Privacy Policy

Last updated: October 9, 2026

1. Who we are, and what our role is

TranscriptMe is operated by TranscriptMe Inc., a corporation formed in the State of Delaware, United States, with registered office at 1000 N. West Street, Suite 1501, Wilmington, DE 19801. We are a US company serving lawyers in Brazil. Brazil's data protection law, the LGPD, therefore applies in full to what we do, under its article 3, II — the law reaches the processing of data of people in Brazil regardless of where the processor sits. We have appointed a representative in Brazil, named in section 11. TranscriptMe is an evidence investigation tool for lawyers. You import a case's documents, recordings and conversations, and we extract, transcribe, index and help you find what matters. That creates a distinction that matters legally: For your account, we are the controller. We decide what to collect so you can sign in, be billed, and use the service. For the content you import, you are the controller and we are the processor. You decide which evidence to upload, for what purpose, and for how long. We handle that content on your instructions and never for purposes of our own. In practice: your case's evidence is yours, and the responsibility for holding and using it is yours. Ours is to keep it carefully, process it only for what you asked, and return or delete it when you say so.

2. What we collect

Your account data — email, name and profile picture (when signing in with Google), the organisation you belong to and your plan. The content you import — documents, PDFs, images, audio, video and conversation exports. From these we derive extracted text, transcripts, summaries, image descriptions and the vector representations used for search. Technical records — IP address, browser, session identifier, and a log of which actions were taken in each case (who opened which file, and when). That audit trail exists because in an evidence product, knowing who accessed what is part of the material's integrity. Approximate country of access — at sign-up and at each sign-in, we record the country the connection came from (only the two-letter country code, such as "BR"), worked out from the IP address on our own server, without sending the address to anyone. The address is not stored with that record. We use it to know which countries our customers come from. This site or product includes IP2Location LITE data available from https://lite.ip2location.com. Application errors — when something fails, the error report goes to Sentry (see section 5). It may contain fragments of data present at the moment of failure. Use of the public site, only with your permission — since October 9, 2026 the public pages (the home page, the blog, the sign-up and sign-in pages) use Google Tag Manager and Google Analytics 4 to learn how many people visit, where they come from and at which step of the sign-up they stop. This only happens after you click "Accept" in the cookie bar; without that, nothing is measured and no Google cookie is set. What Google Analytics receives is page views and seven navigation events (sign-up started and completed, e-mail confirmed, sign-in, pricing seen, checkout started, blog article opened), with the IP address anonymised by Google Analytics 4 itself. We never send your e-mail, your name, your user identifier or any case content. The case area, where the evidence lives, has no script from Google or from any other third party. The data is processed by Google in the United States. We do not collect browsing data for advertising and we use no advertising cookies.

3. On what legal basis

We process personal data on these bases under article 7 of the LGPD: Performance of a contract — to create your account, authenticate you, process the content you import, and bill for the service. Compliance with a legal obligation — to keep tax and access records where the law requires it. Legitimate interest — to keep the service secure, investigate abuse and fix defects. Wherever that is the basis, it yields to your right to object. For the content you import, the legal basis is yours to determine, because you are that material's controller. Evidence commonly involves third parties and, often, sensitive data — health, political opinion, criminal proceedings. It is for you to have grounds to process it, typically the regular exercise of rights in legal proceedings.

4. How we use it

The content you import is used only to deliver the service you signed up for: - Extract and index — to make the material searchable by text and by meaning. - Transcribe and describe — audio becomes text, images get descriptions. - Answer questions — the chat consults your own material to answer, always citing where the answer came from. We do not sell data. We do not use your content to train AI models, and we do not allow our suppliers to — the API contracts we use forbid training on submitted content. We do not read your content. Technical access exists only to operate and repair the service, is logged, and happens only when necessary.

5. Who else processes your data

To work, TranscriptMe sends data to these processors. The list is complete and is updated when it changes: - Anthropic (Claude) — text excerpts and images, for summaries, descriptions and chat answers. - OpenAI — audio files for transcription (Whisper) and text for vector representations. - Mistral — PDF pages, for optical character recognition. - DigitalOcean — servers and database (New York), and storage of imported files. - Backblaze — second copy of backups, encrypted by us before it leaves the server. - Microsoft — access to your OneDrive, only if you connect the account. - Google — authentication, only if you choose to sign in with Google; and, on the public pages, Google Tag Manager and Google Analytics 4, only if you accept in the cookie bar (section 12). - Stripe — payments. Card details go straight to them; we never see them. - Resend — service emails (verification, password reset, notices). - Sentry — application error reports.

