Privacy Policy

CODELABS STUDIO, S.L. (CIF B88708797), with registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain, registered with the Companies Registry of Málaga (Registro Mercantil de Málaga), sheet MA-198508, entry 1, operates the AudioMap service and is responsible for processing your personal data.

Contact for data matters: privacidad@audiomap.ai.

If you reside in the European Union, your data is processed under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

• Account and profile: email, name, and login method. Legal basis: contract performance.
• Audio and transcriptions: files you upload and the text we generate from them. Accessible only to you. Legal basis: explicit consent.
• Usage data: minutes consumed, features used. Used for quota management and service improvement. Never sold. Legal basis: legitimate interest.
• Consent log: a record of every permission you grant, with timestamp, IP address, and version of the legal text accepted. This log is immutable. Legal basis: legal obligation (LOPDGDD Art. 8).
• Voice profiles (only if you turn them on): voice vectors of the speakers in your recordings. This is biometric data. Legal basis: explicit consent (GDPR Art. 9.2.a).

• Transcribe your audio and generate AI Notes and chat responses.
• Manage your subscription and enforce plan quotas.
• Customer support: only from @audiomap.ai addresses.
• Legal compliance when required by a founded court order.

Your audio is never used to train AI models. Not ours, not third parties'. This is a contractual obligation, not a policy preference.

AudioMap can recognise the same person by voice across your own recordings and suggest their name. We never apply a name automatically: the decision is always yours.

• What we do: we compute a voice vector for each speaker in your recordings and, from the speakers you have named, we build one profile per person. Matching happens only inside your account and is never cross-referenced with other users.
• Legal basis: your explicit consent (GDPR Art. 9.2.a), which you can only give if you also declare that you have informed the people recorded and have their consent to be recognised by their voice. You are responsible for that declaration; for that part AudioMap acts on your instructions. We store the date and time of your acceptance and the version of the text accepted (voice-profiles-1.1).
• Where it is processed: on our own server inside the European Union. No third-party provider is involved in this processing.
• What is stored: the voice vectors and the profiles derived from them, not extra copies of the audio.
• How long: until you withdraw consent, delete the profile, exclude that person or delete your account.

Your rights and controls:

• Withdraw consent at any time: we delete all voice vectors and all voice profiles.
• Delete a voice profile: its vectors are deleted.
• Do not recognise this person: their voice is excluded from enrolment and matching, their vectors are deleted and it is not analysed again.

If you are a person who was recorded and you do not want to be recognised by voice, you can ask the account holder, who has the options above, or write to privacidad@audiomap.ai and we will handle the removal.

Only if you have joined the AudioMap founders programme: in return for free access, how your sessions on the AudioMap website work is analysed (the interface as you see it, your screen size and browser, the screens you go through and the errors that appear) to find bugs, elements that do not display well and things to improve. It applies to nobody else.

• What is not analysed: the content. Your notes, your audio, your transcripts, the AI summaries, the chat answers and the names of speakers and folders are never captured as content: on-screen text is replaced with asterisks in your own browser before it is sent, except AudioMap's own buttons and menus; what you type into text fields is masked too, and the audio, the player, the waveform and images are not kept. It is never used to train AI models, never shared with third parties and never used to assess you; the usage figures are also used to check the collaboration commitment of the programme.
• Summaries: when the analysis of a session finds something to explain, an AI model writes a short summary from the usage figures and technical faults, never from the screen content.
• Who it applies to: only the founder's account and only on the website. If your plan is a team plan, the people you invite are not part of the programme and their sessions are not analysed.
• Legal basis: performance of the programme (Art. 6.1.b GDPR), of which the analysis is the counterpart of the free access you accept when joining.
• Retention: the technical trace of a session is kept in our own database and deleted after 7 days. The report of each session (usage figures and technical faults, no screen content) is kept while your account exists and is deleted with it.
• Your rights: access, rectification, erasure, restriction, portability or objection by writing to privacidad@audiomap.ai, and a complaint to the Spanish Data Protection Agency. You may leave the programme whenever you like.

The following providers process your data exclusively as our subprocessors under signed data processing agreements. The authoritative, always current list lives at /legal/subprocessors.

• Cloudflare R2 (EU): encrypted storage of uploaded audio, in an EU bucket.
• AssemblyAI (EU, api.eu.assemblyai.com): audio transcription. Audio is deleted from their systems once transcription is complete.
• Whisper (self-hosted) (Germany): fallback transcription on our own Hetzner servers, no outbound traffic.
• Google Cloud, Vertex AI (EU, europe-west1): the default provider for AI Notes, chat and deliverable generation (Gemini). Not used to train models.
• Mistral AI (France): fallback provider for chat when the primary one is unavailable. Not used to train models.
• Hetzner (Germany): dedicated servers (database, jobs) under our exclusive management.
• Sentry (EU): error monitoring, with filters active to prevent sending sensitive content.
• Stripe (USA): payment processing only. It never receives your audio or transcriptions.

