information, we decide how it is handled, and this policy is our notice to you. You exercise the rights in section 13 directly with us.
- Your employer deployed it. Then your employer decides why and how the Service is used and is the controller; we process on its documented instructions as its processor, under our Terms of Service and our Data Processing Addendum. Section 15 explains what that means for you, and where to take a request.
- You are just visiting the site, or you emailed us. We are the controller of that data, and this policy is our notice to you.
Everything in this policy about what we collect, what we never keep, and how the Service handles voice is true in all three cases. The difference is only who you go to with a request.
Where a signed data processing agreement conflicts with this policy for data we process as a processor, that agreement governs.
2.The short version
This summary is here to be useful, not to replace the sections below. Where it is less specific than the rest of this policy, the rest of the policy governs.
- Audio is captured only while someone holds or toggles the dictation control, is sent over an encrypted connection, is transcribed in memory, and is discarded in the same request. It is not written to disk and not retained.
- We do not train models on customer audio. Our speech models are trained on synthesized speech, licensed and public corpora, and text correction pairs, never on recordings of the people who use the Service.
- We do not create voiceprints and we do not identify people by the sound of their voice. See section 12.
- We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.
- We keep account, license, and billing records for as long as the relationship lasts and for a defined period afterward. Section 10 gives the schedule.
- Everyone who processes data on our behalf is listed in section 8. That list is complete, and we update it before adding anyone new.
3.What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Dictated audio | The audio captured while an Authorized User activates dictation. Held in memory for the length of one request and discarded. | Directly from the client application, at the user's action. |
| Transcript and rewrite text | The text produced from that audio, plus any selected text or context a user submits when invoking a rewrite mode, and the rewritten result. | Generated by the Service from the audio and the user's input. |
| Custom vocabulary | Terms, names, and correction pairs the user or the organization adds so the Service stops mishearing them. | Entered by the user, or learned from corrections the user makes. |
| Account and administrator data | Work email address, name, role, organization, authentication credentials, and admin console settings. | From the customer organization, its identity provider via SSO or SCIM, or the person directly. |
| License and device records | License key, a device identifier for each machine that activates a seat, operating system platform, application version, and check-in timestamps. Collected on launch and roughly every twelve hours. | From the client application, automatically. |
| Usage and diagnostic data | Counts of dictations, feature and mode usage, latency, error codes, and security telemetry. Not the content of what was dictated. | Generated automatically by the Service. |
| Billing data | Billing contact, invoicing details, and a payment processor customer identifier. We do not receive or store full card numbers. | From the customer, and from our payment processor. |
| Communications | Sales enquiries, support requests, and the correspondence around them. | From you, when you contact us. |
| Website data | IP address, browser and device type, referring page, and pages viewed, in standard server logs. | Automatically, when you visit the site. |
4.What we never do
These are commitments, not aspirations. Each one is enforceable against us as a term of the Terms of Service.
- We do not store recordings. No dictated audio is written to disk on our infrastructure, at any stage, including in logs, queues, backups, or crash dumps.
- We do not log the content of transcripts. Our error and diagnostic logs record that a request happened, whether it succeeded, and how long it took. They do not record what was said.
- We do not train on customer audio. Not for the customer it came from, and not for anyone else. If we ever want to, we will ask for a specific, written, revocable opt-in first, and the default answer stays no until we have it.
- We do not build voiceprints. We do not derive, store, or compare voice templates, and we do not use voice to identify or authenticate anyone. See section 12.
- We do not capture what you type. The Service inserts text at the cursor. It does not read, record, or transmit the contents of the applications or documents you are working in.
- We do not listen when dictation is off. The microphone is engaged only while the user activates the dictation control, and released when they stop.
- We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We run no advertising and no ad tracking.
5.The voice lifecycle, step by step
This is the section security reviewers ask for. It describes what happens between someone speaking and text appearing.
- Capture. The user presses the dictation control. The client application opens the microphone and buffers audio locally, in memory, for the duration of the utterance. Releasing the control ends capture.
