Privacy policy

This privacy policy explains how helpful bits GmbH processes personal data when you visit screenwhisper.ai and when you use the ScreenWhisper Mac app and its online services.

1. Controller and contact

The controller under the GDPR is:

Email: info [at] helpfulbits.com
Phone: +49 171 4709677

We have not appointed a data protection officer. Send privacy questions and requests to the email address above.

2. Summary

• Your recordings, results, and dictation history are saved on your Mac.
• A recording, a dictation, or a text leaves your Mac only when you process it. It goes to the ScreenWhisper server of your region and from there to Google Gemini. The server does not save the content and deletes its copies after each request.
• For your account, we keep your email address, your name, and your sign-in ID.
• Stripe processes your payments. We do not see or store your card number.
• The website has no analytics, no advertising, and no tracking cookies.

3. Website

Hosting and server logs

The website runs on a server of InterServer, Inc. in the United States. Cloudflare, Inc. sits in front of the website as a proxy and protects it against attacks. When you open a page, your browser sends technical data: IP address, date and time, the page you request, the referring page, and browser and operating system information. The web server writes this data to a log file. The log files are deleted after 14 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website securely and to find and fix errors and attacks.

Storage on your device

The website sets one cookie, NEXT_LOCALE, which stores the page language. When you choose a light or dark theme, the website saves the choice in your browser's local storage under the key theme. Both are necessary to show the website in the way you asked for (§ 25(2) no. 2 TDDDG). They are not used to identify you. You can delete them in your browser settings at any time.

The website does not use analytics tools, advertising tags, or social media plug-ins.

Email

When you write to us, we use your email address and your message to answer you. Legal basis: Art. 6(1)(b) GDPR if your message is about a contract, otherwise Art. 6(1)(f) GDPR. We delete the messages when the matter is closed, unless the law requires us to keep them.

4. Data on your Mac

The app saves these data only on your Mac, in the folder ~/Library/Application Support/com.screenwhisper: your screen recordings with audio, your goals and instructions, the results, your dictation history and vocabulary hints, your settings, and a local error log. The error log is deleted after 30 days. The other data stay until you delete them. When you remove an entry from the list in the app, the video file stays in the videos folder. To delete the recordings completely, delete the files in that folder. The app saves your sign-in token in the macOS keychain.

Dictation audio is saved as a temporary file and deleted after it is sent for transcription.

5. Server region

We operate two servers: one in Germany at Hetzner Online GmbH (api-eu.screenwhisper.ai) and one in the United States at InterServer, Inc. (api-us.screenwhisper.ai). Each server has its own database. When you first start the app, it asks screenwhisper.ai and Cloudflare (www.cloudflare.com/cdn-cgi/trace) for your country. These requests send your IP address to our website server and to Cloudflare. If you are in North America, the app uses the US server. Everywhere else, it uses the EU server. You can change the region in Settings at any time. Your account data and usage records are stored on the server of your region.

Legal basis: Art. 6(1)(b) GDPR (providing the service) and Art. 6(1)(f) GDPR (a fast connection close to you).

6. Account and sign-in

You sign in with Google, GitHub, Microsoft, or Apple. The sign-in runs through Auth0, a service of Okta, Inc. Our Auth0 tenant is in the EU region. We receive your email address, your name, and a sign-in ID from the provider. We need a verified email address. We do not receive your password. We store your email address, name, sign-in ID, an encrypted refresh token, and the date of creation. The server issues an access token that is valid for one day.

The sign-in provider you choose processes data under its own privacy policy as a separate controller. Legal basis: Art. 6(1)(b) GDPR. We keep the account data until you delete your account (see section 12).

7. AI processing with Google Gemini

The app sends content to the server of your region only when you start one of these actions:

• Process a recording: the video file with its audio track, your goal, your feedback and the previous result if you ask for a new version, and the length and frame rate of the video.
• Dictation: the recorded audio, the language, and your vocabulary hints.
• Rewrite a transcript: the transcript text and your instruction.

A recording can show anything that is on your screen and anything that you or other people say. Do not record content that you are not allowed to share, and stop or cut the recording before sensitive content.

