DokitscriptSecurity & Privacy
This page answers the questions people actually ask before trusting a transcription tool with their content. It describes what we do today, not what we intend to do. For the full legal text, see our Privacy Policy and Terms of Service.
Does Dokitscript use my data to train AI models?
No. Not on any plan, and not on free or anonymous use either.
There is no training dataset and no training export. Your audio, your transcriptions and the AI outputs generated from them are returned to you and kept for you: they are never repurposed as training material, and they are never sold.
Because no training takes place, there is no setting to change and no request to make. If this ever changes, we will say so before it takes effect, not after.
Are my videos and audio files stored?
Video files are never stored. Audio is downloaded temporarily to produce your transcript, then deleted.
With an account, the compressed audio may be kept for up to 90 days so you can replay it alongside the transcript: for every transcription on paid plans, and for one transcription per month on the Free plan. Anonymous use never keeps audio. After 90 days it is deleted automatically: this is enforced by a scheduled job, not by a manual clean-up.
Your transcripts stay available for as long as your account is active, with no cap on how many you keep. You can delete any individual transcript at any time from your history.
Transcriptions made without an account are kept for 30 days, so that the same browser can add them to an account created in that time. After 30 days their text, timestamps, speaker labels, AI results and the name of any uploaded file are erased automatically; only an anonymous record used for statistics remains, with nothing that identifies you.
Are my transcriptions backed up?
Yes. A full backup runs every day, is encrypted with AES-256 before it leaves our systems, and is stored in the European Union.
Backups are kept for 30 days, then deleted automatically. They are written to storage that is separate from the rest of the service, so that a problem on one side cannot take the other with it.
We also test the restore procedure rather than assuming it works. A backup that has never been restored is a hypothesis, not a safeguard.
Being honest about the limit: backups run daily, so a serious incident could cost up to 24 hours of the most recent data.
Where is my data stored?
Backups are stored in the European Union under a data residency commitment, not merely "somewhere in Europe".
Other data may be processed outside the EU or UK by our infrastructure providers. When that happens, transfers rely on a legally recognised mechanism, such as the European Commission's Standard Contractual Clauses, their UK equivalent, or an adequacy decision. This is described in section 16 of the Privacy Policy.
Does Dokitscript store my payment card details?
No. Card details are handled entirely by our payment provider and never reach our servers.
We store a customer reference and your invoice history so you can access your receipts: nothing else related to payment.
How are my password and account protected?
Passwords are hashed with bcrypt and are never stored in a readable form, not even we can see them.
- Two-factor authentication with an authenticator app, available on every account.
- HTTPS everywhere, so traffic is encrypted in transit.
- Rate limiting on sign-in and other sensitive endpoints, to slow down automated attacks.
- Sign in with Google, if you prefer not to manage another password.
Who can access my transcriptions?
You can. Access by our team is restricted to what is necessary to operate the service, respond to a support request, prevent abuse or meet a legal obligation.
Transcripts are private by default. A transcript becomes readable by others only if you generate a share link for it yourself, and you can revoke that link at any time.
Can I export or delete my data?
Yes, and you can do it yourself: no support ticket required.
- Download any transcript, at any time.
- Delete transcripts individually from your history.
- Delete your entire account from your account settings. Your account, transcripts and stored audio are erased; what we keep afterwards, and why, is listed in the next section.
If you are in the EU or the UK, you also have the rights of access, correction, portability, restriction and erasure. Write to [email protected] and we will action it.
What happens to my data after I delete my account?
Your account, transcripts and stored audio are erased when you delete your account. A short list of items is kept, each for a stated reason and duration.
Your support messages, API keys and saved workflows are erased as well. Usage statistics are kept in anonymised form, no longer linked to you. What we keep, and why:
| What is kept | For how long | Why |
|---|---|---|
| A one-way hash (SHA-256) of your email address, your device fingerprint as we received it, and two indicators (free trial used, welcome discount used) | 90 days | Stops free accounts from being re-created in a loop. It lets us recognise the same address if it signs up again; the address itself is not stored. |
| If you used the welcome discount or had a paid plan: a hash of your email address and of its normalised form, your device fingerprint and payment provider customer reference as we received them (these two are not hashed), your plan, and an internal account reference | No expiry date | So that the first-month discount cannot be obtained twice. |
| Payments and invoices (amounts, dates, the email address on the payment) and your prepaid balance history | As long as accounting and tax law requires | Accounting and tax obligations we cannot waive. |
| Support conversations, only if you paid in the 120 days before deleting your account | Until 120 days after your last payment, then erased automatically | To be able to answer a bank dispute. Attached images are erased straight away. Without a recent payment, conversations are erased straight away too. |
| Bank dispute (chargeback) and fraud-alert records linked to payments | As long as necessary to establish or defend a legal claim | Legal defence. |
| Encrypted daily backups | Up to 30 days | A deleted account stays in the backups until the 30-day rotation replaces them. |
This table is the short version. Section 8 of the Privacy Policy gives the full list, including anonymised statistics and our internal security log.
Who processes my data on your behalf?
A small number of providers, each for a specific and limited purpose.
They cover hosting and databases, file storage, payment processing, transactional email, and the AI processing behind transcription and the AI features. Each one receives what it needs to perform its function. The recipients are listed in section 6 of the Privacy Policy.
We do not sell your personal data. Not to anyone, under any plan.
What are you not claiming?
We would rather tell you where the limits are than let you assume protections that do not exist.
- We do not hold ISO 27001 or SOC 2 certification today.
- Backups are daily, not continuous: see the limit noted above.
- No online service can promise absolute security, and we will not pretend otherwise.
Reporting a security issue
If you believe you have found a vulnerability, please write to [email protected] with enough detail for us to reproduce it. We will acknowledge your report and keep you informed. Please do not publish it before we have had a reasonable opportunity to fix it.
For anything else: [email protected] for help with your account, [email protected] for privacy and data protection requests.