- Transit. The buffered audio is sent to our speech engine over TLS, accompanied by the license key and device identifier used to authorize the request. Nothing else is attached to it.
- Authorization. The engine validates the license before the audio reaches any model. A revoked, expired, or unknown license is rejected at this point and the audio is dropped.
- Transcription. The audio is decoded in memory by a speech model we operate on our own infrastructure. The model weights are ours; they are not distributed to client devices and are not sent to a third party.
- Discard. The audio buffer is released when the request completes. It is never written to disk, and no copy is retained. If the request fails, the buffer is released the same way.
- Rewrite, only if asked. If the user invoked a rewrite mode, the transcript text is processed to produce the requested result. See section 8 for exactly who processes it. Audio is never part of this step.
- Delivery. The resulting text is returned to the client and typed at the cursor. From that moment it lives in the destination application, under that application’s controls and the customer’s own policies, and it is outside our systems.
In plain language
The honest boundary is step 7. Once the text lands in someone’s email draft or ticket, it is in their company’s systems, and our retention promises no longer reach it. What we control is steps 1 through 6, and in those steps nothing durable is kept.
This summary is provided for convenience only and is not part of the agreement. If it conflicts with the section above, the section governs.
6.How we use data
- To provide the Service: transcribing audio, producing rewrites, applying custom vocabulary, and delivering text to the client.
- To authenticate and authorize: validating licenses, enforcing seat counts, provisioning and revoking access, and operating SSO and SCIM.
- To keep the Service secure: detecting and investigating abuse, credential sharing, intrusion, and fraud.
- To operate and improve: monitoring reliability and latency, diagnosing errors, and improving accuracy using non-content signals and text correction pairs, never audio.
- To support customers: answering enquiries and resolving issues, using the content of correspondence you send us.
- To bill and administer: invoicing, collections, and account management.
- To comply with law: meeting legal obligations, responding to lawful requests, and establishing or defending legal claims.
7.Legal bases, for people in the EEA and UK
Where the GDPR or UK GDPR applies and we act as a controller, we rely on the following bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service to a customer organization and administering the contract | Performance of a contract (Article 6(1)(b)), or our legitimate interest in serving the organization that engaged us (Article 6(1)(f)) |
| Security, abuse prevention, and license enforcement | Legitimate interests in protecting the Service, our customers, and our intellectual property (Article 6(1)(f)) |
| Reliability monitoring and accuracy improvement using non-content data | Legitimate interests in operating and improving a service people rely on (Article 6(1)(f)) |
| Responding to sales and support enquiries | Legitimate interests, or steps taken at your request before entering a contract (Article 6(1)(b) and (f)) |
| Billing, tax, and accounting records | Legal obligation (Article 6(1)(c)) |
| Any processing that goes beyond the above, if we ever propose it | Consent (Article 6(1)(a)), freely given and withdrawable at any time |
Where we act as a processor, the customer organization is responsible for establishing the legal basis for the dictation its people carry out, and for giving them notice. Our Terms of Service place that obligation on the customer explicitly.
You have the right to object to processing based on legitimate interests. Write to yappertalkteam@gmail.com and we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data to establish or defend legal claims.
9.International transfers
We operate from the United States, and our subprocessors may process data in the United States and other countries. If you are in the EEA, the United Kingdom, or Switzerland, this means your data may be transferred outside your jurisdiction.
When it is, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum, as applicable, together with technical measures including encryption in transit and the fact that dictated audio is never persisted at rest anywhere. We carry out transfer impact assessments where required, and will provide our transfer documentation to a customer on request to yappertalkteam@gmail.com.
