Privacy policy

This is a translation for your convenience. The German version of this Privacy Policy is the legally binding one.

This Privacy Policy explains how we process personal data when you visit the website scribewing.app or use the dictation app Scribewing. Sections 7 to 12 concern the account and the app. They apply from the launch of Scribewing.

1. Controller

Schild Roth SEO Agentur GmbH

Bismarckstr. 1-3

50672 Köln (Cologne)

Germany

• Represented by: Timothy Scherman (managing director)
• Phone: +49 221 29850420
• Email: support@scribewing.app

Please send questions about data protection and requests concerning your rights to the email address above.

2. The essentials at a glance

• The website uses no tracking, no analytics and no advertising. It loads no fonts, scripts, maps or videos from third parties.
• The website runs on a server in Germany.
• Your dictation is transmitted with TLS encryption. It passes through our server in the EU to a speech recognition service in the EU.
• We do not store audio.
• The import from your mailbox is analysed locally on your device. Only the terms you confirm are transmitted.

3. Visiting the website and server log files

When you open the website, the web server processes technical data. This includes in particular: IP address, date and time of the request, requested address, amount of data transferred, status code, the previously visited page (referrer), and information about browser and operating system.

We need this data to deliver the website, to fix faults and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and stable operation of the website.

The website is hosted by Keyweb AG in Germany. The log files are stored only for a limited period and are then deleted. They are kept longer only where this is necessary to investigate a specific security incident. We do not combine log data with other data about you.

4. Cookies and consent management

The website sets no cookies for analytics or advertising. It uses only one technically necessary cookie of the consent management tool. This cookie stores your choice in the consent dialog, so that we do not have to ask you again on every page.

The legal basis for storing this cookie is Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The legal basis for the subsequent processing is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR (proof of consent) and Art. 6 (1) (f) GDPR.

If we use services in the future that require consent, we will ask you beforehand in the consent dialog. You can change your choice there at any time.

We use the consent tool “Borlabs Cookie” to manage your consent. It runs on our own server; no data is transmitted to its vendor. The tool stores your choice in a technically necessary cookie (borlabs-cookie) in your browser so that you are not asked again on every page view. The legal basis is Section 25 (2) no. 2 TDDDG and Art. 6 (1) (c) and (f) GDPR. You can change your choice at any time via the link “Cookie settings” in the footer. At present the website does not use any services that require consent.

5. “Early access” form

You can use the form to sign up for a notification about the launch of Scribewing. We process:

• your email address (required),
• your operating system (optional),
• your consent, the time of submission and the address of the page from which the form was sent, as proof. We do not store the IP address or the browser identification with your submission.

The purpose is a one-time notification about the launch and about access to the app. We do not use the details for other advertising and do not pass them on for advertising purposes.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future. An email to support@scribewing.app is sufficient. Processing up to the withdrawal remains lawful.

The submission is stored in the database of the website and sent by email to our mailbox support@scribewing.app. Website and mailbox are on the same server at Keyweb AG. We delete the details when you withdraw your consent or when we have notified you and the purpose has been achieved.

6. Contact by email

When you write to us, we process your email address, the content of your message and the technical data of the email. The purpose is to handle your request. The legal basis is Art. 6 (1) (b) GDPR if the request concerns a contract or steps prior to a contract. In all other cases it is Art. 6 (1) (f) GDPR. Our legitimate interest is answering enquiries.

7. Account, sign-in and usage volumes

You need an account to use the app. For this we process your account data. This includes in particular your email address, your plan, the identifier of your account, your registered devices, and the times of registration and sign-in.

Sign-in runs through the sign-in service Auth0 of the provider Okta. Auth0 processes your sign-in data and technical data about the sign-in, for example IP address and time. This helps to protect accounts and to detect misuse.

We also count your usage volumes, meaning dictated words and hours. We need these figures to calculate and display the allowances of your plan.

When the app communicates with our server, technical connection data is generated. This includes IP address, time, app version and operating system. We use it for operation, troubleshooting and security.

The legal basis is Art. 6 (1) (b) GDPR (contract for the use of Scribewing). For the security of the service it is Art. 6 (1) (f) GDPR.

8. Payment and billing

Payments for paid plans are handled by the payment service provider Stripe. You enter your payment details with Stripe during checkout. Stripe processes in particular name, email address, billing address, payment method and payment details, amount and time. Business customers also provide company name and VAT identification number.

We receive from Stripe the information we need for the contract and for bookkeeping. This includes the payment status, the plan booked and the invoice data.

The legal basis is Art. 6 (1) (b) GDPR. For the retention of invoices and accounting records it is Art. 6 (1) (c) GDPR in conjunction with commercial and tax law. Stripe also processes some data as an independent controller, for example for fraud prevention and to meet its own legal obligations. Details are set out in Stripe’s privacy policy.

