Terms and Privacy

The intended data controller is [[LEGAL_ENTITY_NAME]], [[LEGAL_FORM_AND_SHARE_CAPITAL]], with registered office at[[REGISTERED_OFFICE]], registered under[[RCS/SIREN]] (“Dictum”, “we”, “us”, or “our”).

For questions, privacy requests, or complaints, contact[email protected]. We have not appointed a Data Protection Officer unless this Policy is later updated to identify one.

This Policy applies to dictumflow.com, the Dictum dashboard, public demonstrations, SDK infrastructure, support interactions, billing administration, and related online Services. It does not govern a Customer's own website, application, webhook recipient, or independently selected BYOK provider.

Dictum acts as an independent controller for website security, account administration, customer relationships, billing, fraud prevention, legal compliance, and its own service operations. Dictum acts as a processor when it handles Customer Content—such as audio, transcripts, end-user identifiers, prompts, or keywords—solely on a Customer's instructions. Processor activities are governed by theData Processing Addendum.

Customers are responsible for their end users and normally act as controller for audio and other personal data submitted through their integrations. End users should first direct requests about Customer Content to the relevant Customer.

We do not intentionally collect government identifiers, payment-card numbers, precise location, or special-category data for our own purposes. If a Customer or speaker submits sensitive information, that information forms part of Customer Content.

We do not sell personal data, share it for cross-context behavioural advertising, or use Customer audio or transcripts to train Dictum models. We do not make decisions producing legal or similarly significant effects about account users through automated profiling.

Dictum transports audio only for the requested transcription. In the Managed flow, capture completes before audio is sent to AWS Bedrock for In-Region processing inAWS Europe (Ireland), region eu-west-1, using Voxtral Mini 3B 2507. In BYOK mode, it is sent to the provider selected and funded by Customer. The resulting transcript is returned to the SDK client and, if Customer enables it, placed temporarily into a bounded Cloudflare Queue for signed delivery to Customer's webhook.

Dictum does not write raw audio or transcript text to its Supabase database, Durable Objects, or application logs. Transcript text leaves Dictum only through the SDK response and an optional Customer-configured webhook. When temporary in-memory, streaming, retry, or dead-letter handling retains content, it does so only for the time technically necessary to complete or troubleshoot the requested delivery.

Signed end-user identities are supplied by Customer. Dictum stores or records only the limited identifiers and hashes needed to authorise sessions, enforce configured quotas, and attribute usage; it does not treat the signed identity as a Dictum user account.

Dictum's AWS Bedrock environment is configured for zero data retention. AWS does not write model inputs or outputs to durable storage, share them with the underlying model developer, or use them to train foundation models. AWS model invocation logging for Customer Content is disabled, subject only to processing or preservation AWS is legally required to perform.

We disclose only the data reasonably necessary to the following recipients:

• Cloudflare for Pages hosting, Workers, network security, queues, logs, and Turnstile.
• Supabase for authentication, PostgreSQL account and project records, and encrypted Vault secrets.
• Amazon Web Services for Managed transcription through Amazon Bedrock in AWS Europe (Ireland), region eu-west-1.
• Stripe for checkout, subscriptions, invoices, tax and payment administration.
• Apple, Google, or GitHub if an account user elects to sign in through that provider.
• Customer-selected BYOK providers and webhook recipients at Customer's express direction.
• Professional advisers, acquirers, courts, regulators, or authorities where reasonably necessary and lawful.

The DPA contains the subprocessors applicable when Dictum acts as processor. Dictum reserves the right to change its subprocessors, their functions, or their processing locations after providing advance notice as described in the DPA.

• Raw audio and transcript text are not retained in Dictum's database or application logs after the requested flow, subject to temporary webhook delivery handling.
• Detailed pseudonymous usage events are automatically purged after 7 days.
• Account, project, credential, and configuration data remain while the account or feature is active and are deleted or deactivated following an eligible deletion request.
• Cloudflare Workers operational logs exclude raw audio and transcript text and are retained for no longer than 7 days.
• Dictum retains invoices, transaction evidence, and required accounting records for 10 years after the end of the relevant financial year, as required by French law.
• Support, dispute, fraud, and security records remain only as long as reasonably necessary for the applicable purpose and limitation period.