10.How long we keep things
| Data | Retention |
|---|---|
| Dictated audio | Not retained. Held in memory for one request, then discarded. |
| Transcript and rewrite text | Not retained by us after the response is returned. Where a rewrite subprocessor is used, under zero-retention terms. |
| Custom vocabulary and correction pairs | For as long as the seat is active, and deleted when the seat is deprovisioned or on request. |
| Account and administrator data | For the term of the customer relationship, then deleted within 90 days of termination unless a longer period is required by law. |
| License and device check-in records | 12 months from the check-in, for seat enforcement and abuse investigation. |
| Usage and diagnostic data | 13 months, in a form that does not include content. |
| Security logs | 12 months, or longer where needed for an open investigation. |
| Billing and tax records | 7 years, or the period required by applicable tax and accounting law. |
| Sales and support correspondence | 24 months from the last message, unless it relates to a live contract or claim. |
Where we are required to keep something to comply with a legal obligation, or to establish or defend a legal claim, we keep it for as long as that need lasts and then delete it. Backups roll off on their own schedule, and data deleted from live systems is removed from backups within 35 days.
11.Security
- All traffic between client applications, the website, and our engine is encrypted in transit using TLS. Data at rest in our database and backups is encrypted.
- Dictated audio is never at rest. The strongest control we have over voice data is that there is no stored copy of it to compromise.
- Access to production systems is limited to personnel who need it, requires multi-factor authentication, and is reviewed and revoked on role change or departure.
- Customer access is governed by single sign-on, SCIM provisioning, and role-based permissions that the customer’s own administrators control.
- Model weights are held in private storage, are not distributed to client devices, and are fetched by our engine at start using credentials that can be rotated or revoked.
- We maintain an incident response process. If a personal data breach affects a customer’s data, we will notify that customer without undue delay and, where we act as processor, in the timeframe set by the applicable data processing agreement, with the information the customer needs to meet its own notification duties.
No system is perfectly secure, and we do not claim otherwise. What we commit to is the specific set of controls above, and to telling you promptly and honestly if one of them fails. To report a vulnerability or a suspected incident, write to yappertalkteam@gmail.com. We do not pursue legal action against good-faith security researchers who report through that address and give us reasonable time to fix the issue before disclosing it.
12.Biometric data
Voice is treated as a biometric identifier under laws including the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington My Health My Data Act, but only where it is used to identify a person. That distinction is the whole of this section.
YapperTalk converts speech to text. It does not derive a voiceprint, a voice template, a speaker embedding, or any other mathematical representation of the characteristics of a person’s voice. It does not identify, verify, or authenticate anyone by the sound of their voice, does not distinguish one speaker from another, and does not link a recording to an identity by its acoustic properties. Audio is decoded to text and discarded in the same request.
Accordingly, we do not collect, capture, store, or disclose biometric identifiers or biometric information as those terms are defined in those statutes, and we do not sell, lease, trade, or otherwise profit from biometric data. If that ever changes, we will publish a written retention and destruction schedule and obtain the written releases those laws require before collecting anything, and we will not apply the change retroactively.
13.Your rights
Depending on where you are, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct information that is inaccurate or incomplete;
- have information deleted;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format, or have it sent to another provider;
- withdraw consent where we rely on it, without affecting past processing;
- not be discriminated against for exercising any of these rights; and
- lodge a complaint with your data protection authority. In the EEA that is the authority where you live or work; in the UK it is the Information Commissioner’s Office. We would rather you came to us first, but you do not have to.
How to exercise them
Write to yappertalkteam@gmail.com. We will verify your identity in proportion to the sensitivity of the request, using the account information we already hold rather than asking for new identity documents where we can avoid it. We respond within 30 days, and within 45 days where a U.S. state law sets that period, and we may extend once where the request is complex, telling you why before the original deadline passes.
An authorized agent may submit a request on your behalf with written proof of authorization, and we may still contact you to confirm it.
There is no charge, unless a request is manifestly unfounded or excessive, in which case we will tell you why before doing anything and what the fee would be.
If you subscribed yourself, we act on your request directly. There is no intermediary and nothing to escalate.
If your employer deployed YapperTalk, we hold that data as a processor and cannot act on it unilaterally. Send your request to your employer’s privacy contact. If you send it to us instead, we will forward it to them, support them in responding, and tell you that we have done so.
