This Privacy Policy explains what information Subtly (“we”, “us”) collects when you use our website, API, and MCP integrations (the “Service”), why we collect it, and the choices you have. We built Subtly to be privacy-focused: we never sell your personal data, never use advertising trackers, and never use your content to train AI models.
Who we are
Subtly is a product operated by Tigro (Obrt Tigro Vlasnik Žilić Ajsel), a sole proprietorship registered in Bosnia and Herzegovina. Tigro is the data controller responsible for your personal data under the Law on Protection of Personal Data of Bosnia and Herzegovina (“ZPPL”). We also respect the EU General Data Protection Regulation (GDPR) where it applies to our processing.
Information we collect
- Account information. Your email address, display name, hashed password, workspace membership, and permissions. Passwords are never stored in plain text.
- Your content. Audio, video, and subtitle files you submit, and the transcripts, subtitles, and translations we generate for you.
- Service and security records. Job status, file names and technical metadata, usage and billing measurements, integration settings, and activity records. Server requests may include your IP address and browser information. These records help us operate, secure, and troubleshoot the Service; they are not used to track you for advertising.
- Billing metadata. Polar processes credit purchases. We keep payment references and credit records, but never see or store your full card number.
How we use your information
- To transcribe recordings, translate subtitles, and deliver your results.
- To authenticate you and apply your workspace permissions.
- To process prepaid credit purchases and meter usage.
- To send transactional emails, including password resets and service notices.
- To protect the Service, investigate failures, and provide support.
No model training. No advertising tracking.
We never use your recordings, transcripts, subtitles, or translations to train or fine-tune AI models. We do not sell or license that content for training. This commitment applies to every customer, without a paid privacy tier.
We do not use advertising trackers or cross-site tracking. We do not sell your personal data or share it with advertising networks. Operational usage records exist to run the Service and calculate your charges, not to build advertising profiles.
Cookieless website analytics
We use Umami, hosted by Tigro, to understand which public pages are useful and improve our website. It provides traffic statistics such as page views, referring sites, browser and device type, and approximate location derived from the request IP address. Umami does not store the IP address in its analytics database or set tracking cookies.
Our analytics covers public website and documentation pages, not your account, workspace, or authentication pages. We exclude URL query strings and fragments, reduce referrers to their site origin, and do not send account identifiers, uploaded files, transcripts, or payment details. We do not enable session replay or heatmaps, track you across sites, or use analytics to build advertising profiles. Where your browser sends a Do Not Track preference, we respect it.
Cookies and preferences
We use cookies for sign-in, workspace selection, and secure connection of AI assistants. Your theme preference is saved in your browser. We do not use marketing or analytics cookies. See our Cookie Policy for details.
Third-party services
- S3-compatible object storage: stores uploaded files and generated results.
- RunPod: provides computing infrastructure for our transcription and translation workers.
- Polar: processes credit purchases.
- Hosting and transactional email providers: operate the application and deliver service emails.
We use providers to deliver the Service, not to supply customer content for their model training or advertising. Processing may take place outside your country. Where required, we use applicable contractual safeguards for international transfers.
If you connect an AI assistant or webhook, information you authorize us to send there is also subject to that provider’s policies and your configuration. Copies you download or send to your own systems are under your control.
Temporary content and deletion
Our 24-hour retention commitment. Temporary results expire 24 hours after processing finishes. Download access through our Service stops at expiry, and the files are automatically scheduled for deletion. Save the results you want to keep before that deadline.
Uploaded source files are scheduled for deletion when processing ends. An automatic storage sweep also removes old uploads, results, and incomplete uploads, including files left behind by interrupted jobs. Active translations do not extend a source file’s expiry. Processing has a fixed deadline and cannot keep temporary content indefinitely.
We use Cloudflare R2 for temporary file storage and RunPod for processing. Our controls request deletion directly and limit processing time; they do not rely solely on a bucket’s lifecycle expiry. Failed deletions are retried. Storage deletion runs every minute and can complete after the download deadline. Provider outages can delay it further. The 24-hour limit guarantees the end of download access through our Service; it is not a guarantee that every provider-held backup, log, or internal copy is physically erased within that time.
These limits apply to uploaded content and temporary results, not to every record associated with your account. Account, workspace, job, billing, and security records are retained as needed to provide the Service, resolve disputes, prevent abuse, and meet legal obligations. Copies you download or send to your own systems, and originals at source URLs you import, follow their own retention settings. All uploads and results within the Service use private storage managed by us. Contact us to request deletion of your account or personal data.
We retain a one-way hash of your normalized email after account deletion to prevent repeated free-trial claims. This record contains no uploaded files, transcripts, or translations.
Legal basis for processing
We process personal data to perform our contract with you, for our legitimate interests in operating and securing the Service, and to comply with legal obligations such as tax and billing recordkeeping. Where processing requires consent, you may withdraw that consent.
Your rights
Depending on applicable law, you can request access to your personal data, correction of inaccurate information, deletion, or an export of your data. You may also object to or restrict certain processing, withdraw consent where applicable, and complain to your competent data protection authority.
To exercise these rights, email us at the address below. We may need to verify your identity. We respond within the time limit set by applicable law, generally one month. Some records may need to be retained to meet legal obligations.
Changes to this policy
When we update this policy, we revise the date above. Material changes will be communicated through the Service.
Contact
Questions about this policy or your data? Email [email protected].