Privacy policy

The personal data described on this page is processed by Thibaud GIOVANNETTI EI, sole trader (entrepreneur individuel), 14 rue de Kercaves, 56260 Larmor-Plage, France, SIREN 985 388 610 (the "Publisher"). For any question: dictadoc@proton.me.

This policy covers the data the Publisher processes to sell and deliver its licences, make them work and answer its customers. It does not cover the health data you process with Dictadoc: you remain its sole controller, and the Publisher has no access to it (article 2).

• With the app alone: your voice is transcribed by your computer's processor or graphics card. The first time you open the app, you choose to keep your reports or to erase everything on close, and you can change this in the settings. Kept reports and recordings stay on your disk in an encrypted database, whose key is entrusted to your operating system's keychain (macOS Keychain, Windows Credential Manager) and is never written beside the database. Otherwise, they are erased when the software closes, then again at the next launch. Uninstalling removes the database, the key and the downloaded models.
• With Dictadoc Server: the workstation sends the recording to your facility's server over an encrypted connection. The server transcribes it and sends the text back to the workstation, keeping neither the dictation nor the text. The workstation saves reports in its encrypted database, as the app alone does.
• At the Publisher: no dictation, no text and no patient data passes through the servers of the Publisher or its providers. The software contains no audience measurement or telemetry tool. The Publisher is therefore not a processor of this data.

The Publisher processes only the following data.

• Purchase and licence: the email address used to pay, your Stripe customer and payment identifiers, the language of the purchase, the code and the signed licence, the version of the terms of sale in force, and the dates of creation, activation and expiry. On activation, a non-reversible fingerprint of your computer is added for the app, or the deployment identifier for Dictadoc Server. Stripe also collects your name, your billing address, your VAT number where applicable and your payment data. The Publisher can view the first three in its Stripe account for invoicing, but never receives your card number.
• Free trial of the app, when offered: the non-reversible fingerprint of your computer, to grant only one trial per computer, and a fingerprint of your IP address, not the address itself, to limit the number of trials requested from the same network. No email address is requested.
• Support: your email address and your messages when you write to the Publisher, and the deployment identifier if you activate Dictadoc Server without internet access.
• Technical logs: the licence service logs the requests it receives, with the IP address and the calling software, and, depending on the operation, the email address, the computer fingerprint or the deployment identifier.
• Updates and downloads: the software sends no data to find out whether a new version exists. As with any download, your IP address is known to the service contacted.
• The dictadoc.fr website: no cookies, no audience measurement tool and no forms. The host processes visitors' IP addresses to serve them the pages.

• Selling, delivering and activating licences: performance of the contract (Article 6(1)(b) GDPR).
• Issuing and keeping invoices: legal obligation (Article 6(1)(c)).
• Answering your requests: performance of the contract, or the Publisher's legitimate interest in answering the people who contact it (Article 6(1)(f)).
• Granting only one trial per computer, limiting abuse and securing the licence service: the Publisher's legitimate interest (Article 6(1)(f)).

Your email address is needed to receive your key: without it, the licence cannot be delivered. The Publisher does not use your data for advertising, does not sell it and sends you no newsletter. The limit on trials per network applies automatically, but it has no legal effect on you and does not stop you from buying a licence.

• Purchase and licence data: for the term of the licence, then five (5) years after it expires, the limitation period for legal claims.
• Computer fingerprint for a free trial: three (3) years after the trial.
• IP address fingerprint: seven (7) days.
• Technical logs: thirty (30) days.
• Support messages: three (3) years after the last exchange.
• Invoices: ten (10) years, as required by Article L. 123-22 of the French Commercial Code (Code de commerce).

Your data is accessible only to the Publisher and to the providers that help it deliver the service, each for its own part:

• Stripe Payments Europe, Limited (Ireland): payment and invoices;
• Google Cloud France SARL (Firebase): hosting of the licence service, its database and its logs, and of the dictadoc.fr website;
• Resend, Inc. (United States): sending licence emails;
• Proton AG (Switzerland): the dictadoc@proton.me support mailbox;
• Google (Gmail): the mailbox that receives replies to licence emails and the service's technical alerts;
• Scaleway SAS (France): storage of downloadable files.

Hugging Face, Inc. (United States) is not a provider of the Publisher. The software contacts it directly to download some models, and Hugging Face then processes your IP address under its own privacy policy. Your data is never sold.

Some data is processed outside the European Union:

• the licence service and the Gmail mailbox run on Google servers, including in the United States;
• Resend and Stripe may process data in the United States;
• Proton processes messages in Switzerland.

Transfers to the United States rely on these providers' certification under the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses. Switzerland benefits from an adequacy decision of the European Commission.

• Exchanges between the software, the website and the licence service are encrypted (HTTPS/TLS).
• No client software can access the licence service's database: only its server functions read and write it.
• The service's keys and secrets are kept in a secrets manager, not in the code.
• To limit trials, the Publisher keeps a fingerprint of the IP address, not the address itself.
• On your computer, the Dictadoc database is encrypted, and its key stays in your operating system's keychain.

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and the right to set instructions on what happens to it after your death. Erasure does not apply to data the law requires to be kept, such as invoices.

To exercise these rights, write to dictadoc@proton.me. The Publisher answers within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr).

The dictadoc.fr website sets no cookies and stores nothing in your browser. It uses no audience measurement tool and no third-party content. A buy button takes you to Stripe's payment page, which applies its own cookie policy.

The Publisher may change this policy to reflect changes in the software or the law. The date of the last update is shown at the top of this page.