Privacy Policy

1. Introduction

This Privacy Policy describes how Obsidian IT Consulting SRL ("we", "our", or "us") collects, uses, and protects your personal data when you use Dictato and the dicta.to website (together, the "Services").

Obsidian IT Consulting SRL is a company registered in Belgium and acts as the data controller:
Boulevard Lambermont 225 box 2, 1030 Brussels, Belgium
Company and VAT number: BE 0797.487.775

2. Your Dictation Never Leaves Your Mac

Dictato turns speech into text entirely on your own Mac. Your audio is never uploaded, and neither is the text it produces. The optional proofreading and tone rewriting run on your Mac too. There is no cloud transcription and no part of our infrastructure that can receive what you dictate. Once the app has downloaded the model it uses, dictation itself works offline. A paid licence checks in with us from time to time to confirm it is still valid, and keeps working for several days without a connection before it needs to check again.

Your dictation history stays on your Mac, and it is not synchronised to iCloud. If you turn on the option to keep the audio of a dictation, those recordings stay on your Mac as well. You can delete either at any time from the History window.

The text Dictato produces is inserted wherever your cursor is, so what happens to it afterwards is governed by the application you are writing in, not by us. The only text we ever receive is text you type yourself, in a feedback message or in an email to us.

3. Information We Collect

3.1 Purchase and Account Data

When you buy a licence we receive your email address, along with your licence key and the dates on which it was purchased and activated. Payments are handled by our payment partner, Polar, which acts as the seller of record. We never see or store your card details. Polar decides for itself how it handles what you give it at checkout, and its own privacy policy applies to that.

3.2 Licensing Data

A licence runs on one Mac at a time, so the app needs to be able to tell one Mac from another. To do that, the app sends an identifier derived from your Mac. It is not your name and it does not describe your hardware, but it is still personal data, because it can be linked to your licence and to the other data described here. We store it together with a record of when the licence was moved between Macs, so that the limit of 3 moves per 30 days can be applied and so that we can help you when an activation fails.

3.3 Trial Data

During the 7-day free trial we store the device identifier and the dates on which the trial started and ends, so the trial cannot simply be restarted forever. No account and no email address are required to run a trial.

3.4 Usage Statistics

Dictato sends counts of how the app is being used: how many dictations you have made, how long they last, which features and which transcription engines you use, and which version of macOS and of the app you are on. These are numbers and pre-set labels only, so nothing you dictated can appear in them. They are attached to the device identifier, not to your name.

This measurement runs during the free trial only. It stops as soon as you activate a licence, and the paid app sends no usage statistics at all. It is on by default during the trial, and we rely on our legitimate interest in understanding how the app is used so we can improve it. You can object at any time, simply by turning usage statistics off in Dictato's settings. The measurements are then cleared on your Mac and we stop collecting them, apart from the bare count of sessions that the trial check carries to tell a real trial from an attempt to restart one.

3.5 Feedback

When you send feedback from inside the app, we store your rating and your comment along with the device identifier and the app version. Feedback carries no name and no email address, but the device identifier is the same one attached to your trial and, if you buy, to your licence, so we could in principle connect a comment back to a purchase. Your comment is whatever you typed, so please do not put anything confidential in it.

3.6 Technical Data

To keep the Services secure and working, we process basic technical data such as your IP address and the time of your requests, including when the app checks whether a new version is available. It is used for security, abuse prevention, and troubleshooting.

3.7 Website Analytics and Cookies

The dicta.to website uses Google Analytics 4 with Google Consent Mode v2. No analytics cookie is set until you press Accept in the cookie banner, and pressing Decline keeps it that way. Before you answer the banner, Google still receives the fact that a page was requested, together with your IP address, without anything being stored on your device. If you decline, nothing is sent to Google at all. You can change your choice at any time from the Cookies link at the bottom of every page. The app itself uses no cookies.

