Privacy Notice — Secretary42
This Privacy Notice explains how insight 42 UG (haftungsbeschränkt) processes personal data in connection with the Secretary42 desktop application. It covers the product only; the insight42.com corporate website has its own privacy policy.
The short version. Secretary42 transcribes your speech on your device. The app does not transmit your microphone audio, transcript text, prompt text, local transcription history, app settings, or licence token to insight 42. There is no user account, and diagnostics are off by default. Separate network flows do occur for purchase and payment (through Paddle), licence-token delivery, model and software downloads, updates, optional diagnostics, support, and website/checkout operation. Those are described below.
1. Controller and contact
insight 42 UG (haftungsbeschränkt), Barellistraße 6, 85049 Ingolstadt, Germany. Privacy / data-protection requests: privacy@insight42.com. General contact and full company details: see the Impressum.
We have not appointed a Data Protection Officer, as we are not legally required to do so under Art. 37 GDPR / § 38 BDSG.
2. What stays on your device
The following are processed locally and are not transmitted to insight 42 by the app:
- Your microphone audio (processed by the bundled on-device whisper.cpp engine; temporary files are deleted after transcription).
- Your transcribed text and any prompt text.
- Your local transcription history (stored in a local database on your device; by default the most recent entries are kept; you can view, copy, and delete them).
- Your app settings and your licence token (verified locally; not transmitted by the app). The token payload carries no personal data — only a version, plan, issue/expiry timestamps and a nonce — no email, name, Paddle IDs, device, or IP.
- A local diagnostics/telemetry log file the app writes on your device for troubleshooting; it is not uploaded unless you choose to share it with support.
There is no cloud transcription and no cloud-transcription fallback under the current release configuration, and no user account — so there is no insight 42 server-side profile of you tied to the dictation product.
3. Processing that does involve personal data
| Activity | Personal data | Purpose | Legal basis |
|---|---|---|---|
| Purchase & payment (via Paddle) | Email, billing & payment data, transaction data | Sell the subscription; take payment; tax/invoicing | Paddle’s own bases as merchant of record / independent controller (Art. 6(1)(b)/(f) and tax-law obligations) |
| Licence delivery (our minter emails your token) | Your buyer email, received from Paddle | Deliver your purchased licence by email | Art. 6(1)(b) GDPR |
| Webhook handling & idempotency (minter) | Pseudonymous HMAC digests + operational metadata | Verify the purchase event; avoid duplicate licence emails; security | Art. 6(1)(f) GDPR |
| Diagnostics (Sentry) — opt-in, off by default | A random local install ID + sanitized technical metadata | Diagnose crashes / performance | Art. 6(1)(a) GDPR (consent) |
| Whisper-model download | Connection metadata (e.g. IP, user agent) to the model host | Deliver the model you chose | Art. 6(1)(b) and/or (f) GDPR |
| App updates | Connection metadata to the update host (GitHub Releases) | Provide updates / security fixes | Art. 6(1)(f) GDPR (and (b) where part of the paid licence) |
| Support | What you send us (email or shared logs) | Handle your request | Art. 6(1)(b)/(f) GDPR |
3a / 3b. Payment (Paddle) and licence delivery
Payment is processed by Paddle, which acts as merchant of record / authorised reseller and as an independent controller for the purchase, payment, tax, billing, invoicing and related buyer data, under its own privacy policy.
We receive your buyer email address from Paddle after purchase so that we can deliver your Secretary42 licence token and provide purchase-related support. We receive this data from Paddle, not from the desktop app.
To email you your licence token, our backend licence-minter reads your buyer
email from Paddle through an API permission scoped to read the customer email only
(customer.read), solely to send the token. The desktop app contains
no Paddle API key. Your email is not stored, logged, returned to the app, or placed in the token.
The licence-minter datastore is designed not to retain direct identifiers such as your buyer email address, raw Paddle customer/subscription/transaction IDs, raw webhook bodies, or generated licence tokens. It retains short-lived HMAC idempotency digests and limited operational metadata for up to 7 days. We treat these records as pseudonymous operational data where GDPR applies — not as anonymous or non-personal data.
3c. Diagnostics (Sentry) — opt-in only
Diagnostics are off by default, and the diagnostics service is not initialised until you explicitly opt in (Settings → License). On a fresh or opted-out install there is zero diagnostics egress. If you opt in, we send sanitized crash and performance metadata — app version, release channel, build identifier, OS, CPU architecture, local engine/model, language, a duration bucket, latency, real-time factor, and outcome — identified only by a random local install ID generated on your device. We do not receive your name, email, account ID (none exists), audio, transcript text, prompts, API keys, or local file paths. You can opt out at any time, which clears the diagnostics state and rotates the install ID.
3e. Whisper-model downloads
When you choose a Whisper model, the app downloads the model file from Hugging Face. The model host receives connection metadata (such as your IP address and user agent). Hugging Face, Inc. is US-based (with an EU establishment, Hugging Face SAS, France); public model repositories are stored in the US by default and US transfers rely on Standard Contractual Clauses.