Managed audio and transcripts are processed exclusively in AWS Europe (Ireland), region eu-west-1. Cloudflare processes network and security data through its global network. Supabase processes account and project data in the configured project region. Stripe and the OAuth provider selected by the user process payment or authentication data under their respective privacy terms.

Subject to applicable law, you have the right to request access, correction, deletion, restriction, portability, or a copy of your personal data; object to processing based on legitimate interests; withdraw consent where consent is the basis; and complain to a supervisory authority. In France, the lead authority is theCNIL.

Account holders can view their account identity, update their billing details, and delete their account through the authenticated dashboard. Where applicable law grants an additional privacy right that is not available through the dashboard, the request must be submitted using the contact details in Section 1. If the request concerns Customer Content, we will normally direct it to or assist the relevant Customer.

The Services are for professionals and are not directed to children. We do not knowingly create accounts for anyone under 18.

Dictum does not currently use advertising cookies or non-essential audience trackers. The Services use browser session storage and strictly necessary security technologies for authentication, SDK identity caching, service continuity, and abuse prevention. If non-essential tracking is added, this Policy and the consent mechanism will be updated before activation where required.

Cloudflare Turnstile

Dictum uses Cloudflare Turnstile to protect the voice demonstration and its SDK identity issuance against automated abuse. Depending on Cloudflare's risk assessment, verification runs invisibly or requests an interaction from the user. Cloudflare processes security signals including IP address, TLS fingerprint, user-agent header, site key, and associated origin to detect automated abuse and improve Turnstile. See theCloudflare Turnstile Privacy Addendum.

Dictum uses safeguards designed for the nature of the data, including encrypted transport, secrets-vault storage, access controls, service isolation, credential redaction, bounded requests, signed identities and webhooks, quotas, monitoring, and account deletion controls. No system is completely secure, and we cannot guarantee absolute security.

Dictum reserves the right to update this Policy prospectively. Material changes will be announced through the Service or sent to the account email. The effective date above identifies the current version.

This DPA is between the Customer identified by the applicable account, order, or signed agreement (“Customer”) and [[LEGAL_ENTITY_NAME]] (“Dictum”). It applies when Dictum Processes Customer Personal Data to provide the Services. Capitalised terms not defined here have the meanings in theTerms and Conditions.

“Data Protection Law” means the GDPR, UK GDPR, French Data Protection Act, and other privacy or data-protection law applicable to the Processing. “Customer Personal Data” means Personal Data contained in Customer Content or otherwise Processed by Dictum on Customer's behalf. “Controller”, “Processor”, “Process”, “Personal Data”, “Data Subject”, “Personal Data Breach”, and “Subprocessor” have the meanings under applicable Data Protection Law.

Customer is Controller or Processor, as applicable. Dictum is Customer's Processor or Subprocessor. Each party is independently responsible for its own controller activities. The subject matter, duration, nature, purposes, data types, and Data Subjects are in Annex I.

Dictum will Process Customer Personal Data only on documented instructions from Customer, including these Terms, Customer's configuration and API calls, an order, and further lawful written instructions accepted by Dictum. Dictum will immediately inform Customer if, in its opinion, an instruction violates Data Protection Law, unless prohibited.

Dictum Processes data when required by EU, Member State, or other applicable law. Where legally permitted, Dictum will notify Customer before that Processing. Dictum will ensure persons authorised to Process Customer Personal Data are subject to confidentiality and receive appropriate privacy and security instruction.

Customer is responsible for the lawfulness, fairness, accuracy, and transparency of its Processing; all required notices and lawful bases; Data Subject requests; the legality of recording and transcription; its chosen providers and webhooks; and ensuring its instructions comply with Data Protection Law. Customer will not instruct Dictum to Process data in violation of law.

Taking into account the state of the art, implementation cost, nature, scope, context, purposes, and risks, Dictum will maintain the technical and organisational measures in Annex II. Dictum reserves the right to replace a measure with an equally or more protective measure without reducing overall security.

Dictum will notify Customer within 24 hours after becoming aware of a suspected or confirmed Personal Data Breach affecting Customer Personal Data. The notice will include information reasonably available about the nature of the breach, affected data and people, likely consequences, mitigation, and a contact point. When complete information is not available with the initial notice, Dictum provides the remaining information in phases. Notification is not an admission of fault.

