Privacy policy

1. Personal data we collect

We collect only what we need to operate the Service. The categories are:

• Account & identity data — when you sign in with Apple or Google, we receive a stable user identifier and, depending on your provider settings, your name and email address. If you use Sign in with Apple's private email relay, we receive only the anonymised @privaterelay.appleid.com address and never your real email. We never receive your Apple or Google password.
• Voice recordings — when you dictate, the audio you record is captured on your device and sent to our backend to be transcribed and polished (see §3). Audio recorded solely to train your on-device personal voice profile stays on your device and is not uploaded.
• Transcripts & dictation content — the text produced from your speech, and any AI-polished version of it, are processed to return the result to you.
• Subscription & transaction data — your plan, trial status, and entitlement. For purchases made through our website or app, payment is processed by Lemon Squeezy, our Merchant of Record (see §4); for purchases made through the Apple App Store, payment is handled by Apple. Your full card and payment details are handled by those providers, not by us; we receive only the confirmation, status, and a customer/subscription reference needed to grant access and let you manage your subscription.
• Usage & diagnostics data — limited technical and product-analytics data such as request identifiers, feature events, error codes, timestamps, and IP address, used to operate, debug, and secure the Service.
• Device & operating-system data — device model, operating-system version, app version, and similar technical attributes used for compatibility and troubleshooting.

2. Why we use your data & our lawful bases

We process personal data for the purposes below. Under UK GDPR / EU GDPR Art. 6 (and, for voice, Art. 9), each purpose has a lawful basis:

• To provide the Service — creating and maintaining your account, transcribing your speech, producing polished text, and managing your subscription. Lawful basis: performance of our contract with you.
• To process your voice — capturing, transmitting, and transcribing dictation audio. Lawful basis: your explicit consent (see §3).
• To secure and improve the Service — diagnostics, abuse prevention, debugging, and aggregate operational analytics. Lawful basis: our legitimate interests in running a secure, reliable product, balanced against your rights.
• To measure product use and our campaigns — optional website analytics and attribution of our own Google Ads from click to selected in-app milestones. Lawful basis: your consent.
• To meet legal obligations — for example tax, accounting, and responding to lawful requests. Lawful basis: compliance with a legal obligation.

Where we rely on consent you may withdraw it at any time; where we rely on legitimate interests you may object (see §8). We do not sell your personal data, and we do not use it for advertising.

3. How voice dictation works

Voice is sensitive personal data, so we treat it with particular care. When you start a dictation:

• the audio is captured on your device;
• it is sent securely to the Clavio backend over an encrypted connection;
• it is processed by our AI sub-processors to transcribe the speech to text and, if you use polishing, to refine that text (see §4);
• the resulting text is returned to you in the app.

By recording a dictation you give your explicit consent to this processing. Dictation audio is processed transiently to generate text and is not retained by us as a persistent voice store; it is handled by our transcription sub-processor under their terms. Your personal voice profile — the model used to recognise your voice — is created and stored on your own device and is not uploaded to us.

Your voice recordings and transcripts are not used to train AI models— neither ours nor our sub-processors' shared, cross-user models. You can withdraw consent at any time by stopping use of dictation and, if you wish, deleting your account (§7).

4. Sub-processors

We share the minimum data needed with carefully selected providers who process it on our behalf under data-protection terms. Our current sub-processors are:

• Anthropic — large-language-model processing to polish transcribed text.
• OpenAI (Whisper) — speech-to-text transcription of dictation audio.
• Groq — may be used as the configured speech-to-text provider for dictation audio. Groq processes inference data under its service terms and the data controls configured for our account.
• Lemon Squeezy — payment processing and subscription billing for purchases made through our website or app. Lemon Squeezy acts as our Merchant of Record, which means it is the seller of record and handles payment, invoicing, and sales-tax/VAT. It receives your name, email address, billing and payment information, and country (for tax determination).
• Apple — sign-in and identity verification (Sign in with Apple).
• Google — sign-in and identity verification (Google Sign-In).
• Mixpanel — consented product analytics, using its EU data endpoint with IP-based geolocation disabled.
• AppsFlyer — consented Google Ads attribution between the website, Mac download, and selected in-app milestones.
• Railway — application hosting and database infrastructure.
• GitLab — software delivery and operational tooling.

This list may change as the Service evolves. We will update this page when our sub-processors change. Enterprise customers can request our Data Processing Addendum and the current sub-processor list at /legal/dpa.

5. International data transfers

We and our sub-processors may process personal data in countries outside the UK and the European Economic Area, including the United States. Where we transfer personal data to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards — principally the UK International Data Transfer Agreement / UK Addendum and the European Commission's Standard Contractual Clauses (EU 2021/914) — together with supplementary measures where appropriate. You can request more information about these safeguards at office@justetools.co.uk.

6. Retention

We keep personal data only for as long as we need it for the purposes described above:

• Account & subscription data — for as long as your account is active, and then deleted when you delete your account, subject to short backup-rotation windows and any retention the law requires (for example, accounting records).
• Voice recordings — not persistently stored by us; processed transiently to produce your transcript.
• Transcripts & dictation content — retained only as needed to deliver the result and any history feature you use, and removed when you delete the relevant content or your account.
• Diagnostic & usage logs — kept for a limited period and then rotated out.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption of data in transit (TLS), storage of only hashed authentication tokens rather than passwords, access controls on a need-to-know basis, and reliance on reputable infrastructure providers. No system can be guaranteed perfectly secure, but we work to protect your data in line with industry practice and our legal obligations.

8. Your data-protection rights

Subject to the conditions in applicable law, you have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to certain processing; data portability; and to withdraw consent at any time where processing is based on consent (without affecting processing already carried out).

You can delete your account and associated server-side data at any time from within the app (Settings → Account), or by emailing office@justetools.co.uk. We will respond to rights requests within the timeframes required by law.

If you are in the UK or the EU/EEA and believe we have mishandled your data, you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO) — ico.org.uk — and in the EU/EEA it is the authority in your country of residence. We would, however, appreciate the chance to address your concerns first.

9. California privacy notice (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended, gives you rights to know what personal information we collect and how we use it, to request access to and deletion of that information, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law, and we do not use sensitive personal information (such as your voice) for purposes other than providing the Service. To exercise your California rights, contact office@justetools.co.uk.

10. Children

Clavio is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

11. Cookies

Our website uses essential cookies needed to make the site work — for example, to keep you signed in and to remember your language preference — and, only with your consent, optional analytics and attribution storage (Mixpanel and AppsFlyer) that helps us understand how the site is used and whether our own Google Ads campaigns lead to downloads and selected in-app milestones. This optional storage is off by default, and the services load only after you opt in; we do not use third-party advertising cookies. The essential cookies are strictly necessary and do not require consent. You can change or withdraw your analytics consent at any time, and read the full detail — what each cookie does, its legal basis, and retention — in our Cookie Policy.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above, and we will communicate material changes in-app or by email where appropriate. Your continued use of the Service after an update means you accept the revised policy. Questions or requests: office@justetools.co.uk.