Privacy Policy

What this policy covers

This policy explains what personal data we collect, why, how long we keep it, and your rights. It applies to our website (indxr.ai) and app (app.indxr.ai). It does not cover the content of the videos you transcribe — those are public videos or files you provide, and we don’t treat their content as data about you.

What we collect

When you create an account, we collect your email address and a securely hashed password — we never see your actual password. If you sign in with Google, we receive your email and basic profile information from Google.

As you use the service, we record which videos, playlists, and files you transcribe, the transcripts saved in your library, your credit balance and transaction history, and which export formats you use.

When you buy credits, payment is handled entirely by Stripe. We receive a confirmation and an invoice record — we never see or store your card details.

We also measure how the service is used — which features are popular, where people run into trouble — to improve the product. Our product analytics is cookieless and EU-hosted: no tracking cookies, no profile that follows you across sessions or sites, and we remove your IP address. We route it through our own domain so it stays reliable, we never sell it, and we honour your browser’s Do-Not-Track setting.

Separately, if you arrive from a Google ad and give consent, we use Google Ads to measure which ad led to a signup or purchase. That sets one cookie (_gcl_au) and nothing else — no advertising profile, no data sold. Without your consent this cookie is never placed and no request goes to Google. You can accept, decline, or withdraw at any time via “Cookie settings” in the footer (withdrawing also deletes the cookie). See the cookie table below.

A saved transcript can show the original video in an embedded player. Nothing from YouTube loads until you choose to open that player, and when it does it loads from YouTube’s privacy-enhanced (no-cookie) domain — it sets no cookie until you press play. If you never open the player, YouTube is never contacted.

What we never do with your transcripts

We never read, analyse, sell, or train models on the content of your transcripts. When we look at how the service is used, we look at patterns — which types of videos are transcribed, which formats are exported, where people get stuck — never at what your videos actually say. We have no reason to: we don’t build transcription models ourselves. The content of your transcripts is yours, and it stays that way.

Why we process your data, and on what basis

We process your account and login data, your transcripts, and your payments in order to provide the service you signed up for — this is necessary to perform our contract with you. We keep payment records to meet our legal obligations under Dutch tax law. We use anonymised, aggregated analytics to understand and improve the product, which is our legitimate interest. If you opt in, we send you product updates by email, based on your consent, which you can withdraw at any time.

How long we keep your data

We keep your account and transcripts for as long as your account is active. You can delete individual transcripts at any time — they’re removed from your library immediately. You can delete your entire account, and everything that identifies you, from your account settings — this removes your account and all your personal data.

Uploaded audio is never stored on our systems. It’s sent to our transcription provider only to create your transcript, then deleted — there is no lasting copy on our side.

When you delete a transcript, we may keep a copy of the transcribed text or captions — linked to the video, not to you — so we don’t have to re-process the same public video for other users. This copy contains no personal data and can’t be traced back to you.

We keep payment and invoice records for 7 years, as Dutch tax law requires.

Who we share data with

We rely on a small number of trusted providers to run the service, each bound to protect the data they handle. Payments are processed by Stripe. Our database and authentication run on Supabase, hosted in the EU. AI transcription and the optional AI summary are provided by AssemblyAI, which processes your audio and transcript on servers inside the EU, and does not use your audio to train its models. File storage is provided by Cloudflare. Error monitoring is provided by Sentry. We also use providers for proxying public video data, for sending email, and for our own product analytics. If you consent to ad measurement, Google Ireland Ltd provides Google Ads conversion measurement and advertisement attribution. Some of these providers are based outside the EU; where that’s the case (including the Google transfer to the United States), the transfer is protected by the European Commission’s Standard Contractual Clauses.

Your rights

Under the GDPR you can access the personal data we hold about you, correct it, delete it, object to how we process it, and receive a copy in a portable format. You can delete your account and its data from your settings, or by emailing us. To request a copy of your data, email privacy@indxr.ai and we’ll provide it. You can withdraw marketing consent through the unsubscribe link in any marketing email. For any other request or complaint, email us — and you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

INDXR.AI is not intended for children under 16, and we don’t knowingly collect their data.

Cookies

We keep cookies to a minimum. There are exactly two, and they are different in kind:

Our product analytics is cookieless (see above). To accept, decline, or withdraw the advertising cookie, use “Cookie settings” in the footer — withdrawing deletes _gcl_au on both sites.

Changes to this policy

If we make significant changes, we’ll update the date above and let you know by email or in the app.