Customer is responsible for securing its applications, end-user devices, credentials, identity signing process, webhook destination, and provider accounts, and for promptly notifying Dictum of suspected compromise relevant to the Services.

Customer gives general written authorisation for Dictum to engage the Subprocessors in Annex III. Dictum will require each Subprocessor to protect Customer Personal Data under written terms substantially no less protective than this DPA for the relevant Processing. Dictum remains responsible for its Subprocessors to the extent required by Data Protection Law.

Dictum will inform Customer of an intended addition or replacement of a Subprocessor before the change takes effect, giving Customer the opportunity to object on reasonable data-protection grounds.

Where Customer Personal Data is transferred from the EEA, United Kingdom, or Switzerland to a country without an applicable adequacy decision, the parties incorporate the appropriate 2021 European Commission Standard Contractual Clauses, UK International Data Transfer Addendum, or Swiss adaptations. The applicable module is Controller-to-Processor or Processor-to-Processor according to Customer's role. This DPA and its annexes complete the relevant appendices; the law and courts specified in the Terms apply where the clauses permit.

A BYOK provider selected and contracted directly by Customer is a Customer-appointed recipient. Customer instructs Dictum to transmit Customer Personal Data to that provider and is responsible for the provider's terms, lawful transfer mechanism, retention, and security configuration.

Taking into account the nature of Processing, Dictum will provide reasonable assistance through technical measures and information so Customer can respond to Data Subject requests. Dictum will not independently respond regarding Customer Personal Data unless instructed or legally required and will redirect the requester to Customer where practical.

Dictum will reasonably assist Customer with security obligations, breach notifications, data-protection impact assessments, and prior consultation, taking into account the information available to Dictum.

Dictum will make available information reasonably necessary to demonstrate Article 28 compliance. No more than once annually, unless required by a regulator or following a material breach, Customer has the right to request an audit by an independent qualified auditor bound by confidentiality. Audits require at least 30 days' notice, must avoid disruption and access to other customers' data, and are at Customer's cost unless they reveal a material Dictum breach.

During the agreement, Customer can retrieve outputs delivered through the SDK or its webhook and manage account data through available tools. At termination or eligible account deletion, Dictum will delete or render inaccessible Customer Personal Data unless Customer requests return before deletion or law requires retention.

Dictum does not maintain a database archive of raw audio or transcript text. Customer Personal Data present in a provider backup, security record, or webhook retry system remains protected until it is overwritten or expires under the applicable retention cycle.

The liability provisions in the Terms apply to this DPA, except where Data Protection Law requires otherwise. If this DPA conflicts with the Terms on Processing of Customer Personal Data, this DPA controls. Standard Contractual Clauses control over both where they expressly require.

• Encryption in transit using HTTPS/WSS and provider-secure transport.
• Provider API keys and webhook secrets stored in Supabase Vault with only prefixes exposed to the dashboard.
• Least-privilege service bindings, restricted internal routes, scoped credentials, and separated production services.
• Signed project identities, bounded token lifetime, domain controls, per-session and daily quotas, request validation, and rate or abuse controls.
• No raw audio or transcript text in Supabase tables, Durable Objects, or application logs; diagnostic fields are minimised and credentials are redacted.
• Signed webhook payloads, bounded queue messages, retry controls, dead-letter handling, and encrypted persistent secret retrieval.
• Role-based account access, Supabase row-level security, ownership checks, credential rotation, and hard account-deletion controls.
• Short retention for detailed usage and operational logs, monitoring, incident investigation, dependency error isolation, and recoverable infrastructure configuration.

Managed transcription uses AWS Bedrock In-Region processing in AWS Europe (Ireland), region eu-west-1, with zero data retention active and AWS model invocation logging for Customer Content disabled. AWS does not write model inputs or outputs to durable storage or share them with the underlying model developer, subject only to processing or preservation AWS is legally required to perform. Dictum does not claim a security certification that it has not obtained.

Stripe and OAuth providers process controller-side account or payment data as described in the Privacy Policy rather than Customer audio under this DPA.