4. Recipients and their roles
| Recipient | Role | Location & transfer basis |
|---|---|---|
| Paddle | Independent controller / merchant of record for checkout, payment, tax, billing; discloses buyer email to us for licence delivery | UK (UK adequacy decision); controller-to-controller SCCs for relevant transfers |
| Sentry (Functional Software, Inc.) | Processor for opt-in diagnostics (Art. 28) | EU storage (GCP); US transfers under EU-U.S. DPF (DPF-certified, participant 5869) with SCC fallback. DPA signed; 30-day retention |
| Brevo (Sendinblue SAS, Paris) | Processor for licence-token email delivery (Art. 28) | EU hosting (France/Belgium); non-EEA subprocessing under SCCs/DPF. AVV signed; open/click tracking disabled |
| Hetzner (Hetzner Online GmbH) | Processor for minter hosting (compute + Redis) (Art. 28) | Germany (Nuremberg/Falkenstein). AVV concluded |
| Hugging Face, Inc. | Model-download host; recipient of connection metadata | US-based (EU establishment HF SAS, France); US transfer under SCCs |
| GitHub (GitHub, Inc. / Microsoft) | Update/download host (independent controller for public releases); public issue tracker if you file one | US + international; EU-U.S. DPF (DPF-certified, participant 6174) + SCCs |
We do not sell personal data or use it for advertising. Where a service provider processes personal data on our behalf, we use the data-processing terms required by Art. 28 GDPR. Paddle acts as an independent controller for checkout and payment and is not our subprocessor for that purpose.
Support channel
Support is private email only — support@insight42.com. We do not operate a public support forum. When you email support, please send only what is needed; avoid sharing audio, full transcripts, licence tokens, payment details, or secrets unless we specifically ask. If you ever reach us through any public channel, do not post personal data there.
5. Retention
| Data | Retention |
|---|---|
| Audio | Not retained — transient, deleted after transcription |
| Transcripts / local history / settings | On your device only; you control and can delete |
| Local diagnostics/telemetry file | On your device only; not uploaded unless you share it |
| Licence-delivery idempotency records (minter) | 7 days default, hard-capped at 30; operational metadata only; no email / raw Paddle IDs / body / token; Redis has no persistence or backup |
| Buyer email (minter) | Not stored — read transiently for delivery, never stored/logged/returned/placed in the token |
| Diagnostics events (Sentry) | 30 days (EU project, DPA signed) |
| Minter / reverse-proxy logs | Reverse-proxy logs roll at 7 days |
| Email delivery logs (Brevo) | Open/click tracking disabled |
| Support correspondence | Kept only as long as needed to handle your request, then deleted |
| Payment / billing | Per Paddle’s retention policy (Paddle is the controller) |
6. Legal bases
The legal bases per flow are set out in the table in §3. In summary: purchase and licence delivery rely primarily on contract (Art. 6(1)(b)); webhook verification/idempotency, security logging, updates and model-download logging rely on legitimate interests (Art. 6(1)(f)) with documented assessments; opt-in diagnostics rely on consent (Art. 6(1)(a)).
7. Whether providing data is required
Providing your email at checkout is necessary to buy a subscription and receive a licence; without it we cannot deliver the licence. Diagnostics are optional and refusing them does not affect your use of the app. Support content is optional, but we need it to answer your request.
8. Your rights
Subject to the GDPR, you have the rights of access, rectification, erasure, restriction, portability, and objection (including the right to object to processing based on legitimate interests), and the right to withdraw consent for diagnostics at any time without affecting prior processing. Because the app holds no account and the minter is designed not to retain direct identifiers, for much of the local product there is no server-side personal data for us to act on; for payment data, contact Paddle (the controller for that data), and for diagnostics, contact us.
To exercise your rights, email privacy@insight42.com. You also have the right to lodge a complaint with a supervisory authority. The competent authority for insight 42 is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
9. International transfers
Some recipients may process personal data outside the EU/EEA, or their corporate group / subprocessors may have access from third countries. Where a recipient processes data outside the EU/EEA, appropriate safeguards apply, such as an EU adequacy decision, the EU-U.S. Data Privacy Framework for certified US organisations, or the EU Standard Contractual Clauses with supplementary measures where required. Sentry and GitHub/Microsoft are DPF-certified; Hugging Face’s US transfers rely on SCCs; Brevo hosts in the EU with SCC/DPF fallback; Hetzner is EU/DE; Paddle (UK) benefits from the UK adequacy decision and uses SCCs for other transfers.
10. Cookies, the website, and the checkout (TDDDG)
The Secretary42 product pages and checkout use only what is necessary to function. A consent banner (Complianz) manages any non-essential storage, which you can accept or decline; strictly necessary storage and the cookies Paddle sets to run secure checkout do not require consent. We do not run analytics or advertising trackers on the Secretary42 product pages. The general insight42.com website is covered by the corporate privacy policy.
11. Automated decision-making
insight 42 does not use automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR. Any fraud/payment risk decisions at checkout are carried out by Paddle as part of its own controller processing.
12. Children
Secretary42 is not directed to children; you must be 18+ to purchase (see the Terms).
13. Changes
We may update this Notice; the “Last updated” date reflects the current version.
14. Contact
insight 42 UG (haftungsbeschränkt), Barellistraße 6, 85049 Ingolstadt, Germany — privacy@insight42.com.