Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how VoicePad ("Software," "Application," "we," "us," or "our"), developed by Bogdan-Alexandru Raducu ("Developer," "Data Controller"), processes personal data in connection with the VoicePad desktop application.

This Policy applies to:

• The VoicePad desktop application for Windows
• The VoicePad website at https://hoermal.app/voicepad
• Any related services, support, or communications

2. Data Controller Information

3. Data We Process

3.1 Data Processed Locally Only (Never Collected by Us)

Data Category	Processing Purpose	Retention
Voice/Audio Input	Real-time speech-to-text conversion	Immediate deletion from RAM; never saved to disk
Transcribed Text	Display and transfer to your applications	Exists only in your system clipboard
Application Settings	Your local preferences	Stored locally in encrypted configuration file

3.2 Data We May Process (With Legal Basis)

Data Category	Purpose	Legal Basis (GDPR)	Retention
Email Address	License activation, subscription management	Art. 6(1)(b) - Contract	Subscription + 90 days
License Key	Subscription validation	Art. 6(1)(b) - Contract	Subscription + 90 days
Machine ID (hashed)	Device limits, fraud prevention	Art. 6(1)(f) - Legitimate interest	Subscription + 90 days
Transaction ID	Payment verification, refunds	Art. 6(1)(b) - Contract	7 years (tax compliance)
Crash Reports (optional)	Stability improvement	Art. 6(1)(a) - Consent	90 days

3.3 Data We Never Collect

• ❌ Voice recordings or raw audio data
• ❌ Transcribed text content
• ❌ Keystrokes, screen content, or clipboard data
• ❌ Documents, files, or user-generated content
• ❌ Location or GPS data
• ❌ Browsing history or internet activity
• ❌ Contact lists, calendar, or personal files
• ❌ Biometric data (beyond voice-to-text processing)
• ❌ Health, financial, or other sensitive personal data

4. How We Process Data

4.1 Voice-to-Text Processing

VoicePad uses OpenAI Whisper, an open-source AI speech recognition model that runs entirely on your local device:

1. Audio Capture: Your microphone captures audio when you activate dictation
2. Local Processing: The Whisper AI model processes audio in your device's RAM
3. Text Output: Converted text is sent to your active application or clipboard
4. Immediate Deletion: Audio data is immediately discarded from memory
5. No Network Transmission: No audio data ever leaves your device

4.2 License Validation

When you activate your license:

1. Your license key is validated via our payment processor
2. A cryptographically signed activation certificate is stored locally
3. After activation, VoicePad operates fully offline
4. Annual renewal requires brief online verification
5. 30-day offline grace period if renewal verification is unavailable

4.3 Payment Processing

All payments are processed by Lemon Squeezy (Lemon Squeezy, LLC), acting as Merchant of Record:

• We never receive, see, or store your payment card details
• Lemon Squeezy handles all payment processing, tax calculation, and compliance
• Your payment data is governed by Lemon Squeezy's Privacy Policy

5. Third-Party Services

Service Provider	Purpose	Data Shared	Privacy Policy
Lemon Squeezy (USA)	Payment processing, license keys	Email, payment info	View
Supabase (USA)	License validation	License key (hashed), machine ID (hashed)	View

Important: OpenAI Whisper runs locally on your device. No data is sent to OpenAI or any cloud AI service.

6. Data Security

Security Measure	Implementation
Encryption at Rest	AES-256-GCM for stored license data
Encryption in Transit	TLS 1.3 for all network communications
Key Management	Per-installation cryptographic keys
Data Minimization	Collection limited to strictly necessary data

7. Data Retention

Data Type	Retention Period
Voice/Audio	0 seconds (never stored)
License Data	Subscription + 90 days
Transaction Records	7 years (tax compliance)
Support Communications	3 years after resolution
Crash Reports	90 days

8. Your Rights Under GDPR

As a data subject under GDPR (EU) 2016/679, you have the following rights:

Right	Description
Access (Art. 15)	Obtain confirmation of processing and access to your data
Rectification (Art. 16)	Correct inaccurate or incomplete data
Erasure (Art. 17)	Request deletion ("right to be forgotten")
Restriction (Art. 18)	Limit processing in specific circumstances
Portability (Art. 20)	Receive data in structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interests
Withdraw Consent (Art. 7)	Withdraw consent for optional processing
Lodge Complaint (Art. 77)	File complaint with supervisory authority

To exercise your rights, email: contact@hoermal.app. We respond within 30 days.

9. Automated Decision-Making

VoicePad does not engage in automated decision-making or profiling that produces legal effects or significantly affects you. The AI speech recognition is solely for text conversion at your direction.

10. Children's Privacy

VoicePad is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children under 16.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices. Material changes will be communicated via:

• In-app notification at least 30 days before changes take effect
• Email notification (if subscribed)
• Updated "Last Updated" date on this Policy

12. Contact and Supervisory Authorities

Supervisory Authorities

Country	Authority	Website
Germany (Baden-Wurttemberg)	LfDI Baden-Wurttemberg	baden-wuerttemberg.datenschutz.de
Romania	ANSPDCP	dataprotection.ro