Privacy policy
This Privacy Policy describes how SpeakApp collects, uses and protects the personal data of users of the SpeakApp desktop application and the speakapp.work website. It complies with the General Data Protection Regulation (GDPR, EU 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
1. Data controller
Florent de Maisoncelle, a sole trader (Entreprise Individuelle, EI) under the micro-enterprise tax regime, trading as PROSPECTPARTNER, registered in France under SIRET 941 122 897 00023 (SIREN 941 122 897).
Legal form: Sole proprietorship, no share capital
Postal address: 18 Rue de la République, 94220 Charenton-le-Pont, France
Contact: privacy@speakapp.work
Data Protection Officer (DPO): None appointed, as this is not mandatory given the activity. For any personal data question, contact the controller directly.
2. Data collected
2.1 Identification data (user account)
| Data | Source | Purpose |
|---|---|---|
| Email address | Google OAuth or email Magic Link authentication | Identify the account, service communication, sending sign-in codes |
| First and last name | Google profile, if Google OAuth | Personalize the interface |
| Profile photo (URL) | Google profile, if Google OAuth | Display user avatar |
| Supabase user identifier (UUID) | Generated at first login | Technical key linking account data |
2.2 Configuration and personalization data
| Data | Storage | Purpose |
|---|---|---|
| Application preferences (TTS voice, speed, language) | Local %APPDATA%\SpeakApp\config.json + Supabase cloud (cross-PC sync) | Preserve the experience across sessions and devices |
| Custom voice shortcuts (snippets) | Local + cloud | Customize Dictation workflows |
| Personal dictionary (industry-specific words, proper names) | Local + cloud | Improve transcription accuracy |
| Configured keyboard shortcuts | Local + cloud | Customize app controls |
2.3 Usage and billing data
| Data | Storage | Purpose |
|---|---|---|
| Monthly Dictation minutes consumed | Supabase cloud (usage table) | Track subscribed plan limits: Free 30 min/month, Lecture 3 hr/month, Pro unlimited |
| Number of spoken readings (monthly) | Supabase cloud (usage table) | Track Free's 50 readings/month limit; unlimited on paid plans |
| Active subscription status (Free / Trial / Lecture / Pro) | Supabase cloud (subscriptions table) | Enable capabilities according to the plan |
| Payment data (card numbers, etc.) | Stripe only; never collected or stored by SpeakApp | Payment processing by Stripe |
2.4 Technical and diagnostic data
| Data | Storage | Purpose |
|---|---|---|
| Anonymized crash reports (stack trace, OS version, app version) | Sentry, only with explicit opt-in at first launch | Diagnose and fix production bugs |
Application activity logs (debug.log) | Local only, never transmitted | Local user-side technical troubleshooting |
2.5 Data NOT collected (explicit statement)
- Audio recordings: Dictation streams are sent in real time to the Gladia transcription service, which processes and deletes them. SpeakApp never stores audio.
- Transcribed dictation content: Immediately returned to the user and pasted in the active window, without storage on SpeakApp servers.
- AI conversation content: SpeakApp does not retain any of your conversation content on its servers. To read replies aloud, the app accesses them locally on your computer. They are sent to a third party only when you explicitly enable Smart Reading (§4.2), and only to that sub-processor.
- Web browsing data outside SpeakApp: no tracking, third-party cookies, or browsing telemetry.
- Payment card credentials: SpeakApp has no access to payment methods. Stripe fully operates its hosted checkout.
