Privacy Policy

What we collect

Account information

When you create an account we store your email address, the hashed form of your password, and an internal user ID. Our authentication provider hashes the password; we never see or store it in plaintext. We also keep authentication metadata such as confirmation and last-sign-in times.

API keys

We generate API keys and show each one to you once. We store only a cryptographic hash, so a key cannot be recovered from our database. Alongside the hash we keep a creation time, an optional per-key request limit (60 requests per minute by default) and a revocation time.

Audio you upload

Uploaded audio is stored in a private storage bucket, in a folder scoped to your user ID. Files are limited to 25 MB and to the audio and video formats we accept. Database policies allow an authenticated user to read or delete only their own folder, and no file is served from a public URL.

Transcripts and job data

For each transcription job we store the transcript text, timestamped segments, word-level timestamps where the model provides them, the detected language, a confidence score, which provider handled the job, the storage path of the audio, the minutes charged, and creation and completion times. Transcripts and job history are visible in the dashboard.

Credit and payment records

We keep an append-only ledger of minute movements on your account: grants, reservations, charges and releases, each with a timestamp, an event type, and the number of minutes. When billing is enabled, payments are handled by Stripe. We never see or store your card number; we store a Stripe customer identifier, the packs you bought, the amounts, and the minutes those purchases granted.

Technical data

To run and protect the service we keep per-minute request counters tied to your API key or account, records of active transcription jobs, and application logs that may include your IP address, user agent, request path and timestamps. Job failure reasons are currently recorded in server logs rather than shown in the dashboard.

How your audio is processed

Producing a transcript means sending your audio to a third-party inference provider. The current pipeline is:

1. Your audio is uploaded directly from your browser or API client to our storage provider.
2. On submission we read the file's duration on the server to work out how many transcription minutes to reserve.
3. The audio is sent to OpenRouter, a third-party model gateway, to reach a speech-to-text model.
4. The model provider that OpenRouter routes to performs the transcription and returns text and timestamps.

So your audio is handled by our sub-processors and by whichever speech-to-text provider OpenRouter routes to. That routing can change as we improve the service, and the provider that handled a given job is recorded on that job.

WhatsApp transcription bot

QuantClarity runs a WhatsApp number that replies to voice notes with a transcript. It uses the WhatsApp Business Platform operated by Meta. When you message it:

• Meta delivers your message to us with your WhatsApp phone number, your WhatsApp profile name, a message ID and, for a voice note, a link to the audio.
• The first time you send a voice note, we create a QuantClarity account for your phone number. It starts with the same free minutes as any new account, and your voice notes use them up.
• We download the voice note from Meta and transcribe it through the QuantClarity API, so the audio and transcript are stored and processed as described above under 'What we collect' and 'How your audio is processed'.
• We send the transcript back to you through WhatsApp. If you send something other than a voice note, we reply asking for one.

We store your phone number with that account to keep track of your minutes and, if you buy more, your billing, and we use it to reply to your messages. We do not add you to any list or message you first. Message IDs and error details may appear in our application logs. Meta processes your messages under its own terms and privacy policy.

Deleting your WhatsApp data

To have your WhatsApp account deleted, email support@quantclarity.com with the phone number you messaged from. We will delete the account, your phone number, and the audio files, transcripts and job records from your voice notes, and confirm by email, except records we are legally required to retain. Messages in your WhatsApp chat are stored by WhatsApp; delete them in the app.

How we use your data

• To provide the service: authenticate you, accept uploads, run transcriptions, and return transcripts.
• To bill you accurately and keep your minute balance correct.
• To secure the service and prevent abuse, including rate limiting and capping concurrent jobs per account.
• To diagnose failures and improve routing, model selection and reliability.
• To meet legal, tax and accounting obligations.
• To send you service messages about your account. We do not send marketing email.

Why we are allowed to use it

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you, for running the service and billing; our legitimate interests, for security, abuse prevention and service improvement, balanced against your interests; compliance with a legal obligation, for tax, accounting and fraud prevention; and consent, where you have given it. You can withdraw consent at any time by contacting us.

Who we share it with

We do not sell personal data and we do not share it for advertising. We share it only with the service providers needed to operate the service, and where the law requires it or to protect anyone's rights.

• Our database, authentication and object storage provider (Supabase), which holds your account data and your audio.
• Our hosting provider (Vercel), which runs the website, dashboard and API.
• OpenRouter, the model gateway that receives your audio for transcription.
• The speech-to-text model provider that OpenRouter routes to.
• Stripe, for payment processing, billing records and the customer portal, once billing is enabled.
• Resend, for transactional and authentication emails (including account confirmation and password reset).
• Sentry, for real-time error tracking, diagnostic crash reporting, and system reliability monitoring.
• Google Analytics, for aggregate website and dashboard usage statistics.
• Meta Platforms (WhatsApp Business Platform), which delivers messages to and from our WhatsApp transcription bot.

Each of these acts as a sub-processor under a data processing agreement or equivalent terms. We may update this list as the service changes; material changes will be noted on this page with a new 'Last updated' date.

International transfers

Our primary database and storage run in [REVIEW: Supabase project region], and the site is delivered from a global hosting network, so some processing may happen outside your own country. Where personal data is transferred out of the EEA or the UK, we rely on an adequacy decision or on standard contractual clauses with the recipient.

How long we keep it

Uploaded audio: there is currently no automated deletion schedule. An audio file is kept until you delete it or close your account.

Transcripts and job history: kept until you delete them or close your account. Credit ledger entries are kept while your account is open and for as long as tax and accounting law requires afterwards. Backups containing this data are overwritten on our provider's normal schedule.

How we protect it

Traffic is encrypted in transit. Audio storage is private and is reached only through short-lived signed URLs and owner-scoped database policies, so one account cannot read another's files. API keys are stored hashed, and rate limits plus a per-account cap on concurrent transcriptions limit abuse. No system is perfectly secure, so please do not upload audio you could not afford to lose.

Your rights and controls

Depending on where you live you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and complain to your local data protection authority. To exercise any of these, email us. We will verify your request, respond within the period the law requires, and may limit what we can release where it would expose another person's data.

You can delete your own uploaded audio at any time. Closing your account deletes your API keys, jobs, transcripts and credit history, except records we are legally required to retain.

Cookies

The dashboard and API rely on a session cookie issued by our authentication provider to keep you signed in. Our website and dashboard also use Google Analytics, which sets first-party cookies (such as _ga) to count visits and understand how pages are used. We do not use advertising cookies or cross-site tracking, and Google Analytics never receives your audio or transcripts.

Children

QuantClarity is intended for professional and business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We update this page when our practices change and revise the 'Last updated' date. If a change materially affects your rights, we will tell you by email or in the dashboard before it takes effect.

Contact

QuantClarity. Email: support@quantclarity.com. Contact address: abdul@quantclarity.com.