Audio and content are processed within the EU. Anthropic (Claude) and OpenAI can be enabled by an administrator as an alternative model provider, but are not the default. In the default configuration the only US transfers are Stripe for payment data and, if you use the Live Assist panel, your own browser’s speech recognition (Google in Chrome, Apple in Safari), which never goes through our servers, covered by Standard Contractual Clauses (EU Commission Decision 2021/914).

Under GDPR and LOPDGDD you have the following rights:

• Access: request a copy of all personal data we hold about you.
• Rectification: correct any inaccurate or incomplete data.
• Erasure: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Objection and restriction: limit or stop certain uses of your data.

To exercise any of these rights, write to privacidad@audiomap.ai. We respond within the legal deadline of one calendar month.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

• Original audio: while your account is active and you have given explicit consent. If you revoke consent, we physically delete it from storage within 7 days.
• Transcriptions and AI Notes: while your account is active or until you delete them.
• Consent log: 6 years after account closure (the minimum legal requirement in Spain for contractual records). This is the only data that survives account closure.
• Voice vectors and profiles: until you withdraw consent, delete the profile, exclude that person or delete your account.

We use two elements that are strictly necessary for the service to work, and that do not require your consent because they are essential (ePrivacy Directive, Art. 5(3)): the session cookie that keeps you logged in, and your browser's local storage where we save the choice you make in the cookie banner, so we don't ask you again on every visit.

To measure site traffic we use Plausible Analytics, hosted in the European Union. Plausible does not use cookies, does not identify people, and does not track them across sites: that's why it does not trigger the cookie banner, even though the rest of the site does. Even so, if you click Decline, it stops loading: it will not request anything again, not even when you navigate to another page without reloading.

Only if you accept the cookie banner do we install the Meta pixel (Meta Platforms Ireland Ltd.) to measure whether our ads on Facebook and Instagram lead to a sign-up or a purchase. It processes its own cookie identifier (_fbp, which lasts 90 days), the pages you visit, and the sign-up, checkout-started, and purchase events you complete. Meta may transfer this data outside the European Union under the EU-U.S. Data Privacy Framework; details are in Meta's cookie policy.

If you accept marketing cookies, we also install cl_attr, a first-party cookie set by Codelabs Studio, S.L. that stores the campaign your visit came from, such as the fbclid from an ad, so we know which ad brought each sign-up. It lasts 90 days and, like the Meta pixel, is only installed if you accept marketing cookies.

partner_ref: first-party cookie of the Codelabs Studio, S.L. partner programme. It stores which partner referred you to AudioMap (the ref parameter of the link) so the commission can be attributed if you sign up or pay. It is an affiliate cookie, in the marketing category, and is only set if you accept marketing cookies. It lasts 90 days. Without your consent nothing is stored in your browser: the identifier travels in the link and we send it when you sign up or pay.

That same consent also loads the website support chat, by AgenteUno (a Codelabs Studio, S.L. product hosted in Germany). It stores a conversation identifier in your browser's session storage (au_sid_, cleared when you close the tab) and sends usage statistics for the chat itself. If you do not accept, the chat does not load.

In notes made from a YouTube video, the original video is shown with the YouTube player (Google Ireland Ltd.) in its privacy-enhanced mode (youtube-nocookie.com). Nothing from YouTube loads until you press the video; once you do, YouTube may store data in your browser and process your visit under its privacy policy.

You can withdraw your consent at any time from the Cookie preferences link in this page's footer: it will show the banner again so you can choose once more, without reloading. As an alternative, you can also delete your browser's cookies for this site. Rejecting or withdrawing consent does not change anything else about the service.

Each cookie and each item stored in your browser, with its purpose and duration, is listed in the cookie policy.

This policy is governed by Spanish law and the GDPR. If you are a business or professional, the parties submit to the courts of Málaga (Spain), where CODELABS STUDIO, S.L. has its registered office, waiving any other forum that might apply. If you are a consumer, the courts determined by mandatory law will have jurisdiction (generally those of your place of residence) and, where the law allows, also those of Málaga; this does not limit any right that consumer or data protection law grants you, including the right to complain to the Spanish Data Protection Agency (AEPD).

The full identification details of the owner are in the legal notice.