Privacy Policy

1. Who We Are

Speechbox is operated by Danielle Dafni, Tel Aviv, Israel. We provide a video transcription and AI content generation platform at prism.speechbox.ai. Contact: contact@speechbox.ai.

2. Information We Collect

• Account data: Name and email address, collected via Google OAuth at sign-in.
• Video content: Videos you upload for processing. Stored in Cloudflare R2 and processed by our AI pipeline.
• Generated content: Transcripts, quotes, social posts, and other assets created from your videos.
• Speaker face data: To show which speaker appears in each video, we derive numerical face representations ("face embeddings") from speaker photos you add and from faces detected in your videos. They are used only to recognise speakers within your own account. They are never shared with other customers, sold, or used to train models. They are computed on our own processing server in Germany and stored with our database provider. An account administrator can ask us to turn automatic face recognition off for the account, in which case speakers are linked by hand.
• Usage data: Number of videos processed, storage used, feature interactions, for plan enforcement and analytics.
• Payment data: Handled entirely by Our payment processor. We do not store credit card numbers or payment details.
• Email link visits: When you open a link in an email Speechbox sent you, we record that the link was visited: the time, which of our sites you visited (speechbox.ai, prism.speechbox.ai or demo.speechbox.ai) and the type of page, your device type (mobile or desktop), and whether you interacted with the page. This record is linked to the email address we wrote to. We do not use tracking pixels.
• Publishing to LinkedIn: If you choose to publish a clip or a written post to LinkedIn from a speaker kit or an agenda page, you sign in with LinkedIn and we receive your LinkedIn name, profile photo, member ID and a temporary access token. We use them only to show you who is posting and to publish the post you reviewed and approved. The post text shown to you was prepared for you and you can edit the text before publishing. The organizer of the kit or page may add a mention of, or a link to, their LinkedIn page at the end of every post; it is shown to you before you publish and cannot be edited there. If you do not want it, copy the text and post it yourself. Your access token and name are held only in an encrypted cookie in your browser, for up to 10 minutes, and are removed when publishing starts. We do not store the access token, your name, your photo or the text of your post on our servers. We keep a one-way keyed hash of your member ID, the IDs of the sign-in, the uploaded video and the published post, for a written post a one-way fingerprint of the prepared text it was published from, whether you edited the prepared text, and the publishing status, to prevent duplicate posts, to enforce daily limits and to show the owner what was published. The owner of the kit or page sees how many posts were published from it and of which type; for a kit, the owner and the people they give access to also see each post: the clip or the prepared text it was published from, and when. Speechbox never shows them who published it or whether you edited the text; a mention of their page is visible to that page's admins on LinkedIn, like any mention, but Speechbox never tells them who published. We do not revoke the access token when you finish; it expires on LinkedIn's schedule, and you can remove Speechbox's access at any time in your LinkedIn settings.
• Connecting YouTube in the customer portal: An administrator of a customer portal may connect one or more YouTube channels to the account, so that its videos and clips can be uploaded to them from the portal. Speechbox uses YouTube API Services to do this. By connecting a channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. With your permission we upload the videos and clips you choose to the channel, and we read the channel's name, handle, picture and upload limits and the status of the videos we uploaded. We store an encrypted token for each connected channel, the channel's name, handle and picture, and for each upload the title, description, tags and privacy setting you chose, its status and the YouTube ID of the video. We use this data only to upload the videos and clips you choose and to show the account their upload status in the portal. Speechbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. To stop our access, remove the channel in the portal (Settings, Connectors), which deletes its token at once, or remove Speechbox from your Google Account at https://myaccount.google.com/permissions. If you remove Speechbox from your Google Account instead, we remove that channel and its token from the portal 7 days after Google first refuses our access. Within 7 days of a channel being disconnected, in the portal or after Google access is removed, we delete its name, picture and ID and the YouTube IDs of the videos uploaded to it from our records.

3. How We Use Your Information

• To provide and improve the Service.
• To process your videos and generate content assets.
• To manage your account and enforce plan limits.
• To communicate with you about your account.
• To comply with legal obligations.

4. Sub-processors

We work with the following third-party processors:

• AssemblyAI - transcription of your video audio.
• Google Gemini - AI generation of content assets from transcripts.
• Cloudflare R2 - cloud storage for uploaded videos.
• Supabase - database for user and usage data.
• Our payment processor - payment processing.
• Vercel - hosting and infrastructure.
• Hetzner Online GmbH (Germany) - our media processing server: face embeddings, active-speaker detection and video processing.
• Resend - sending service emails about your account and your content.
• Sentry - error monitoring, to find and fix technical problems.
• Umami - privacy-friendly website analytics.
• Google Analytics - aggregated, IP-anonymized usage analytics. No advertising or cross-site personalization signals.
• LogRocket - anonymized product session analytics to diagnose issues.
• LinkedIn - sign-in and publishing, only when you choose to publish a clip or a written post to your LinkedIn profile.
• YouTube (Google) - uploading videos and clips, only to channels a portal administrator connected and only when someone with access to the portal chooses to upload.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data and uploaded content within 30 days, unless retention is required by law. For publishing to LinkedIn, failed attempts are deleted after 30 days, and after 90 days the hashed member ID, the text fingerprint and the sign-in, video and post IDs are removed from every publishing record. Because we do not store who you are, to have your LinkedIn publishing records deleted sooner, send us the link to your LinkedIn post at the address below.

For YouTube channels connected in the customer portal, a channel's token is deleted when the channel is disconnected, or 7 days after Google first refuses our access if you remove it from your Google Account, and within 7 days of either the channel's name, picture and ID and the YouTube IDs of the videos uploaded to it are deleted from our upload records. Uploads that failed or were cancelled are deleted after 30 days. The record of when channels were connected and disconnected names a channel only by a one-way hash and is deleted after two years.

Speaker face data is kept only while the speaker record and your account are active. It is deleted together with the video it came from or the speaker record it belongs to, and within 30 days after your account is closed. When two speaker records are merged, a copy needed to undo the merge is kept for 30 days and then deleted. A speaker who wants their face data removed can write to the address in section 11; we delete it within 30 days and confirm in writing.

Records of visits to links in our emails are deleted after 180 days. To opt out of this measurement, or to have these records deleted sooner, contact us at the address in section 11.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict processing.
• Export your data.

To exercise these rights, contact us at contact@speechbox.ai.

7. Cookies

We use session cookies for authentication, and Google Analytics and LogRocket for product analytics to help us improve the Service. We do not use advertising cookies.

8. Security

We implement industry-standard security measures including encrypted storage, HTTPS, and access-controlled infrastructure.

9. International Transfers

Our sub-processors may process your data in the United States or other countries. By using the Service, you consent to such transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email.

11. Contact

For privacy questions: contact@speechbox.ai.