Appeals
If we decline a request, we will explain why. Several U.S. state laws give you the right to appeal that decision: reply to our response, or write to yappertalkteam@gmail.com with “Appeal” in the subject line, and a person who was not involved in the original decision will review it and respond within 45 days with a written explanation. If we deny the appeal, we will give you a link or address to complain to your state attorney general.
14.Additional disclosures for U.S. states
California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island give residents privacy rights. The rights in section 13 are available to residents of every state that grants them, whether or not that state is named here.
- Categories collected. Identifiers, professional and employment information, commercial information, internet and network activity information, audio information, and inferences drawn for accuracy improvement. The detail is in section 3.
- Sensitive personal information. Dictated audio and its transcript may contain whatever the speaker chose to say, which can include categories a state treats as sensitive. We do not use or disclose that content for any purpose other than providing the Service, which means we do not use it for the purposes that would trigger a right to limit its use under the California Consumer Privacy Act.
- No sale, no sharing, no targeted advertising. We have not sold or shared personal information for cross-context behavioral advertising, and we do not process it for targeted advertising or profiling that produces legal or similarly significant effects, in the preceding twelve months or at all. Because we do not, there is nothing for a “Do Not Sell or Share My Personal Information” link to switch off, and we honor Global Privacy Control signals as a matter of course.
- Retention. Section 10 sets out how long each category is kept.
- Service provider status. For data we process on behalf of a customer organization, we are a service provider or processor under those laws. We do not retain, use, or disclose it for any purpose other than performing the services, and we do not combine it with data from other sources except as those laws permit.
15.If you use YapperTalk at work
This section applies only if your employer deployed YapperTalk rather than you subscribing yourself. If you subscribed yourself, it does not apply to you, and we are your controller.
Your employer decides whether to deploy the Service, who gets a seat, which features are on, and what its own policies say about dictation. It is the controller of your data in the Service, and it, not us, is the right place to take a question about why the tool is in use, what your employer can see, or a request to access or delete your data.
What we can tell you directly is what we do with it, and that is the rest of this policy. Your dictated audio is not stored. Your transcripts are not logged by us. We do not tell your employer what you said, because we do not have it. Your employer’s administrators can see that your seat exists, which devices it is registered to, and whether it is active. They cannot retrieve the content of your dictations from us, because it is not there to retrieve.
Whether your employer was required to notify you before deploying the Service, and whether it needed your consent, is a question of the law where you work. Our Terms of Service require every customer to handle that before turning the Service on.
17.Automated decision-making
Transcription and rewriting are automated, and they produce text. They do not produce decisions about people. We do not carry out profiling or automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not evaluate, score, or rank the people who use the Service.
Because transcription is probabilistic, its output can be wrong. That is a product limitation, described in section 14.3 of the Terms of Service, and it is why the Terms require a person to review output before it is relied on.
18.Children
The Service is a business tool sold to organizations. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a child’s information has reached us, write to yappertalkteam@gmail.com.
19.Changes to this policy
We will update this policy as the Service changes. When we do, we will change the “last updated” date at the top and post the new version at yappertalk.com/privacy.
If a change materially reduces the protections described here, including any change to what we retain, who processes data, or the commitments in section 4, we will give at least 30 days’ notice before it takes effect, by email to customer administrators and by a notice on the site, so that anyone who objects has time to act. We will not apply a materially less protective policy retroactively to data we already hold.
Earlier versions are available on request to yappertalkteam@gmail.com.
20.Contact us
Privacy questions, data subject requests, and appeals: yappertalkteam@gmail.com
Security reports: yappertalkteam@gmail.com
Legal notices: yappertalkteam@gmail.com
YapperTalk LLC
Los Angeles, California
We do not currently maintain an establishment in the European Economic Area or the United Kingdom. If you are located in either and wish to raise a matter under the GDPR or UK GDPR, write to yappertalkteam@gmail.com and we will respond within the statutory period. Should our activities come to require a representative under Article 27 of the GDPR or UK GDPR, we will appoint one and name them here before that obligation takes effect.