6. Where the data lives, and how it is protected

Servers in the United States, on DigitalOcean. The database is managed and sits on a private network, not exposed to the internet. Separation between cases — there is one database, and every row carries the case it belongs to. Isolation is enforced by the database itself, through row-level security: a query made without your case's context returns nothing. It is not a database per customer; it is a rule the database applies to every query, including ours. Files — documents and recordings live in versioned object storage, not on the server's disk. Access is always through a signed, temporary URL valid for two hours. In transit — HTTPS throughout. At rest — the access tokens for your OneDrive are encrypted in the database with AES-256-GCM, using a key that is not kept in the database. Backups are encrypted before leaving the server, with a key the storage providers do not hold. Backups — daily, in two clouds run by different companies, with the file immutable for the retention period. Every restore is logged.

7. Where processing happens

Your data is processed outside Brazil from the very first moment. The controller is American, servers and database are in New York, backups sit in two clouds in the United States, and the AI suppliers process in the countries where they operate. This is not data leaving Brazil: it originates under a foreign controller. The processing is nonetheless subject to the LGPD, and sharing with each supplier relies on article 33, VI — necessary to perform the contract you entered into with us — and on contractual clauses with each of them. Say so before importing any evidence if that is incompatible with a requirement of your firm, your client, or a particular case. It is a legitimate and common restriction, and better known before the first file.

8. How long we keep it, and how we delete it

While the account exists, the content stays available. You can delete an entire import at any time, which removes its messages, media, transcripts and indexes. When you close the account, we delete your data from production systems within 30 days. In backups the period is longer, and that has to be clear: we keep daily copies for 35 days and monthly copies for 400 days. Data you delete today continues to exist inside encrypted backups until those periods expire. We do not consult backups except in disaster recovery, and a single record cannot be removed from a backup without invalidating the whole backup — which is why there is a deadline rather than indefinite retention. Tax and audit records are kept for the periods the law requires, even after the account closes.

9. People who are not our users

An imported conversation contains other people's messages. A recording contains the voice of whoever was on the other end. Those people have no account here and do not know us. We handle their data as a processor, on the instructions of whoever imported the material. The lawyer or firm who performed the import answers for that processing, and the legal basis is theirs to determine — usually the regular exercise of rights in legal proceedings. If you are one of those people and want to know whether your data is here, write to the address in section 11. We will locate the material and pass the request to whoever imported it, because they hold the power to decide about it — and we will answer directly whatever we can.

10. Your rights

The LGPD gives you, regardless of what this policy says, the right to: - Confirm that we process your data, and access what we hold. - Correct incomplete, inaccurate or outdated data. - Anonymise, block or delete unnecessary data or data processed unlawfully. - Port your data to another supplier. - Delete data processed on the basis of your consent. - Know who we share your data with — it is in section 5. - Withdraw consent, where that is the basis for processing. - Object to processing based on legitimate interest. How to exercise them: write to the address in section 11. We answer within 15 days, the period set by article 19 of the LGPD, and acknowledge receipt before that. How this works today, plainly: there is no button on screen that performs the export or the deletion by itself. Requests are handled by a person, by hand, within the period above. We would rather promise what we deliver than show a button that does not do what it says.

11. Data protection officer and Brazilian representative

Controller: TranscriptMe Inc., Delaware, United States. Tomás Lima holds two roles required by law: - Data protection officer under article 41 of the LGPD, as the channel between you, the company and Brazil's National Data Protection Authority. - Representative in Brazil for the foreign controller, to receive communications from data subjects and Brazilian authorities. privacidade@transcriptme.com This is the address for data subject requests, questions about this policy, and communications from authorities. We answer within 15 days, and acknowledge receipt before that.

12. Cookies and what stays in your browser

The necessary, always — the session token, in local storage, which keeps you signed in and is cleared when you sign out; the cookie with the language you chose; Stripe's cookies on the payment screen; and the "tm_consent" cookie, which keeps your choice in the cookie bar for six months. Site measurement, only if you accept — on the public pages, if you click "Accept" in the cookie bar, Google Analytics 4 sets its cookies ("_ga" and similar) to tell one visit from another, and starts receiving what section 2 describes. If you click "Only the necessary", or click nothing, no Google cookie is set and nothing is measured. You can revisit your choice at any time through the "Cookies" link in the site footer, which opens the bar again; "Only the necessary" after an earlier "Accept" stops the measurement from then on, and any Google cookies that already exist you delete in your browser. We use no advertising cookies. Inside the case area there is no third-party cookie or script.

13. Security incidents

If an incident occurs that may cause you relevant risk or harm, we will notify Brazil's National Data Protection Authority and you, within a reasonable period, describing what happened, the data involved and the measures taken — as required by article 48 of the LGPD.

14. Changes to this policy

This policy changes when the product changes. Material changes are communicated by email and announced on the site, with the update date at the top of this page. Previous versions are available on request to the address in section 11.