Privacy Policy

1. Controller

The controller responsible for processing personal data through this service is:

2. Data processed by the service

2.1 Account and authentication data

When you create an account, we process your name, email address, password hash, session information, language preference, and timestamps required for authentication and account management. The legal basis is Art. 6(1)(b) GDPR; security logs may additionally rely on Art. 6(1)(f) GDPR.

2.2 Uploaded and entered learning material

The service processes files, pasted text, webpage URLs, extracted text, OCR results, file metadata, and the source title in order to understand the material and prepare a podcast. Please avoid including personal data that is not needed for your learning purpose.

2.3 Podcast settings, dialogue, and audio

We process your selected language, format, duration, voices, learning aids, generated dialogue, manual edits, speech segments, and MP3 files to provide the requested podcast. The legal basis is Art. 6(1)(b) GDPR.

2.4 Usage, jobs, and technical data

We store production status, timestamps, error information, token and character usage, cost estimates, browser and server logs, and identifiers needed to operate jobs, prevent abuse, troubleshoot failures, and calculate prices. Depending on the purpose, processing is based on Art. 6(1)(b) or Art. 6(1)(f) GDPR.

2.5 Orders and payments

When payment is enabled, we process order identifiers, amounts, currency, payment status, and the Stripe references required to match a payment to your podcast. Card and bank details are entered directly with Stripe and are not stored by us. Processing is based on Art. 6(1)(b) GDPR and statutory accounting obligations.

3. External service providers

Only the data needed for the respective processing step is sent to the following providers. Uploaded source material is not sent to unrelated search, advertising, or social-media services.

Where a provider processes data outside the European Economic Area, the transfer is based on an applicable GDPR transfer mechanism, such as an adequacy decision or EU Standard Contractual Clauses.

4. Storage periods

The configured default storage periods are designed to keep production data only as long as it is useful for the service:

• Uploaded sources and extracted source content: generally up to 30 days.
• Generated dialogue and related script data: generally up to 90 days.
• Generated audio files: generally up to 365 days.
• Account and podcast metadata: until deletion of the account or individual podcast, unless a longer period is required for security or legal claims.
• Order and invoice information: for the statutory commercial and tax retention periods.

Deletion may occur earlier when you delete a podcast or your account. Backups and provider-side processing may require a limited additional period before all copies are removed.

5. Private transfer and podcast feeds

QR codes, device-transfer links, audio links, and personal podcast-feed URLs are intended for private use. They can contain an unguessable access token so that a phone or podcast app can retrieve the corresponding podcast without another login.

Anyone who obtains a valid private link may be able to access the linked content. Do not publish these links or forward them to people who should not receive the podcast. Revoke or replace a link when you suspect it has been shared unintentionally.

6. Cookies, browser storage, and analytics

Technically necessary cookies and browser storage keep you signed in, remember language and theme choices, preserve workflow state, and record that notices were dismissed. These mechanisms are required to provide the requested functions.

No advertising cookies or third-party advertising trackers are used on this service.

7. Your rights

Subject to the statutory requirements, you have the following rights under the GDPR:

• Access to the personal data processed about you (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure of data where the legal requirements are met (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability for data covered by Art. 20 GDPR.
• Objection to processing based on legitimate interests (Art. 21 GDPR) and withdrawal of consent with future effect where consent is used.

To exercise your rights, contact: info@48design.de

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

8. Changes to this policy

We update this policy when the service, providers, or legal requirements change. Material changes will be communicated appropriately. The date shown above identifies the current version.