2.6 Emails and subscription attribution
| Data | Storage | Purpose |
|---|---|---|
| Choice about email offers: accepted or not, date, where the choice was made (signup or Settings), unsubscribe date | Supabase cloud | Send offers only if accepted, and never again after opting out |
| Opting out of advice emails: date | Supabase cloud | Stop tips, monthly recaps and new-feature emails |
| Log of advice and offer emails sent: which and when | Supabase cloud | Never send the same email twice or more than one per day |
The link from one of our emails leading to a subscription (e.g., email-p1) | Stripe, with the subscription | Measure which emails bring subscribers |
The previous website at the moment of subscription: domain only (e.g., linkedin.com), plus link campaign parameters (utm_source, utm_medium, utm_campaign). Read during the visit, never stored on the user's device. | Stripe, with subscription | Identify acquisition channels |
| Beta waiting list: email, signup page (/beta, /li, /tk), displayed headline variation, referring page | Supabase cloud | Notify people at launch and understand where registrations came from |
3. Legal bases for processing
| Processing | GDPR legal basis |
|---|---|
| Account creation and management | Performance of a contract (Article 6(1)(b)) |
| Cloud synchronization of preferences | Performance of a contract (Article 6(1)(b)) |
| Billing and subscription tracking | Performance of a contract plus legal accounting obligation (Articles 6(1)(b) and 6(1)(c)) |
| Sending Magic Link login codes | Performance of a contract (Article 6(1)(b)) |
| Anonymized crash reports (Sentry) | Explicit opt-in consent (Article 6(1)(a)) |
| Voice transcription (Gladia) | Performance of a contract (Article 6(1)(b)) |
| Smart voice reformulation (Mistral AI, Smart Reading) | Explicit opt-in consent (Article 6(1)(a)), collected at first activation |
| Advice emails (onboarding, monthly recaps, new features) | Legitimate interest (Article 6(1)(f)): help subscribers use the service; one-click unsubscribe in each email |
| Offer emails | Consent (Article 6(1)(a)): signup checkbox or Settings toggle, revocable in one click in each email |
| Subscription attribution (email link, referring website, campaign parameters) | Legitimate interest (Article 6(1)(f)): know which channels bring customers; right to object under Article 21 |
| Beta waiting list | Consent (Article 6(1)(a)): signup, revocable on request |
4. Sub-processors
SpeakApp uses the providers below. They are covered by GDPR-compliant Data Processing Agreements (DPAs), with one exception disclosed explicitly: Microsoft speech synthesis (§4.1). The full data path is explained in plain language at Where your text goes.
This table describes standard installation, covering nearly all users. The software also contains integrations to other providers that are disabled by default with no activation control in the interface. To use one, a person would need to edit a local configuration file and provide their own access key. All reachable providers, including inactive ones, are named in our complete sub-processor list.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase Inc. | Authentication and data storage (preferences, subscriptions, usage) | European Union (eu-central-1) |
| Gladia SAS | Primary voice transcription | France (Paris) |
| Deepgram Inc. (removed) | Engine removed from the product; no application path calls it | Not applicable: no data sent |
| Stripe Inc. | Payments and subscriptions | European Union + United States, EU SCCs |
| Resend (Plus Five Five, Inc.) | Sending login codes, account confirmations, receipts, service notices, tips and offers; receives email address and message content | European Union (sent from Ireland, eu-west-1) + United States, EU SCCs |
| Functional Software Inc. (Sentry) | Anonymized error reports only on opt-in | United States, EU SCCs |
| Google Cloud (OAuth) | Google OAuth authentication | EU + United States, EU SCCs |
| Microsoft (Edge TTS, browser endpoint) | Speech synthesis (transient playback with no storage) | Microsoft Edge endpoint, no DPA for this access method, see §4.1 |
| GitHub Inc. | Release binary hosting | United States, EU SCCs |
| Mistral AI SAS | Optional Smart Reading reformulation (opt-in only) | European Union (servers in Paris, France), DPA included in Scale plan terms |
4.1 Transparency note: Microsoft Edge TTS
For spoken text, SpeakApp uses the open-source Python edge-tts library, which calls the speech synthesis endpoint used natively by Microsoft Edge. Its characteristics:
- No storage: text is processed in real time and is not retained by Microsoft under the Edge service terms.
- No formal DPA: unlike a paid Azure Cognitive Services Speech subscription, this access has no signed Microsoft Online Services DPA. The service is used as it is publicly exposed by Edge.
- Data sent: only text to be read aloud (AI replies and chat text). No user identifying information is sent to this endpoint.
- Why disclose this rather than contract for it: Azure Cognitive Services Speech provides the same voices with no improvement in audio quality, at a cost disproportionate to SpeakApp's subscription price. We therefore disclose the provider openly rather than making the service more expensive, as other publishers do for their speech synthesis provider.