4. How We Use Your Data

Our legal bases. Purchase and licensing data: performance of our contract with you. Trial data and technical data: our legitimate interest in preventing abuse and in keeping the Services secure and working. Usage statistics in the app: our legitimate interest in improving it, and you can object at any time. Website analytics cookies and marketing emails: your consent, which you can withdraw at any time. Feedback: your consent, given when you choose to send it. Billing records: our legal obligations under tax and accounting law. The cookieless measurement the website sends before you answer the banner rests on our legitimate interest in knowing how many people visit the site, and declining stops it.

5. Data Sharing

5.1 We do not

• Sell your data to third parties
• Share data with advertising platforms or data brokers
• Use your data for personalised advertising

5.2 We share data with

• Polar, our payment partner and seller of record, to sell the licence, invoice you, and handle VAT
• Amazon SES, to deliver our emails
• Hetzner (Germany, EU), which hosts our servers
• Google Analytics 4, for website analytics: measurement cookies only after you accept, and cookieless page pings before you answer the banner. If you decline, nothing is sent at all.
• Google, which hosts and serves the dicta.to website
• Legal authorities, if required by law or to protect our rights

Some of these partners are established outside the European Union, or process data on servers outside it: Polar (United States), Google (Ireland and United States), and Amazon SES (Amazon Web Services, United States). When your data leaves the European Economic Area, it is protected by the safeguards the GDPR requires, that is, an adequacy decision of the European Commission for the country concerned, or the European Commission's standard contractual clauses. You can ask us for a copy of those safeguards at al@obsidian-it.be.

The first time you use a transcription engine, the app downloads its model directly from the publisher that distributes it. As with any download, the publisher sees your IP address. It carries no account, no licence key, and nothing you dictated.

6. Data Security

• All data in transit is encrypted
• The device identifier is stored in a form that cannot be turned back into your hardware details
• Access to personal data is restricted to those who need it
• Our licensing servers are hosted in the European Union, and our emails are delivered through Amazon SES in the United States, under the safeguards described in section 5.2

7. Data Retention

We keep each piece of data for as long as the purpose it was collected for requires, and no longer.

In practice, your licence is a lifetime licence, so the record that lets you activate it is kept for as long as that licence exists. That is what allows you to reinstall Dictato years from now and have your key still work. We never delete it because you have not used the app for a while. Billing records are kept for as long as tax and accounting law requires. Trial records are kept until the trial has expired and the period during which it could be restarted has passed. Feedback is kept while we are still acting on it. Technical data is kept for a short period for security and troubleshooting, and then deleted.

You can ask us to delete your data at any time, and we will. Deleting the record attached to your licence ends that licence, so we will tell you before we do it.

8. Your Rights

You can ask us at any time to:

• Access a copy of the data we hold about you
• Correct anything that is inaccurate
• Delete your data
• Export your data in a portable form
• Withdraw consent, by unsubscribing from any marketing email and, for website analytics, from the Cookies link at the bottom of every page
• Object to our use of usage statistics, by turning them off in Dictato's settings

Write to al@obsidian-it.be. We answer within one month and free of charge. If your request is complex we may need up to two further months, and we tell you within the first month if that happens. We may ask you for information to confirm your identity before we act.

8.1 European Users (GDPR)

Under the General Data Protection Regulation you also have the right to object to or restrict processing, and to lodge a complaint with a supervisory authority. In Belgium that is the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be. You can also complain to the authority of the country where you live or work.

8.2 California Users (CCPA)

If you are a California resident, you also have the:

• Right to know what data we collect
• Right to have your data deleted
• Right to opt out of the sale of your data, noting that we do not sell data
• Right not to be discriminated against for exercising these rights

9. Children's Privacy

The Services are not intended for people under 18. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy. The date at the top of the page always reflects the current version. If a change is significant and we have your email address, we will tell you by email.

11. Contact Us

For any privacy question, or to exercise your rights, write to al@obsidian-it.be.

Data controller
Obsidian IT Consulting SRL
Boulevard Lambermont 225 box 2
1030 Brussels, Belgium
BE 0797.487.775