Privacy Policy

Codelabs Studio, S.L. (CIF B88708797), registered in Málaga, Spain, operates the AudioMap service and is responsible for processing your personal data.

Contact for data matters: privacidad@audiomap.ai.

If you reside in the European Union, your data is processed under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

• Account and profile: email, name, and login method. Legal basis: contract performance.
• Audio and transcriptions: files you upload and the text we generate from them. Accessible only to you. Legal basis: explicit consent.
• Usage data: minutes consumed, features used. Used for quota management and service improvement. Never sold. Legal basis: legitimate interest.
• Consent log: a record of every permission you grant, with timestamp, IP address, and version of the legal text accepted. This log is immutable. Legal basis: legal obligation (LOPDGDD Art. 8).

• Transcribe your audio and generate AI Notes and chat responses.
• Manage your subscription and enforce plan quotas.
• Customer support: only from @audiomap.ai addresses.
• Legal compliance when required by a founded court order.

Your audio is never used to train AI models. Not ours, not third parties'. This is a contractual obligation, not a policy preference.

The following providers process your data exclusively as our subprocessors under signed data processing agreements. The authoritative, always current list lives at /legal/subprocessors.

• Cloudflare R2 (EU): encrypted storage of uploaded audio, in an EU bucket.
• AssemblyAI (EU, api.eu.assemblyai.com): audio transcription. Audio is deleted from their systems once transcription is complete.
• Whisper (self-hosted) (Germany): fallback transcription on our own Hetzner servers, no outbound traffic.
• Google Cloud, Vertex AI (EU, europe-west1): the default provider for AI Notes, chat and deliverable generation (Gemini). Not used to train models.
• Mistral AI (France): fallback provider for chat when the primary one is unavailable. Not used to train models.
• Hetzner (Germany): dedicated servers (database, jobs) under our exclusive management.
• Sentry (EU): error monitoring, with filters active to prevent sending sensitive content.
• Stripe (USA): payment processing only. It never receives your audio or transcriptions.

Audio and content are processed within the EU. Anthropic (Claude) and OpenAI can be enabled by an administrator as an alternative model provider, but are not the default. The only US transfer in the default configuration is Stripe for payment data, covered by Standard Contractual Clauses (EU Commission Decision 2021/914).

Under GDPR and LOPDGDD you have the following rights:

• Access: request a copy of all personal data we hold about you.
• Rectification: correct any inaccurate or incomplete data.
• Erasure: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Objection and restriction: limit or stop certain uses of your data.

To exercise any of these rights, write to privacidad@audiomap.ai. We respond within the legal deadline of one calendar month.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

• Original audio: while your account is active and you have given explicit consent. If you revoke consent, we physically delete it from storage within 7 days.
• Transcriptions and AI Notes: while your account is active or until you delete them.
• Consent log: 6 years after account closure (the minimum legal requirement in Spain for contractual records). This is the only data that survives account closure.

We use Plausible Analytics to measure aggregate site traffic. Plausible does not use cookies, does not track individuals across sites, and does not send data outside the EU. No cookie banner is required for this tool.

We also set session cookies that are strictly necessary for authentication. These do not require your consent under the ePrivacy Directive (Art. 5(3)) as they are essential for the service to function.

We do not use advertising cookies, cross-site tracking, or fingerprinting of any kind.