- If you need contractual assurances: for professional use or a legal department requirement, contact us. We review the decision case by case.
You can disable speech synthesis at any time in SpeakApp Settings. Dictation and Voice commands remain fully functional without TTS.
4.2 Smart Reading reformulation: Mistral AI
When you enable Smart Reading, text from your AI agents' replies is sent to Mistral AI SAS, a French company with headquarters in Paris, France, for rewriting before spoken playback.
- Controller: EI Florent de Maisoncelle, 18 Rue de la République, 94220 Charenton-le-Pont, France; florent@speakapp.work.
- Sub-processor: Mistral AI SAS, mistral.ai/privacy. Data hosted exclusively on servers in the European Union.
- Legal basis: your explicit consent (GDPR Article 6(1)(a)), collected on the dedicated consent screen when the feature is first enabled.
- Data sent: only the AI reply text in transit. SpeakApp does not store it; Mistral AI does not use it for model training.
- Retention: no retention by SpeakApp. Mistral AI's handling follows its Scale plan terms.
- Your rights: withdraw consent any time by disabling Smart Reading in Settings → Chat Reading. For access, correction, or deletion requests, contact florent@speakapp.work.
This feature is disabled by default. No data is sent to Mistral AI unless you explicitly enable it.
5. Retention periods
| Data | Retention |
|---|---|
| Active user account (email, profile) | While the account remains active |
| Account inactive for 3 years | Automatically deleted after an advance email notification |
| Billing records | 10 years (French accounting law) |
| Usage logs (transcription minutes) | Rolling 13 months |
| Sentry crash reports | 90 days, then automatically purged |
| Session tokens (Supabase refresh tokens) | 30 days after last use, then revoked |
| Email offer preferences, unsubscribes, log of advice and offer emails | For as long as the account exists; deleted with it |
| Subscription attribution (email links, referring domain, campaign parameters) | Stored by Stripe with the subscription for the same period as billing records (10 years) |
| Beta waiting list | Up to 3 years after registration; deleted sooner on request |
6. Your GDPR rights
Under GDPR Articles 15 to 22 you have the following rights:
- Access (Article 15): receive a copy of all your data.
- Rectification (Article 16): correct inaccurate data.
- Erasure (Article 17, right to be forgotten): delete your account and data.
- Restriction (Article 18): temporarily restrict processing.
- Portability (Article 20): receive your data in a structured format (JSON).
- Objection (Article 21): object to processing for legitimate reasons.
- Withdraw consent: at any time, e.g., by disabling anonymized crash reports in Settings.
To exercise these rights, email privacy@speakapp.work with proof of identity. We respond within 30 days maximum.
If unsatisfied, you may complain to the CNIL, the French Data Protection Authority: www.cnil.fr/fr/plaintes.
7. Security
We apply technical and organizational measures to protect your data:
- HTTPS/TLS encryption for all network exchanges (Let's Encrypt and Supabase certificates).
- Multi-factor authentication supported through Google OAuth.
- Cryptographically signed, short-lived JWT access tokens (1 hour), with automatic rotation.
- PostgreSQL relational database on Supabase with Row Level Security (RLS) preventing one user from accessing another's data.
- Daily encrypted backups on Supabase in the EU region.
- Regular security audits of software dependencies.
If a data breach is likely to pose a risk to your rights and freedoms, we will inform you within 72 hours maximum under GDPR Article 33.
8. Cookies and trackers
speakapp.work uses only strictly necessary technical cookies (login sessions). No advertising cookies, third-party audience analytics cookies, or marketing trackers.
The SpeakApp desktop application sets no cookies on your system (native Python architecture, with no embedded browser for most features).
9. Changes to this policy
This policy may be updated to reflect service changes or legal requirements. The “Last updated” date at the top indicates the current version. Material changes (new sub-processors, different purposes) will be communicated by email.
10. Contact
For questions about this policy or your personal data:
Email: privacy@speakapp.work
Reply: within 7 business days.