9. Dictation: processing of audio and text

Scribewing converts your spoken language into text. Recognition does not run on your device but on servers. Your data takes the following path:

1. You start the recording with the key and speak. The app records audio only while the recording is running.
2. The app transmits the audio with TLS encryption to the Scribewing server in the EU.
3. Our server forwards the audio via TLS to the speech recognition service AssemblyAI. We use AssemblyAI’s EU endpoint for this. Our server does not store the audio.
4. AssemblyAI recognises the text and cleans it up automatically (punctuation, capitalisation, paragraphs).
5. The text returns to the app through our server. The app inserts it into the application that is currently active on your device.

AssemblyAI acts for us as a processor and processes audio and text in order to provide the speech recognition. We name the company here so that you know the recipient of your data.

The data processed is your voice as an audio signal, the content of what you say and the recognised text. The content depends solely on what you dictate. Please dictate information about other people only if you are entitled to do so.

The legal basis is Art. 6 (1) (b) GDPR. If your dictation contains information about third parties and you use Scribewing professionally, you are responsible for that information yourself. We offer Team customers a data processing agreement (see section 11).

10. Vocabulary and mailbox import

You can store your own terms, for example technical terms, names and product names. We store these terms in your account. Where recognition requires it, we transmit terms together with the dictation to the speech recognition service. If you train a term with a voice sample, this sample is processed like a dictation.

When you import from documents, the app suggests terms to you. Only the terms you accept are added to your vocabulary.

When you import from your mailbox, the app analyses your sent emails locally on your device. Only the terms you confirm are transmitted to our server. Your emails themselves are not transmitted to us.

The legal basis is Art. 6 (1) (b) GDPR. You can change or delete terms at any time.

11. Team features

In the Team plan we additionally process membership of a team, your role in the team, invitations with the email address of the invited person, and the shared team vocabulary. The team vocabulary can be used by the members of the team. The team administration sees the members, their roles and the information needed for seats, allowance and billing.

The legal basis is Art. 6 (1) (b) GDPR in relation to the Team customer and Art. 6 (1) (f) GDPR in relation to the members. Our legitimate interest is providing the team features.

If you use Scribewing through a team of your employer or client, they may be the controller for the processing of the dictated content. In that respect we act as a processor under Art. 28 GDPR. Please contact your team administration first with questions about this.

12. Emails about the contract

We send you emails that are necessary for the account and the contract. Examples are confirmations, notices about payment and plan, invitations to a team and important notices about the service. We use the service provider Brevo to send them. For this purpose Brevo processes your email address, the content of the message and delivery data. The legal basis is Art. 6 (1) (b) GDPR. We do not send a newsletter.

13. Recipients and processors

We use the following service providers. Processors may process data only on our instructions and on the basis of a contract under Art. 28 GDPR.

Beyond this, we pass on data only if we are legally obliged to do so or if it is necessary to enforce legal claims. Recipients may then be authorities, courts, tax advisers and lawyers.

14. Transfers to third countries

We process your data on servers in the EU. Some service providers are based in the USA or belong to a group of companies from the USA. This concerns AssemblyAI, Okta (Auth0) and Stripe. Access from a third country therefore cannot be ruled out, for example for maintenance and support.

Where data is transferred to third countries, this takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or of appropriate safeguards (Art. 46 GDPR). For the USA, the adequacy decision on the EU-U.S. Data Privacy Framework may apply, provided the recipient is certified under it. Appropriate safeguards are in particular the standard contractual clauses of the European Commission. We will tell you the basis in each case on request.

15. Storage period

We store personal data only for as long as the respective purpose requires.

• Audio: we do not store it.
• Account data, vocabulary and team data: for the lifetime of the account. After the account is deleted, we delete this data unless a statutory retention obligation applies.
• Usage volumes: as long as we need them for allowances and billing.
• Invoices and accounting records: for the statutory periods under commercial and tax law. These are currently up to ten years.
• Entries in the “Early access” form: until you withdraw consent or until the purpose has been achieved.
• Emails: as long as handling the matter requires and statutory obligations demand.
• Server log files: for a limited period (see section 3).

How long our service providers keep data in their systems depends on our agreements with them and on their documentation. We will give you information about this on request.

16. Your rights

You have the following rights in relation to us:

• access to your data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

Right to object: Where we process data on the basis of Art. 6 (1) (f) GDPR, you can object to the processing on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, an email to support@scribewing.app is sufficient.

17. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You may contact the authority at your place of residence. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)

Kavalleriestr. 2-4

40213 Düsseldorf, Germany

Phone: +49 211 38424-0

Email: poststelle@ldi.nrw.de

18. Obligation to provide data and automated decisions

You are not obliged to provide us with data. Without an email address, however, we cannot create an account or notify you. Without the transmission of audio, speech recognition is not possible.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

19. Version and changes

Version: November 2026.

We update this Privacy Policy when the website, the app or the legal situation changes. The version available on this page applies. You can find more information about security on the page Privacy and Security.