The server sends the content to the Gemini API of Google LLC (generativelanguage.googleapis.com) with a paid API key and returns the result to your Mac. Large videos are uploaded through the Gemini Files API. The server writes the video to a temporary file during the request. After the request, successful or not, the server deletes the temporary file and the file at Google. The server does not save recordings, audio, prompts, transcripts, or results.

Under the Gemini API Additional Terms of Service for paid services, Google does not use prompts, files, or responses to improve its products. Google processes them as our processor under its data processing terms. Google logs prompts and responses for a limited period only to detect violations of its prohibited use policy. Google can store data temporarily in any country where it has facilities.

Legal basis: Art. 6(1)(b) GDPR. Without this processing, we cannot give you the result.

8. Credits and payments

You buy prepaid credits in the app. Payment runs through Stripe Checkout. Stripe collects your card or other payment details, your billing address, and, if you enter it, your VAT ID. Stripe calculates the tax. We send Stripe your email address, your name, and your user ID. We store your Stripe customer ID, your credit balance, your purchases with amount, fee, and Stripe charge ID, your invoices, and your automatic top-up settings. If you turn on automatic top-up, Stripe saves your payment method and we charge it when your balance falls below your threshold. Stripe sends the receipts.

For customers in the EEA, Stripe Payments Europe, Limited (Ireland) is responsible. Stripe also processes data as its own controller, for example for fraud prevention and legal duties. See the Stripe privacy policy.

Legal basis: Art. 6(1)(b) GDPR for the payment and Art. 6(1)(c) GDPR for tax and accounting duties. Commercial and tax law (§ 147 AO, § 257 HGB) requires us to keep accounting records for up to 10 years. These records stay at Stripe and in our accounting after you delete your account.

9. Usage records and security logs

For each AI request, the server records your user ID, the model, the token counts, the cost, a request ID, the status, the duration, the file size, and the time. These records do not contain the content of your request. We use them to charge credits, to show your usage in the app, and to find errors. Legal basis: Art. 6(1)(b) GDPR. We delete them when you delete your account.

For security, the server records account events with IP address and browser or app information. The system log of the servers contains the email address at sign-in and the user ID of some requests. System logs are deleted after 90 days at the latest. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to protect the service and your account against misuse.

10. Downloads and updates

The installer and the update information are delivered through Amazon CloudFront, a service of Amazon Web Services, Inc. When you download the app or when the app checks for an update, CloudFront receives your IP address and the requested file. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (secure and current software).

11. Recipients and transfers to third countries

• Hetzner Online GmbH, Germany: EU server and database.
• InterServer, Inc., United States: US server and database, website hosting.
• Cloudflare, Inc., United States: proxy for the website and the API, country lookup.
• Okta, Inc. (Auth0), United States, EU tenant: sign-in.
• Google LLC, United States: Gemini API.
• Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., United States: payments.
• Amazon Web Services, Inc., United States: downloads and updates.

InterServer, Cloudflare, Okta, Google, Stripe, and Amazon Web Services state on their own websites that they are certified under the EU-U.S. Data Privacy Framework. Transfers to them rely on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Google also uses the EU Standard Contractual Clauses where needed. If you use the US server, your account data and usage records are stored in the United States. Contact us if you want information about the safeguards for a transfer.

We do not sell personal data and we do not use it for advertising.

12. Retention and deleting your account

We keep account data, credit balance, purchases, and usage records while your account exists. To delete your account, write to us from the email address of your account. We then delete your account, credits, purchases, invoices, usage records, and account events from our database and delete your sign-in record at Auth0. Records that the law requires us to keep stay at Stripe and in our accounting for the legal period. Data on your Mac stays there until you delete it.

13. Your rights

You have these rights under the GDPR:

• Access to your data (Art. 15)
• Correction of wrong data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21): you can object at any time, for reasons that come from your particular situation, to processing that we base on Art. 6(1)(f) GDPR.
• Withdrawal of a consent at any time, with effect for the future (Art. 7(3))

To use these rights, write to info [at] helpfulbits.com. You can also complain to a data protection supervisory authority, for example the authority where you live or work. The authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Other information

You do not have to give us personal data. Without an account, you cannot use the AI functions. We do not use automated decision-making or profiling under Art. 22 GDPR. The service is for people aged 18 or older.

We will update this policy when the app or the services change. The date at the top shows the current version.